PaperlayerView exact revision on arXiv

Source-linked AI summary

Local Differential Privacy for Deep Learning

M. A. P. Chamikara, P. Bertok, I. Khalil, D. Liu, S. Camtepe, M. Atiquzzaman

arXiv:1908.02997v3cs.LGcs.CR

TL;DR

Sensitive IoT data can leak privacy when used to train deep learning models, while existing privacy-preserving approaches rely on server-centric or trusted-curator settings. The paper proposes LATENT, a local differential privacy mechanism that inserts randomized processing into CNN training before data leave the owner’s device. LATENT reports 90%-91% testing accuracy on CIFAR-10 and 95%-96% on MNIST at ε = 0.5.

  • Problem

    Deep learning trained on sensitive crowd-sourced data can expose private information, while existing privacy-preserving approaches rely on server-centric and trusted-curator settings.

  • Method

    LATENT splits a CNN into convolutional, randomization, and fully connected modules, using local randomization and the utility enhancing randomization protocol before data reach an untrusted service.

  • Results

    90%-91% testing accuracy on the CIFAR-10 dataset and 95%-96% testing accuracy on the MNIST dataset are achieved at ε = 0.5.

  • Takeaways & Limitations

    LATENT provides a distributed privacy-preserving CNN mechanism that operates without requiring a trusted curator and maintains high accuracy at a low privacy budget.

Abstract

from arXiv · show

The internet of things (IoT) is transforming major industries including but not limited to healthcare, agriculture, finance, energy, and transportation. IoT platforms are continually improving with innovations such as the amalgamation of software-defined networks (SDN) and network function virtualization (NFV) in the edge-cloud interplay. Deep learning (DL) is becoming popular due to its remarkable accuracy when trained with a massive amount of data, such as generated by IoT. However, DL algorithms tend to leak privacy when trained on highly sensitive crowd-sourced data such as medical data. Existing privacy-preserving DL algorithms rely on the traditional server-centric approaches requiring high processing powers. We propose a new local differentially private (LDP) algorithm named LATENT that redesigns the training process. LATENT enables a data owner to add a randomization layer before data leave the data owners' devices and reach a potentially untrusted machine learning service. This feature is achieved by splitting the architecture of a convolutional neural network (CNN) into three layers: (1) convolutional module, (2) randomization module, and (3) fully connected module. Hence, the randomization module can operate as an NFV privacy preservation service in an SDN-controlled NFV, making LATENT more practical for IoT-driven cloud-based environments compared to existing approaches. The randomization module employs a newly proposed LDP protocol named utility enhancing randomization, which allows LATENT to maintain high utility compared to existing LDP protocols. Our experimental evaluation of LATENT on convolutional deep neural networks demonstrates excellent accuracy (e.g. 91%- 96%) with high model quality even under low privacy budgets (e.g. $\varepsilon=0.5$).

I. INTRODUCTION

The paper addresses privacy leakage in deep learning over sensitive IoT data and proposes LATENT, a distributed local differential privacy mechanism for CNNs. LATENT places randomization before data leave the owner’s device and reports high accuracy under very low privacy budgets.

  • IoT-generated data supports deep learning across industries but often includes sensitive personal, health, and financial records.
  • Server-centric deep learning privacy methods require trusted infrastructure and can expose uploaded data to membership inference and model memorizing attacks.
  • LATENT introduces a distributed local differential privacy mechanism that limits privacy leaks in CNN models released as black-box models.
  • LATENT uses a randomization module between CNN convolutional and fully connected components, enabling privacy processing before data reach an untrusted service.

2) Probability to fail / probability of error

This section defines differential privacy mechanisms, emphasizing how global and local models randomize data and how privacy parameters govern protection. It also introduces randomized response and RAPPOR as foundations for LATENT’s bit-string randomization.

  • Differential privacy compares randomized outputs on adjacent datasets that differ by one person under the (ε, δ)-DP definition.
  • Global differential privacy uses a trusted curator to add calibrated noise, whereas local differential privacy randomizes client values before processing by the service.
  • Randomized response provides ε-differential privacy when truthful binary answers are preserved with probability p = e^ε/(1 + e^ε).
  • Sensitivity measures the maximum influence of one individual on a numeric query using the L1 distance between neighboring outputs.
  • RAPPOR encodes each input as a one-hot d-bit vector and has sensitivity 2 because adjacent vectors can differ in two bits.

E. Properties of Differential Privacy

The section reviews differential privacy properties and CNN components relevant to LATENT. It explains how postprocessing and composition support privacy-preserving CNN training with an intermediate randomization layer.

  • E. Properties of Differential Privacy: Postprocessing invariance preserves an ε-DP guarantee when additional computations operate on a differentially private output.
  • E. Properties of Differential Privacy: Composition accumulates privacy loss when multiple differential privacy algorithms operate on the same or overlapping datasets.
  • F. Deep Learning Using Convolutional Neural Networks: CNNs extract image features through convolution and pooling, flatten the final pooled representation, and pass it to a fully connected network.
  • SDN virtualizes control functions and NFV virtualizes network functions, providing a programmable infrastructure for flexible and reconfigurable IoT services.
  • LATENT combines randomized response with regularization, image augmentation, and hyperparameter tuning to optimize CNN performance under noisy inputs.
  • A. Introduction of the Intermediate Layer (LATENT) to Inject Differential Privacy into the CNN Architecture: LATENT inserts a randomization layer between the convolutional module and fully connected module to process flattened real-valued feature vectors.

1) Apply z-score normalization to LATENT’s input values:

LATENT normalizes flattened CNN outputs before binary conversion, then merges the resulting bit strings and applies randomized-response-based protocols designed to preserve utility under high sensitivity.

  • Normalization: Z-score normalization converts flattened 1-D inputs into a consistent range before binary encoding, avoiding complexity from widely varying magnitudes.Without normalization, large values or small fractions may require inconsistent numbers of bits.
  • Binary conversion: Each binary representation uses a sign bit followed by whole-number and fractional segments, with segment lengths controlling range and precision.The sign bit is 1 for negative values and 0 for positive values; more fractional bits provide greater precision.
  • Merging: Merging binary strings prevents composition across separate randomization steps from multiplying the privacy loss by the number of strings.Randomizing r separate strings would yield privacy loss r × ε.
  • Randomization: LATENT uses randomized response on the merged string, with probability p determined by the privacy budget and the string sensitivity.The merged string length is l = n + m + 1, and merging increases sensitivity, requiring more randomization.
  • Utility enhancement: OUE-inspired modifications adjust perturbation probabilities differently for zeros and ones to improve utility when binary strings contain many zeros or have high sensitivity.MOUE increases preservation of zeros through α, while UER further varies randomization across the string while maintaining the privacy budget.

7) Improving the utility of randomized binary strings:

The paper improves randomized binary-string utility by extending optimized unary encoding with flexible, asymmetric perturbation probabilities while preserving ε-LDP.

  • Utility enhancing randomization: UER applies two randomization models across different halves of a binary string to improve utility while maintaining the same privacy budget.The design increases zero preservation while balancing preservation of one bits across the two halves.
  • Modified OUE: MOUE modifies OUE with a privacy budget coefficient α, allowing more flexible control of randomization probabilities.Increasing α raises the probability of transmitting 0 bits in their original state.

8) Conduct UER on the bits of the merged binary strings:

LATENT applies UER to merged binary strings before training the fully connected module, producing a differentially private CNN model with optimization performed on randomized inputs.

  • Randomization: Each merged binary string is randomized with UER using a probability calculated from the privacy budget, string length, and privacy budget coefficient.Changing α alters the amount of randomization while maintaining the same privacy budget.
  • Optimization: Regularization, image augmentation, and hyperparameter tuning optimize the fully connected module under noisy-input conditions.These procedures are applied after training on randomized binary strings.
  • Algorithm 1: The LATENT workflow defines CNN modules, generates 1-D feature arrays, converts values to binary, merges arrays, and determines the relevant lengths.The algorithm then calculates the randomization probability before applying UER.
  • Algorithm 1: UER randomizes each merged bit string before the fully connected module is trained on the perturbed strings.The trained output is returned as the differentially private fully connected module.

C. The LDP Settings for LATENT

LATENT distributes CNN processing so convolution and randomization can occur near data owners, while an untrusted or cloud-side service trains the differentially private fully connected module.

  • LDP configurations: The data owner runs the convolutional and LATENT modules, while the untrusted curator trains the differentially private fully connected module.The released model contains only the trained DPFC module, and the local convolutional module remains untrained.
  • LDP configurations: Moving convolution to the data owner produces a dimension-reduced vector before randomization, providing additional privacy and processing flexibility.The arrangement is intended for settings with millions of data owners communicating with a server.

D. Integrating LATENT in the Amalgamation of SDN and NFV in Edge-Cloud Interplay

LATENT is integrated into an SDN+NFV edge-cloud setting by placing convolution and randomization near data owners before randomized data reach public transport and server-side processing. Experiments use separately configured CNNs for MNIST and CIFAR-10, with differential privacy adding a LATENT layer between convolutional and fully connected modules.

  • SDN+NFV integration: LATENT runs its convolutional and randomization layers at the local edge, with randomization provided as an NFV privacy service before public transport.An SDN controller manages the communication setup, while the public transport layer receives randomized inputs.
  • Datasets and architectures: The experiments use MNIST and CIFAR-10 because their contrasting difficulty provides a balanced setup for evaluating the deep-learning scenario.MNIST is described as generating good accuracy, whereas CIFAR-10 is difficult to train.
  • Datasets and architectures: The baseline study compares non-private NPCNN and differentially private DPCNN models for each dataset using corresponding CNN architectures.Figures 7 and 8 depict the MNIST and CIFAR-10 baseline architectures, respectively.
  • LATENT architecture: DPCNN inserts LATENT between the convolutional module and the fully connected module, converting flattened outputs into randomized bit strings.For MNIST, 10 bits per flattened output produce a randomized string of length 92,160 when the flattening layer has 9,216 outputs.
  • Datasets and architectures: CIFAR-10 uses a more complex CNN than MNIST, while its DPCNN increases input resolution to 56×56 and omits convolutional-module dropout.The architecture is customized because CIFAR-10 is more complex than MNIST.
  • Training configuration: Training, regularization, and hyperparameter tuning are applied to the fully connected module, with higher neuron and epoch settings selected for CIFAR-10.The tuning process sets the bit-preservation probability p=1 to represent LATENT’s nonprivate state.

3) Image augmentation to improve robustness of the DPCNN trained using CIFAR-10 :

For CIFAR-10, image augmentation addresses overfitting in the differentially private model, while LATENT maintains strong accuracy under ε=0.5. The evaluation also examines privacy-budget effects and computational burden on ordinary hardware.

  • Image augmentation: 150,000 augmented images generated from 50,000 training images stopped DPFC overfitting and yielded about 98% training and 95% testing accuracy.These results were obtained under randomization probability 1 and repeated attempts.
  • Accuracy under privacy: For MNIST at ε=0.5 and α>5, training accuracy was around 98–99% and testing accuracy around 95–96%.The passage links these results to MNIST clarity and the large feature space generated by LATENT.
  • Accuracy under privacy: 95–96% training accuracy and 90–91% testing accuracy were reached on CIFAR-10 after 50 epochs with ε=0.5.The configuration used increased image resolution, image augmentation, and best-chosen hyperparameters.
  • Privacy-budget analysis: Accuracy remained almost constant as ε changed, with α=7 producing similar accuracy for ε<10.The passage attributes the weak effect of small ε to high sensitivity values.
  • Comparison with existing methods: The comparison includes existing differentially private mechanisms and reports LATENT’s stronger accuracy at ε=0.5 than the cited baseline for CIFAR-10.The cited prior method failed to generate acceptable CIFAR-10 accuracy in that extreme privacy case.
  • Computational analysis: LATENT’s binary conversion and randomization complexity is O(l), where l is the number of digits in the convolutional output.The bit string length is l×(m+n+1), and randomization is independent for each bit.
  • Computational analysis: 0.1655 seconds for MNIST and 0.0374 seconds for CIFAR-10 were required to perturb one record on a general-purpose computer.The authors conclude that moderate hardware is sufficient for randomized-data generation in IoT or equivalent cloud settings.

V. RELATED WORK

The related work positions LATENT against privacy-preserving data-mining methods, global-DP deep-learning approaches, and cloud machine-learning deployments. It emphasizes local privacy, low owner-side burden, and high reported accuracy, while identifying broader evaluation as future work.

  • Privacy-preserving data mining: Encryption-based privacy methods can provide security and accuracy but often impose high computational complexity, whereas perturbation methods are less costly for large-scale mining.Perturbation can still allow privacy leakage because it preserves the original input or output format.
  • Differential privacy: Differential privacy is presented as a stronger privacy model than earlier approaches vulnerable to minimality, composition-based, and foreground-knowledge attacks.The discussion lists Laplace, Gaussian, geometric, randomized-response, and staircase mechanisms as DP approaches.
  • Private deep learning: Prior private deep-learning methods include distributed learning with privacy loss per model parameter and global-DP training with moments-accountant privacy tracking.The discussion notes that per-parameter accounting can accumulate substantial privacy loss across many parameters.
  • Cloud deployment: LATENT is designed for machine-learning-as-a-service settings and uses technologies associated with cloud frameworks such as scikit-learn, XGBoost, Keras, and TensorFlow.The design targets environments offered by large internet-based companies.
  • Future directions: Future work includes reducing sensitivity, testing recurrent LSTM architectures, and evaluating other large datasets for performance and generalizability.Lower sensitivity is described as enabling ε selection tailored to domain requirements.

APPENDIX A PROOF OF UNARY ENCODING (UE)

The appendix presents proof steps for unary encoding under sensitivity 2, defining or selecting probabilities and relating them to the paper’s numbered equations.

  • Unary encoding proof: The proof fixes sensitivity at 2 and selects p and q according to the expressions in Equations 16 and 17.The supplied proof passages refer to these choices as part of the unary-encoding argument.

APPENDIX E PROOF OF ε-LDP FOR MOUE FOR HIGH SENSITIVITIES

The proof accounts for LATENT's sensitivity when allocating the privacy budget and selects MOUE randomization probabilities accordingly.

  • LATENT’s sensitivity is given as r × l, so the privacy budget ϵ is divided by the sensitivity for each bit.The proof identifies this allocation as following the RAPPOR argument.
  • For MOUE, the randomization probabilities are chosen according to Eq. 25 under sensitivity rl.
  • The proof considers sensitivity rl when establishing the corresponding randomization probabilities.
Loading 1908.02997v3…