Privacy Preserving Spam Filtering

Abstract

Email is a private medium of communication, and the inherent privacy constraints form a major obstacle in developing effective spam filtering methods which require access to a large amount of email data belonging to multiple users. To mitigate this problem, we envision a privacy preserving spam filtering system, where the server is able to train and evaluate a logistic regression based spam classifier on the combined email data of all users without being able to observe any emails using primitives such as homomorphic encryption and randomization. We analyze the protocols for correctness and security, and perform experiments of a prototype system on a large scale spam filtering task.State of the art spam filters often use character n-grams as features which result in large sparse data representation, which is not feasible to be used directly with our training and evaluation protocols. We explore various data independent dimensionality reduction which decrease the running time of the protocol making it feasible to use in practice while achieving high accuracy.

Pretzel: Email encryption and provider-supplied functions are compatible

“…To perform the computation described above within a function module ( §2.2) securely, i.e., in a way that the client does not learn the model parameters and the provider does not learn the feature vector, Pretzel uses secure two-party computation (2PC): cryptographic protocols that enable two parties to compute a function without revealing their inputs to each other [56,128]. Pretzel builds on a relatively efficient 2PC protocol [19,28,69,98,102] that we name Yao+GLLM; we present this below, informally and bottom up. (For details and rigorous descriptions, see [55,66,84,103].…”

“…Yao+GLLM has been applied to spam filtering using LR [98], face recognition using SVM [19], and face and biometric identification using Euclidean distance [28,69,102].…”

“…Both Pretzel's protocol and the baseline require additively homomorphic encryption (Figure 2). The traditional choice for AHE-it is used in prior works [19,69,98,102]-is Paillier [96], which is based on a longstanding number-theoretic presumed hardness assumption. However, Paillier's Dec takes hundreds of microseconds on a modern CPU, which contributes substantially to provider-side CPU time.…”

“…The paper's central example is classification, which Pretzel applies to both spam filtering and topic extraction (for completeness, the implementation also includes a simple keyword search function). Pretzel's first step is to compose (a) a relatively efficient 2PC protocol ( §3.2) geared to computations that consist mostly of linear operations [19,28,69,98,102], (b) linear classifiers from machine learning (Naive Bayes, SVMs, logistic regression), which fit this form and which have good accuracy ( §3.1), and (c) mechanisms that protect against adversarial parties. Although the precise protocol ( §3.3) has not appeared before, we don't claim it as a contribution, as its elements are well-understood.…”