Source-linked AI summary
Context-Aware Generative Adversarial Privacy
Chong Huang, Peter Kairouz, Xiao Chen, Lalitha Sankar, Ram Rajagopal
TL;DR
The paper addresses the difficulty of publishing useful data with provable privacy when context-free methods reduce utility and context-aware methods require dataset statistics. It introduces GAP, which learns privatization mechanisms from data through a constrained minimax game between a privatizer and an adversary. Across binary and binary Gaussian mixture models, data-learned mechanisms perform as well as theoretically computed mechanisms in synthetic-data simulations.
Problem
Context-free privacy can reduce utility, while context-aware privacy requires dataset statistics and can be difficult to optimize from data.
Method
GAP learns a privatization mechanism from data using a constrained minimax game between a privatizer and an adversary, with empirical log-loss for data-driven training.
Results
Synthetic-data simulations show that GAP mechanisms perform as well as theoretically computed mechanisms for binary and binary Gaussian mixture models.
Takeaways & Limitations
GAP provides a data-driven framework for context-aware privacy without requiring access to dataset statistics.
Takeaways & Limitations
The evaluation focuses on binary and binary Gaussian mixture models, and the Gaussian-mixture analysis assumes Gaussian noise in its theoretical setting.
Abstract
from arXiv · showhide
Preserving the utility of published datasets while simultaneously providing provable privacy guarantees is a well-known challenge. On the one hand, context-free privacy solutions, such as differential privacy, provide strong privacy guarantees, but often lead to a significant reduction in utility. On the other hand, context-aware privacy solutions, such as information theoretic privacy, achieve an improved privacy-utility tradeoff, but assume that the data holder has access to dataset statistics. We circumvent these limitations by introducing a novel context-aware privacy framework called generative adversarial privacy (GAP). GAP leverages recent advancements in generative adversarial networks (GANs) to allow the data holder to learn privatization schemes from the dataset itself. Under GAP, learning the privacy mechanism is formulated as a constrained minimax game between two players: a privatizer that sanitizes the dataset in a way that limits the risk of inference attacks on the individuals' private variables, and an adversary that tries to infer the private variables from the sanitized dataset. To evaluate GAP's performance, we investigate two simple (yet canonical) statistical dataset models: (a) the binary data model, and (b) the binary Gaussian mixture model. For both models, we derive game-theoretically optimal minimax privacy mechanisms, and show that the privacy mechanisms learned from data (in a generative adversarial fashion) match the theoretically optimal ones. This demonstrates that our framework can be easily applied in practice, even in the absence of dataset statistics.
1 Introduction
Published datasets often combine useful public information with private variables vulnerable to linkage and inference attacks. GAP addresses the privacy-utility challenge by learning a context-aware privatization mechanism from data through an adversarial game, without requiring dataset statistics.
- Privacy motivation: Anonymization, generalization, and suppression do not reliably prevent correlation, linkage, or re-identification attacks on published datasets.Reported examples include de-anonymizing Netflix watch histories and identifying participants in an anonymized DNA study.
- Privacy motivation: Context-free privacy such as differential privacy offers worst-case guarantees but can substantially reduce utility and increase sample complexity.For local differential privacy, learning population histograms can require sample complexity proportional to dictionary size.
- Privacy motivation: Context-aware privacy can improve the privacy-utility tradeoff by using dataset statistics and modeling adversary capabilities, but learning privatization parameters from empirical information-theoretic losses is challenging.Mutual-information-based learning can become computationally intractable without dataset priors.
- GAP framework: GAP is a data-driven context-aware framework that learns privatization mechanisms from the dataset itself using generative adversarial networks.The learned model represents the privatization mechanism and avoids requiring access to dataset statistics.
- GAP framework: GAP formulates privacy mechanism learning as a constrained minimax zero-sum game between a privatizer that sanitizes public variables and an adversary that infers private variables.The framework seeks useful representations of public variables while limiting reliable inference of private variables, and uses log-loss to obtain tractable data-driven training.
- Evaluation: The paper studies binary and binary Gaussian mixture datasets, comparing theoretically optimal mechanisms with mechanisms learned directly from data.It also compares private-data-dependent and private-data-independent mechanisms, reporting superior privacy-utility tradeoffs for the former.
2 Generative Adversarial Privacy Model
GAP formulates privacy-preserving data release as a constrained game: a privatizer preserves utility while limiting an adversary’s inference of private variables. The framework supports multiple adversarial losses and can learn mechanisms directly from data when dataset statistics are unavailable.
- Problem setup: Each data entry contains public variables X and private variables Y, and the privacy mechanism maps them to a released representation while operating memorylessly across entries.The model assumes independently distributed entry pairs and restricts mechanisms to per-entry randomized mappings.
- Privacy mechanisms: PDD mechanisms depend on both X and Y, whereas PDI mechanisms depend only on X; the paper reports a sizeable performance gap between them.The distinction determines whether private data can influence privatization.
- Minimax formulation: GAP casts privatization and inference as a non-cooperative game in which the privatizer minimizes private-variable inference subject to a distortion constraint.The adversary chooses an inference strategy for the released data, while the privatizer balances privacy against utility.
- Adversarial models: Different loss functions yield different adversarial models, including MMSE, MAP, and belief-refining adversaries.Squared loss leads to an MMSE adversary, 0-1 loss to a MAP adversary, and log-loss to a soft decision rule.
- Adversarial models: Under log-loss, the GAP formulation is equivalent to using mutual information as the privacy metric, subject to the distortion constraint.The optimal soft adversarial rule is determined by the conditional distribution of the private variable given the released data.
- Data-driven GAP: When dataset statistics are unavailable, data-driven GAP learns privatization mechanisms through a two-player minimax game whose equilibrium defines the optimal mechanism.The framework is evaluated under binary and binary Gaussian mixture dataset models using 0-1 loss.
3 Binary Data Model
The binary data model formulates privacy as choosing a randomized mechanism that limits MAP inference of the private variable under a distortion constraint. It derives optimal PDD and PDI mechanisms and evaluates whether data-driven GAP matches theoretical solutions across privacy metrics and parameter settings.
- Binary privacy mechanisms: The privatizer randomizes binary public variable X into X̂ to reduce an adversary’s ability to infer private variable Y under a distortion constraint.PDD mechanisms depend on both X and Y, whereas PDI mechanisms depend only on X.
- PDD privacy mechanism: PDD mechanisms are represented by four conditional probabilities P(X̂|X,Y), with MAP inference accuracy computed separately for each possible privatized output.The resulting optimization minimizes the sum of two slack variables representing the output-specific maxima, subject to the distortion constraint.
- PDD privacy mechanism: The PDD optimization is a four-dimensional linear program parameterized by the joint distribution p and distortion limit D.The slack variables t0 and t1 encode the maxima in the MAP adversary’s inference accuracies, and an off-the-shelf LP solver obtains the optimal mechanism.
- PDI privacy mechanism: For PDI mechanisms under Y = X ⊕ N, infinitely many mechanisms achieve the optimal privacy-utility tradeoff, with the solution depending on q and the distortion regime.When q = 1/2, any mechanism satisfying the stated constraint is optimal; otherwise, the theorem gives separate cases based on 1 − D and max{p, 1 − p}.
- PDI privacy mechanism: For D ≥ min{p, 1 − p}, optimal PDI privacy becomes constant with distortion, so using D = min{p, 1 − p} avoids further utility sacrifice.Below this threshold, the MAP adversary’s accuracy decreases linearly with D.
- Illustration of results: Data-driven GAP closely matches theoretical mechanisms across binary settings, while adversary accuracy decreases with distortion and eventually saturates.For (p, q) = (0.5, 0.25), the maximum accuracy difference is around 3%; the same comparable performance appears for (0.75, 0.25), and mutual information reaches independence beyond a threshold.
4 Binary Gaussian Mixture Model
The binary Gaussian mixture model studies Gaussian-noise privatization mechanisms that reduce inference of binary Y under a distortion constraint. Theoretical and data-driven GAP mechanisms achieve comparable privacy performance while adapting shifts and variance scaling to the data distribution.
- Model and mechanisms: The model has binary Y and conditionally Gaussian X, with privatization schemes that are either private-data independent or private-data dependent.The PDI mechanism uses g(X)=X+β+γN, while the PDD mechanism can depend on both X and Y.
- PDI Gaussian noise adding mechanism: For PDI mechanisms, the optimal scheme adds zero-mean Gaussian noise with variance D under the distortion constraint.Theorem 2 identifies this mechanism as minimizing the MAP adversary’s inference accuracy within the PDI Gaussian noise-adding class.
- PDD Gaussian noise adding mechanism: PDD mechanisms shift the conditional Gaussian distributions toward each other and can scale their variances to reduce inference of Y.The general mechanism uses shifts β0, β1 and noise scales γ0, γ1, with expected distortion constrained by D.
- PDD Gaussian noise adding mechanism: The optimal PDD mechanism uses the full distortion budget, placing its parameters on the boundary of the distortion constraint.The general PDD optimization includes the preceding mechanisms and becomes non-convex even in a simpler equal-noise-scale case.
- Data-driven evaluation: Data-driven GAP mechanisms reduce MAP inference accuracy as distortion increases and differ from theoretical mechanisms by at most about 6% in the Gaussian mixture experiments.The learned mechanisms are comparable to theoretical mechanisms that assume access to the joint distribution of (X,Y).
- Illustration of results: When priors or variances differ, the lower-prior distribution is shifted more and the lower-variance distribution is scaled more.When priors and variances are equal, the two conditional distributions are shifted and scaled almost equally.
5 Concluding Remarks
GAP learns context-aware privatization mechanisms directly from data through a minimax game between a privatizer and an adversary. On binary and binary Gaussian mixture models, learned mechanisms match theoretically computed mechanisms, while broader data models remain future work.
- GAP learns privatization mechanisms directly from the dataset without requiring access to dataset statistics.The mechanism is learned through a game between a privatizer and an adversary, using an iterative minimax algorithm.
- The evaluation studies binary data and binary Gaussian mixture models using empirical log-loss and both private-data dependent and independent mechanisms.The resulting privacy guarantees are cross-validated against the analyzed mechanisms.
- Synthetic-data simulations show GAP-learned privacy mechanisms perform as well as mechanisms obtained from theoretical computation.
- Future work targets richer signals, deep generative models for sanitized data, data-driven mutual information privacy, and stronger adversaries.The current generative models were tailored to the statistics of the datasets considered.
A Proof of Theorem 1
The proof decomposes the privatizer’s optimization according to the adversary’s two possible inference decisions and their probability relationships. Each subproblem yields feasibility conditions and optimal solutions expressed through weighted combinations of s0 and s1.
- Subproblem decomposition: The privatizer’s objective is decomposed into four subproblems based on comparisons between joint probabilities for Y and the inferred variable.Each maximum in the inference objective corresponds to guessing one of the two values, producing four cases.
- Subproblem 1: In Subproblem 1, the privatizer maximizes ps1 + (1 −p)s0 when q < 1 2 and minimizes it when q > 1 2.The resulting optimal values and feasibility conditions depend on whether the distortion constraint reaches min{p, 1 −p} or max{p, 1 −p}.
- Subproblem 2: In Subproblem 2, q < 1 2 requires minimizing ps1 +(1−p)s0, with optimal values determined by 1−D and max{p, 1−p}.The optimization is feasible only under the stated relationships among p, q, and D.
- Subproblem 3: For Subproblem 3, the objective is P(Y = 1, ˆX = 0)+P(Y = 1, ˆX = 1), subject to bounds on s0, s1, and the distortion constraint.
- Subproblem 3: For q < 1 2 in Subproblem 3, infeasibility occurs for p < 1 2, while feasible cases have optimal value p(1−q)+(1−p)q.For q > 1 2, the corresponding infeasibility condition is p > 1 2, with the same stated optimal value in feasible cases.
- Subproblem 4: Subproblem 4 has optimal value pq+(1−p)(1−q) in its feasible cases, with feasibility and solution ranges determined by q, p, and 1−D.The q < 1 2 case is infeasible for p > 1 2, while q > 1 2 is infeasible for p < 1 2.
- Conclusion: The case analysis is summarized by Theorem 1.
B Proof of Theorem 2
The proof analyzes additive Gaussian privatization by expressing the sanitized variable as X + β + γN and optimizing the resulting inference probability. Substitution of the optimal solution yields the MAP inference accuracy.
- Theorem 2 considers sanitized data ˆX = X + β + γN, with β ∈R and γ ≥0, under the MAP adversary’s inference accuracy.
- The optimization is reduced using monotonicity in α, after showing the second term is zero and the first term is always positive.
- Substituting the optimal solution into the inference expression yields the MAP probability of correctly inferring Y from ˆX.
C Proof of Theorem 3
The proof studies class-dependent additive shifts in sanitized data and reduces the optimization through a monotonicity argument. The resulting optimal solution is substituted into the MAP inference probability.
- Theorem 3 considers ˆX = X + (1 −Y )β0 −Y β1, where β0 and β1 are non-negative.The shifts depend on the private variable Y.
- The objective is reduced using the MAP adversary’s inference accuracy and monotonicity in α = 2µ−(β1+β0) σ.
- The resulting optimization is convex, so KKT conditions are used to obtain the optimal solution.
- Substituting that solution into P (G) d yields the MAP probability of correctly inferring Y from ˆX.