Not All Features Are Equal: Discovering Essential Features for Preserving Prediction Privacy

Abstract

When receiving machine learning services from the cloud, the provider does not need to receive all features; in fact, only a subset of the features are necessary for the target prediction task. Discerning this subset is the key problem of this work. We formulate this problem as a gradient-based perturbation maximization method that discovers this subset in the input feature space with respect to the functionality of the prediction model used by the provider. After identifying the subset, our framework, Cloak, suppresses the rest of the features using utility-preserving constant values that are discovered through a separate gradient-based optimization process. We show that Cloak does not necessarily require collaboration from the service provider beyond its normal service, and can be applied in scenarios where we only have black-box access to the service provider's model. We theoretically guarantee that Cloak's optimizations reduce the upper bound of the Mutual Information (MI) between the data and the sifted representations that are sent out. Experimental results show that Cloak reduces the mutual information between the input and the sifted representations by 85.01% with only negligible reduction in utility (1.42%). In addition, we show that Cloak greatly diminishes adversaries' ability to learn and infer non-conducive features. CCS CONCEPTS• Security and privacy → Privacy protections; Usability in security and privacy; • Computing methodologies → Neural networks; Computer vision tasks; • Mathematics of computing → Information theory.

Development and evaluation of an interoperable natural language processing system for identifying pneumonia across clinical settings of care and institutions

“…Furthermore, trained machine learning models are not easily transported between institutions due to privacy concerns when they are trained on sensitive medical data. 53 Rule-based models, on the other hand, do not suffer from this limitation, and can be shared and reused easily and safely.…”

Privacy-Preserving Face Recognition with Learnable Privacy Budgets in Frequency Domain

“…The privacy budget ϵ is set to 5. (4) Cloak [25]: We run its official code. Note that when training large datasets, the privacy-accuracy parameter is adjusted according to our experiment setting, which is set to 100.…”

“…For instance, [17] used the Mixup [37] method to perturb data while it has been hacked successfully [5]. [25] presented a Gaussian noise disturbance method to suppress unimportant pixels before sending them to the cloud. Recently, some privacy-preserving methods have also appeared in the field of face recognition.…”

Formal verification and complexity analysis of confidentiality aware textual clinical documents framework

“…The authors in Reference [28] proposed a deep learning model that is capable of checking the effectiveness of privacy attacks. The authors in Reference [29] proposed an updated comparison of deep learning‐based privacy preserving methods. Most recently, in study 30 a model has been proposed to deidentify the Italian medical records over COVID‐19 data set.…”