Source-linked AI summary
Privacy Preserving Machine Learning: Threats and Solutions
Mohammad Al-Rubaie, J. Morris Chang
TL;DR
Machine learning increasingly relies on private data, creating exposure and inference risks that motivate privacy-preserving systems. This article surveys machine learning tasks, threats, cryptographic and perturbation-based protections, and implementation challenges; it notes that limiting outputs to class labels was most effective among tested mitigations but did not fully thwart membership inference attacks.
Problem
Private data is uploaded to centralized locations for machine learning, where it faces exposure and can reveal additional information even after anonymization or restricted access.
Method
The article surveys machine learning tasks, privacy threats, privacy-preserving techniques, and challenges across cryptographic and perturbation approaches.
Results
Limiting prediction outputs to the class label was the most effective tested mitigation for membership inference, although it did not fully thwart the attack.
Takeaways & Limitations
Bridging machine learning with privacy and security technologies requires considering proposed protections alongside flexibility, scalability, policy, and negotiability challenges.
Takeaways & Limitations
Many privacy-preserving techniques are tied to particular machine learning algorithms and may require repeated repurposing as machine learning advances.
Abstract
from arXiv · showhide
For privacy concerns to be addressed adequately in current machine learning systems, the knowledge gap between the machine learning and privacy communities must be bridged. This article aims to provide an introduction to the intersection of both fields with special emphasis on the techniques used to protect the data.
Introduction
Machine learning uses collected private data to learn predictions or structures, but centralized data sharing creates privacy threats ranging from exposure and reconstruction to model-based inference. The article surveys these threats and privacy-preserving solutions to bridge machine learning with privacy and security technologies.
- Motivation: Machine learning applications use increasingly collected data, including searches, browsing histories, purchases, viewing habits, and preferences.
- Privacy Threats: Private data uploaded in clear text to centralized locations is vulnerable to insider and outsider attacks, and anonymization or restricted testing outputs may still reveal additional information.
- Article Scope: The article describes machine learning tasks, privacy threats, proposed protections, and future challenges to bridge machine learning with privacy and security technologies.It aims to help professionals understand the threats, solutions, and challenges at their intersection.
- Machine Learning Background: Training uses feature vectors and labels to build models that predict labels for new samples, while feature extraction can transform raw data or reduce its dimensions.Classification and regression use labeled data; unsupervised learning instead seeks structure, commonly through clustering.
- Privacy Threats: Reconstruction attacks recover raw data from stored feature vectors, including fingerprints or touch gestures, and can threaten authentication systems.These attacks require white-box access to the model and may occur when training features remain available or are embedded in the model.
- Privacy Threats: Model inversion attacks create feature vectors resembling private samples, while membership inference attacks determine whether a sample belonged to the training set.
Privacy-Preserving Machine Learning (PPML)
Privacy-preserving machine learning uses cryptographic and perturbation techniques to train or test models while limiting exposure of private data. The approaches include encrypted computation, secret sharing, secure processors, differential privacy, and dimensionality reduction.
- Cryptographic Approaches: Cryptographic protocols enable collaborative ML training or testing without releasing private data in its original form.Approaches include encrypted computation, secret sharing, garbled circuits, and secure processors.
- Perturbation Approaches: Differential privacy adds noise to data, algorithm iterations, or outputs, while local differential privacy moves noise addition to each input party.It is especially effective against membership inference attacks; privacy loss can be quantified under composition.
- Perturbation Approaches: Dimensionality reduction perturbs data by projecting it to a lower-dimensional hyperplane, while limiting model outputs can reduce model inversion and membership inference attacks.
- Cryptographic Approaches: Homomorphic encryption computes on encrypted data, but practical PPML often uses additive schemes because frequent ciphertext bootstrapping is costly.Additive schemes support addition and multiplication by a plaintext; packing can improve efficiency.
- Cryptographic Approaches: Garbled circuits let two parties compute a function over private inputs while protecting each party’s input from the other.The function and inputs are converted into garbled forms, with oblivious transfer used for Bob’s garbled input.
- Cryptographic Approaches: Secret sharing distributes a secret across parties so individual shares are useless alone, while a threshold permits reconstruction from only t shares.
Challenges and outlook
PPML adoption remains constrained by flexibility, scalability, security assumptions, policy enforcement, and changing privacy expectations. The article points toward adaptable, distributed, and negotiable systems that give data owners clearer control.
- Flexibility: Many PPML techniques are tied to particular ML algorithms, making them difficult to adapt as new ML advances appear.Transformed data release, distributed approaches, and local differential privacy may require less customization.
- Scalability: PPML techniques can impose processing and communication costs that limit use with the large data volumes available today.Distributed methods exchanging summary statistics or model parameters are identified as promising directions.
- Security assumptions: Some PPML systems rely on non-collusion assumptions whose practical justification and service-provider incentives remain unresolved.
- Policies: Privacy policies must specify shared data, guarantees, users, and purposes, while policy enforcement raises trust concerns when computation and results parties share control.
- Human-data interaction: Human-data interaction principles emphasize legibility, agency, and negotiability for ML data sharing.Agency includes control over collection and use, while machine unlearning can adjust models built from incorrect data.
- Human-data interaction: Negotiability is needed because privacy definitions and associated threats can change over time.Systems should support revising, partially withdrawing, or fully withdrawing data-sharing decisions and policies.
15 Dwork, Cynthia and Roth, Aaron (2014) ‘The Algorithmic Foundations of Differential
This section lists references on differential privacy, private learning, PCA, randomized response, and locally private machine learning.
- The cited literature includes foundational work on differential privacy and its algorithmic foundations.
- Several cited studies address privacy-preserving principal component analysis and noisy iterative methods.
- The references also include differentially private empirical risk minimization, RAPPOR, and AnonML.
24 Liu, Kun, Kargupta, Hillol and Ryan, Jessica (2006) ‘Random projection-based
This section lists references concerning privacy-preserving data mining, differential-private data publishing, compressive privacy, human-data interaction, and machine unlearning.
- The cited work includes random projection-based privacy-preserving distributed data mining.
- The references include differential-private data publishing through component analysis and compressive privacy for machine learning.
- The section also cites work on human-data interaction and machine unlearning.