Enhancing Privacy and Utility with Noisy Minimax Filter

Transcription

1 Enhancing Privacy and Utility with Noisy Minimax Filter Jihun Hamm Dept. Computer Science and Engineering The Ohio State University

2 Syntactic anonymity Privacy measures for database release k-anonymity [Sweeney 02] l-diversity [Machanavajjhala 06] t-closeness [Li 07] Information-theoretic approaches Example: patient records Identifiers Quasi-ident ers Sensitive First Last Age Race Cancer Harry Stone Afr-Am Neg John Reyser Cauc Neg Beatrice Stone Afr-Am Neg John Delgado Hisp Pos

3 Problems with K-anonymity High-dimensional and/or continuous attributes Identifiers Quasi-ident ers???? Sensitive First Last Age Race MRI SCAN Cancer Harry Stone Afr-Am Neg John Reyser Cauc Neg Beatrice Stone Afr-Am Neg John Delgado Hisp Pos Q1: Identifier? Quasi-identifier? Sensitive? Q2: Generalize? Suppress? K-anonymity is ineffective for high-dimensional sparse databases [Narayan 08].

4 Differential privacy Let D, D : neighboring datasets : randomized output from of an algorithm on D Def: is ε-dp if P(f(D)) P(f(D )) for all D ~ D and measurable S Lemma: P f D x e ε P f D i x for all D~D and all x then f is ε-dp

5 Common weakness Susceptible to inference attack Adversary is able to infer sensitive attributes of individuals accurately from insensitive, sanitized attributes [Kifer 09, Cormode 11]

6 Common weakness Susceptible to inference attack Adversary is able to infer sensitive attributes of individuals accurately from insensitive, sanitized attributes Why? [Kifer 09, Cormode 11] Dependence between released & sensitive attributes DP only prevents an adversary from gaining additional knowledge of inclusion/exclusion of a participant How to prevent this?

7 Minimax filter [Hamm 15, 16] Researcher Subjects Adversary

8 Minimax filter [Hamm 15, 16] Researcher Subjects x g(x) Adversary

9 Game formulation Researcher: predict z (disease) from g(x) Researcher Subjects x g(x) y : identity z : disease Adversary

10 Game formulation Researcher: predict z (disease) from g(x) Researcher Subjects x g(x) y : identity z : disease Adversary Adversary: predict y (sensitive) from g(x)

11 Game formulation Researcher Subjects x g(x) y : identity z : disease Adversary Minimax filter g: optimal trade-off

12 CelebA dataset Test 1: obfuscate smile vs non-smile, retaining other attributes Test 2: obfuscate gender, retaining other attributes Original (test) image

13 CelebA dataset Test 1: obfuscate smile vs non-smile

14 Test 2: obfuscate gender CelebA dataset

15 Comparison Minimax filter Resilient to inference attacks by design Maximize utility-privacy tradeoff on average Deterministic

16 Comparison Minimax filter Resilient to inference attacks by design Maximize utility-privacy tradeoff on average Deterministic Differential privacy Randomized Resilient to relative information gain in the worst-case

17 Comparison Minimax filter Resilient to inference attacks by design Maximize utility-privacy tradeoff on average Deterministic Differential privacy Randomized Resilient to relative information gain in the worst-case Proposal: randomize minimax filter

18 Noise mechanism Perturbation of features by Laplace-type noise x x + ξ, P ξ e ε S ξ, S: sensitivity Bounded sensitivity (S = 2) 1. hard bound: b x = min 1, 2. soft bound: b x = tanh a x x 3. normalization: b x = x/ x x 1 x x

19 Pre- vs post-processing

20 Pre- vs post-processing

21 When does preprocessing help?

22 Test 1 Genki dataset X: 1740 face images Z: smile vs non-smile Y: male vs female Filter/classifier: Linear/logistic regression Methods Minimax preprocessing Minimax postprocessing PCA preprocessing PCA postprocessing

23 Test 2 UCI HAR Activity recognition from accelerometry X: time-freq features Z: 6 activities Y: identity of S=30 subjects

24 Test 3 Enterface dataset Emotion recognition from speech X: 427 MFCCs Z: happy vs non-happy Y: identity of S=43 subject

25 Conclusion Defense against inference attacks has not been welladdressed Very difficult to achieve using differentially-private perturbation mechanisms only Mixing minimax filter and perturbation by noise can have synergetic effect on privacy and utility

26 References Arvind Narayanan and Vitaly Shmatikov, Robust deanonymization of large sparse datasets, in IEEE S&P, Daniel Kifer, Attacks on privacy and definetti s theorem, ACM SIGMOD, Conf. Manag. data Graham Cormode, Personal privacy vs population privacy: learning to attack anonymization, ACM SIGKDD, 2011 Jihun Hamm, Preserving privacy of continuous high-dimensional data with minimax filters, AISTATS, Jihun Hamm, Minimax Filter: Learning to Preserve Privacy from Inference Attacks, arxiv preprint arxiv: , 2016