Privacy-preserving Machine Learning Research Articles

Cryptographic Primitives in Privacy-Preserving Machine Learning: A Survey

Cryptographic Primitives in Privacy-Preserving Machine Learning: A Survey

Towards Few-Label Vertical Federated Learning

Federated Learning (FL) provided a novel paradigm for privacy-preserving machine learning, enabling multiple clients to collaborate on model training without sharing private data. To handle multi-source heterogeneous data, vertical federated learning (VFL) has been extensively investigated. However, in the context of VFL, the label information tends to be kept in one authoritative client and is very limited. This poses two challenges for model training in the VFL scenario: On the one hand, a small number of labels cannot guarantee to train a well VFL model with informative network parameters, resulting in unclear boundaries for classification decisions; On the other hand, the large amount of unlabeled data is dominant and should not be discounted, and it’s worthwhile to focus on how to leverage them to improve representation modeling capabilities. In order to address the above two challenges, Firstly, we introduce supervised contrastive loss to enhance the intra-class aggregation and inter-class estrangement, which is to deeply explore label information and improve the effectiveness of downstream classification tasks. Secondly, for unlabeled data, we introduce a pseudo-label-guided consistency mechanism to induce the classification results coherent across clients, which allows the representations learned by local networks to absorb the knowledge from other clients, and alleviates the disagreement between different clients for classification tasks. We conduct sufficient experiments on four commonly used datasets, and the experimental results demonstrate that our method is superior to the state-of-the-art methods, especially in the low-label rate scenario, and the improvement becomes more significant.

Differentially private stochastic gradient descent with low-noise

Modern machine learning algorithms aim to extract fine-grained information from data to provide accurate predictions, which often conflicts with the goal of privacy protection. This paper addresses the practical and theoretical importance of developing privacy-preserving machine learning algorithms that ensure good performance while preserving privacy. In this paper, we focus on the privacy and utility (measured by excess risk bounds) performances of differentially private stochastic gradient descent (SGD) algorithms in the setting of stochastic convex optimization. Specifically, we examine the pointwise problem in the low-noise setting for which we derive sharper excess risk bounds for the differentially private SGD algorithm. In the pairwise learning setting, we propose a simple differentially private SGD algorithm based on gradient perturbation. Furthermore, we develop novel utility bounds for the proposed algorithm, proving that it achieves optimal excess risk rates even for non-smooth losses. Notably, we establish fast learning rates for privacy-preserving pairwise learning under the low-noise condition, which is the first of its kind.

United We Stand: Accelerating Privacy-Preserving Neural Inference by Conjunctive Optimization with Interleaved Nexus

Privacy-preserving Machine Learning as a Service (MLaaS) enables the powerful cloud server to run its well-trained neural model upon the input from resource-limited client, with both of server's model parameters and client's input data protected. While computation efficiency is critical for the practical implementation of privacy-preserving MLaaS and it is inspiring to witness recent advances towards efficiency improvement, there still exists a significant performance gap to real-world applications. In general, state-of-the-art frameworks perform function-wise efficiency optimization based on specific cryptographic primitives. Although it is logical, such independent optimization for each function makes noticeable amount of expensive operations unremovable and misses the opportunity to further accelerate the performance by jointly considering privacy-preserving computation among adjacent functions. As such, we propose COIN: Conjunctive Optimization with Interleaved Nexus, which remodels mainstream computation for each function to conjunctive counterpart for composite function, with a series of united optimization strategies. Specifically, COIN jointly computes a pair of consecutive nonlinear-linear functions in the neural model by reconstructing the intermediates throughout the whole procedure, which not only eliminates the most expensive crypto operations without invoking extra encryption enabler, but also makes the online crypto complexity independent of filter size. Experimentally, COIN demonstrates 11.2x to 29.6x speedup over various function dimensions from modern networks, and 6.4x to 12x speedup on the total computation time when applied in networks with model input from small-scale CIFAR10 to large-scale ImageNet.

Wasserstein Differential Privacy

Differential privacy (DP) has achieved remarkable results in the field of privacy-preserving machine learning. However, existing DP frameworks do not satisfy all the conditions for becoming metrics, which prevents them from deriving better basic private properties and leads to exaggerated values on privacy budgets. We propose Wasserstein differential privacy (WDP), an alternative DP framework to measure the risk of privacy leakage, which satisfies the properties of symmetry and triangle inequality. We show and prove that WDP has 13 excellent properties, which can be theoretical supports for the better performance of WDP than other DP frameworks. In addition, we derive a general privacy accounting method called Wasserstein accountant, which enables WDP to be applied in stochastic gradient descent (SGD) scenarios containing subsampling. Experiments on basic mechanisms, compositions and deep learning show that the privacy budgets obtained by Wasserstein accountant are relatively stable and less influenced by order. Moreover, the overestimation on privacy budgets can be effectively alleviated. The code is available at https://github.com/Hifipsysta/WDP.

Federated Learning-based neural networks for airline passenger satisfaction prediction

Preserving user data privacy is paramount for airlines. However, achieving highly accurate predictions of passenger satisfaction while safeguarding the privacy of individual companys data remains a considerable challenge. To achieve this objective, we utilized a privacy-preserving machine learning technique known as Federated Learning (FL). FL allows model training on decentralized devices while ensuring data security and privacy. The FL process comprises client training processes, communication rounds, and weight aggregation. We simulate FL principles using multiple processes to enable distributed learning. Clients preprocess data and train local models, ensuring data privacy. Communication rounds involve clients downloading the global model, local training, and transmitting updates to a central server. Weight aggregation methods like Federated Averaging merge these updates, preserving data privacy. Additionally, we leverage Artificial Neural Networks (ANNs) as foundational techniques. ANNs consist of input, hidden, and output layers, with weight adjustments based on real value differences to achieve accuracy. Our approach combines FL with ANNs to demonstrate FLs potential in privacy-preserving predictive analytics. We use the Airline Passenger Satisfaction dataset for modeling and evaluate the impact of neural network depth and submodel quantity on prediction accuracy. Our experimental results reveal that neither the depth of neural networks nor the number of submodels significantly affects prediction accuracy. FL emerges as a promising approach to balance data privacy and prediction accuracy effectively.

Federated learning with blockchain-based model aggregation and incentives

Federated learning is a privacy-preserving machine learning technique that allows mutually distrusting parties to collaboratively train a model without sharing their data. Most federated learning techniques require a centralized aggregator that stores and aggregates models received from multiple parties. However, having a centralized entity may lead to a single point of failure problem. Another problem of federated learning is the leakage of sensitive data through model updates. To address these issues, we propose a Blockchain-based protocol for federated learning. Our protocol uses Blockchain as a model aggregator solving single-point-of-failure problems. Also, we use a Blockchain-based privacy-preserving technique to avoid data leakage problems. We also incorporate a Blockchain-based incentive distribution module to distribute incentives to model contributors. We perform experiments with well-known datasets and show that the proposed model's accuracy is close to that of a centralized aggregator. We also show the overhead of Blockchain by implementing the protocol and running it on Ethereum Blockchain.

PFedKT: Personalized federated learning with dual knowledge transfer

Federated learning (FL) has been widely studied as an emerging privacy-preserving machine learning paradigm for achieving multi-party collaborative model training on decentralized data. In practice, such data tend to follow non-independent and identically distributed (non-IID) data distributions. Thus, the performance of models obtained through vanilla horizontal FL tends to vary significantly across FL clients. To tackle this challenge, a new subfield of FL – personalized federated learning (PFL) – has emerged for producing personalized FL models that can perform well on diverse local datasets. Existing PFL approaches are limited in terms of effectively transferring knowledge among clients to improve model generalization while achieving good performance on diverse local datasets. To bridge this important gap, we propose the personalized Federated Knowledge Transfer (pFedKT) approach. It involves dual knowledge transfer: (1) transferring historical local knowledge to local models via local hypernetworks; and (2) transferring latest global knowledge to local models through contrastive learning. By fusing historical local knowledge and the latest global knowledge, the personalization and generalization of individual models for FL clients can be simultaneously enhanced. We provide theoretical analysis on the generalization and convergence of pFedKT. Extensive experiments on 3 real-world datasets demonstrate that pFedKT achieves 0.74%–1.62% higher test accuracy compared to 14 state-of-the-art baselines.

Privacy-Preserving Machine Learning Using Functional Encryption: Opportunities and Challenges

Privacy-Preserving Machine Learning Using Functional Encryption: Opportunities and Challenges

A Dynamic Adaptive and Resource-Allocated Selection Method Based on TOPSIS and VIKOR in Federated Learning

Federated learning (FL) is a decentralized and privacy-preserving machine learning technique that protects data privacy by learning models locally and not sharing datasets. However, due to limited computing resources on devices and highly heterogeneous data in practical situations, the training efficiency and resource utilization of federated learning is low. In order to resolve these challenges, we introduce a blockchain-assisted dynamic adaptive and personalized federated learning framework (TV-FedAvg) in the presence of restricted computing power resources and data heterogeneity. After each round of local training, we utilize an improved scoring model based on VIKOR and TOPSIS to comprehensively score the devices. The scores are then utilized to choose devices for participation in global aggregation and to carry out model aggregation through blockchain consensus. Furthermore, resources are reallocated for the next round to enhance resource efficiency, model fairness, and performance. Finally, we demonstrate through experimentation that TV-FedAvg outperforms other models such as pFedMe, FedAvg, Per-FedAvg, and TOPSIS in terms of both efficiency and performance.

Exploring the Distributed Knowledge Congruence in Proxy-data-free Federated Distillation

Federated learning (FL) is a privacy-preserving machine learning paradigm in which the server periodically aggregates local model parameters from cli ents without assembling their private data. Constrained communication and personalization requirements pose severe challenges to FL. Federated distillation (FD) is proposed to simultaneously address the above two problems, which exchanges knowledge between the server and clients, supporting heterogeneous local models while significantly reducing communication overhead. However, most existing FD methods require a proxy dataset, which is often unavailable in reality. A few recent proxy-data-free FD approaches can eliminate the need for additional public data, but suffer from remarkable discrepancy among local knowledge due to client-side model heterogeneity, leading to ambiguous representation on the server and inevitable accuracy degradation. To tackle this issue, we propose a proxy-data-free FD algorithm based on distributed knowledge congruence (FedDKC). FedDKC leverages well-designed refinement strategies to narrow local knowledge differences into an acceptable upper bound, so as to mitigate the negative effects of knowledge incongruence. Specifically, from perspectives of peak probability and Shannon entropy of local knowledge, we design kernel-based knowledge refinement (KKR) and searching-based knowledge refinement (SKR) respectively, and theoretically guarantee that the refined-local knowledge can satisfy an approximately-similar distribution and be regarded as congruent. Extensive experiments conducted on three common datasets demonstrate that our proposed FedDKC significantly outperforms the state-of-the-art on various heterogeneous settings while evidently improving the convergence speed.

Decentralised, collaborative, and privacy-preserving machine learning for multi-hospital data

BackgroundMachine Learning (ML) has demonstrated its great potential on medical data analysis. Large datasets collected from diverse sources and settings are essential for ML models in healthcare to achieve better accuracy and generalizability. Sharing data across different healthcare institutions or jurisdictions is challenging because of complex and varying privacy and regulatory requirements. Hence, it is hard but crucial to allow multiple parties to collaboratively train an ML model leveraging the private datasets available at each party without the need for direct sharing of those datasets or compromising the privacy of the datasets through collaboration. MethodsIn this paper, we address this challenge by proposing Decentralized, Collaborative, and Privacy-preserving ML for Multi-Hospital Data (DeCaPH). This framework offers the following key benefits: (1) it allows different parties to collaboratively train an ML model without transferring their private datasets (i.e., no data centralization); (2) it safeguards patients’ privacy by limiting the potential privacy leakage arising from any contents shared across the parties during the training process; and (3) it facilitates the ML model training without relying on a centralized party/server. FindingsWe demonstrate the generalizability and power of DeCaPH on three distinct tasks using real-world distributed medical datasets: patient mortality prediction using electronic health records, cell-type classification using single-cell human genomes, and pathology identification using chest radiology images. The ML models trained with DeCaPH framework have less than 3.2% drop in model performance comparing to those trained by the non-privacy-preserving collaborative framework. Meanwhile, the average vulnerability to privacy attacks of the models trained with DeCaPH decreased by up to 16%. In addition, models trained with our DeCaPH framework achieve better performance than those models trained solely with the private datasets from individual parties without collaboration and those trained with the previous privacy-preserving collaborative training framework under the same privacy guarantee by up to 70% and 18.2% respectively. InterpretationWe demonstrate that the ML models trained with DeCaPH framework have an improved utility-privacy trade-off, showing DeCaPH enables the models to have good performance while preserving the privacy of the training data points. In addition, the ML models trained with DeCaPH framework in general outperform those trained solely with the private datasets from individual parties, showing that DeCaPH enhances the model generalizability. FundingThis work was supported by the Natural Sciences and Engineering Research Council of Canada (NSERC, RGPIN-2020-06189 and DGECR-2020-00294), Canadian Institute for Advanced Research (CIFAR) AI Catalyst Grants, CIFAR AI Chair programs, Temerty Professor of AI Research and Education in Medicine, University of Toronto, Amazon, Apple, DARPA through the GARD project, Intel, Meta, the Ontario Early Researcher Award, and the Sloan Foundation. Resources used in preparing this research were provided, in part, by the Province of Ontario, the Government of Canada through CIFAR, and companies sponsoring the Vector Institute.

PPML-Omics: A privacy-preserving federated machine learning method protects patients' privacy in omic data.

Modern machine learning models toward various tasks with omic data analysis give rise to threats of privacy leakage of patients involved in those datasets. Here, we proposed a secure and privacy-preserving machine learning method (PPML-Omics) by designing a decentralized differential private federated learning algorithm. We applied PPML-Omics to analyze data from three sequencing technologies and addressed the privacy concern in three major tasks of omic data under three representative deep learning models. We examined privacy breaches in depth through privacy attack experiments and demonstrated that PPML-Omics could protect patients' privacy. In each of these applications, PPML-Omics was able to outperform methods of comparison under the same level of privacy guarantee, demonstrating the versatility of the method in simultaneously balancing the privacy-preserving capability and utility in omic data analysis. Furthermore, we gave the theoretical proof of the privacy-preserving capability of PPML-Omics, suggesting the first mathematically guaranteed method with robust and generalizable empirical performance in protecting patients' privacy in omic data.

DPSUR: Accelerating Differentially Private Stochastic Gradient Descent Using Selective Update and Release

Machine learning models are known to memorize private data to reduce their training loss, which can be inadvertently exploited by privacy attacks such as model inversion and membership inference. To protect against these attacks, differential privacy (DP) has become the de facto standard for privacy-preserving machine learning, particularly those popular training algorithms using stochastic gradient descent, such as DPSGD. Nonetheless, DPSGD still suffers from severe utility loss due to its slow convergence. This is partially caused by the random sampling, which brings bias and variance to the gradient, and partially by the Gaussian noise, which leads to fluctuation of gradient updates. Our key idea to address these issues is to apply selective updates to the model training, while discarding those useless or even harmful updates. Motivated by this, this paper proposes DPSUR, a Differentially Private training framework based on Selective Updates and Release, where the gradient from each iteration is evaluated based on a validation test, and only those updates leading to convergence are applied to the model. As such, DPSUR ensures the training in the right direction and thus can achieve faster convergence than DPSGD. The main challenges lie in two aspects --- privacy concerns arising from gradient evaluation, and gradient selection strategy for model update. To address the challenges, DPSUR introduces a clipping strategy for update randomization and a threshold mechanism for gradient selection. Experiments conducted on MNIST, FMNIST, CIFAR-10, and IMDB datasets show that DPSUR significantly outperforms previous works in terms of convergence speed and model utility.

Practical and Robust Federated Learning With Highly Scalable Regression Training.

Privacy-preserving federated learning, as one of the privacy-preserving computation techniques, is a promising distributed and privacy-preserving machine learning (ML) approach for Internet of Medical Things (IoMT), due to its ability to train a regression model without collecting raw data of data owners (DOs). However, traditional interactive federated regression training (IFRT) schemes rely on multiple rounds of communication to train a global model and are still under various privacy and security threats. To overcome these problems, several noninteractive federated regression training (NFRT) schemes have been proposed and applied in a variety of scenarios. However, there are still several challenges: 1) how to protect the privacy of DOs' local dataset; 2) how to realize highly scalable regression training without linear dependence on sample dimension; 3) how to tolerate DOs' dropout; and 4) how to enable DOs to verify the correctness of aggregated results returned from the cloud service provider (CSP). In this article, we propose two practical noninteractive federated learning schemes with privacy-preserving for IoMT, named homomorphic encryption based NFRT (HE-NFRT) and double-masking protocol based NFRT (Mask-NFRT), respectively, which are based on a comprehensive consideration of NFRT, privacy concerns, high-efficiency, robustness, and verification mechanism. The security analyses display that our proposed schemes are able to protect the privacy of DOs' local training data, resist collusion attack, and support strong verification to each DO. The performance evaluation results demonstrate that our proposed HE-NFRT scheme is desirable for a high-dimensional and high-security IoMT application while Mask-NFRT scheme is desirable for a high-dimensional and large-scale IoMT application.

Privacy Preserving Feature Selection for Sparse Linear Regression

Privacy-Preserving Machine Learning (PPML) provides protocols for learning and statistical analysis of data that may be distributed amongst multiple data owners (e.g., hospitals that own proprietary healthcare data), while preserving data privacy. The PPML literature includes protocols for various learning methods, including ridge regression. Ridge regression controls the L2 norm of the model, but does not aim to strictly reduce the number of non-zero coefficients, namely the L0 norm of the model. Reducing the number of non-zero coefficients (a form of feature selection) is important for avoiding overfitting, and for reducing the cost of using learnt models in practice. In this work, we develop a first privacy-preserving protocol for sparse linear regression under L0 constraints. The protocol addresses data contributed by several data owners (e.g., hospitals). Our protocol outsources the bulk of the computation to two non-colluding servers, using homomorphic encryption as a central tool. We provide a rigorous security proof for our protocol, where security is against semi-honest adversaries controlling any number of data owners and at most one server. We implemented our protocol, and evaluated performance with nearly a million samples and up to 40 features.

The Emerging Role of Wearable Health Technologies in Proactive Disease Prevention

The study gives a complete plan for lowering disease through the use of ICT in personal healthcare. The Health Pattern Recognition (HPR), Dynamic Risk Assessment (DRA), and Personalized Intervention Strategy (PIS) formulas are all parts of this method. They are used to collect, prepare, and use data. This research focuses on cybersecurity using health pattern recognition (HPR), dynamic risk assessment (DRA), and personalized intervention strategies (PIS). PIS offers a comprehensive disease prevention approach in personal healthcare that takes advantage of technological advancements. Because they integrate secure data processing with privacy-preserving machine learning, these aspects assure the safety and validity of health data collected from wearable devices. This option allows for the assessment of medical records. It may be helpful to analyze the technique's accuracy and adherence to established security standards in order to evaluate its application for disease prediction and preventive health management. The HPR program looks at each person's health information to find trends in diseases and other results using machine learning. This helps with early evaluation and healthcare management that avoids problems. DRA keeps a person's risk rating up to date so that it takes into account any changes in their health. After that, people are given choices based on the results and risks that PIS has predicted. Some of the tests that were used to compare the suggested method to industry standards were accuracy, sensitivity, specificity, precision, and the Matthews Correlation Coefficient. The suggested way seems to work because it has better predicting power, fewer fake positives, and more users who are involved in preventive health management.

Deep Homeomorphic Data Encryption for Privacy Preserving Machine Learning

Addressing privacy concerns is critical in smart manufacturing where sensitive data is used for machine learning. Data protection is essential to ensure model accuracy while upholding data privacy. Homeomorphic encryption, an algorithm for privacy-preserving machine learning, achieves this by transforming data using a neural network with secret key weights. This process conceals private data while retaining the potential to learn classification models from the anonymized data. This paper introduces a comprehensive quality metric to assess homeomorphic encryption across conflicting criteria: security (regarding private data), machine learning adaptability (tolerance), and efficiency (regarding needed extra resources). Through experiments on various datasets, the metric proves its effectiveness in guiding optimal encryption parameter selection. Our findings highlight homeomorphic encryption's strong overall quality, positioning it as a valuable Industry 4.0 solution. By offering a simpler alternative to fully homomorphic encryption, it effectively addresses privacy concerns and enhances data usability in the context of smart manufacturing.

Adaptive Client Clustering for Efficient Federated Learning over Non-IID and Imbalanced Data

Federated learning (FL) is an emerging distributed and privacy-preserving machine learning framework. However, the performance of traditional FL methods is seriously impaired by the real-world data, which appear to be non-IID. The recent clustered federated learning (CFL) methods eliminate the impact of non-IID data by grouping clients with similar data distribution into the same cluster. Unfortunately, existing CFL methods heavily rely on the pre-setting of the cluster number, failing to achieve adaptive client clustering. We also experimentally observe that imbalanced data largely degrade their correctness of client clustering. In this paper, we present a novel CFL method without manual intervention, named AutoCFL, which can eliminate both effects of non-IID and imbalanced data simultaneously. To deal with imbalanced data, the local training adjustment strategy adaptively adjusts the number of local training epochs for each client. To further improve the clustering correctness and adaptability, the weighted voting-based client clustering strategy automatically groups each client into an appropriate cluster. Extensive experiments are conducted to evaluate the design of AutoCFL with three popular datasets under various data settings. Experimental results demonstrate that AutoCFL outperforms state-of-the-art methods, e.g., on average improving model accuracy by 9.24%, while reducing communication costs by 4.67 in an adaptive manner.

Chebyshev polynomial approximation in CNN for zero-knowledge encrypted data analysis

Integrating Deep Learning (DL) techniques in Convolutional Neural Networks (CNNs) with encrypted data analysis is an emerging field for enhancing data privacy and security. A significant challenge in this domain is the incompatibility of standard non-linear Activation Functions (AF) like Rectified Linear Unit (ReLU) and Hyperbolic Tangent (tanh) with Zero-Knowledge (ZK) encrypted data, which impacts computational efficiency and data privacy. Addressing this, our paper introduces the novel application of Chebyshev Polynomial Approximation (CPA) to adapt these AF to process encrypted data effectively. Utilizing the MNIST dataset, this paper conducted experiments with LeNet and various configurations of AlexNet, extending the range of the ReLU and tanH functions to optimize CPA. Our results reveal an optimal polynomial degree (α), with α = 10 for ReLU and between α = 10 and α = 15 for tanH, beyond which the benefits in accuracy plateau. This finding is crucial for ensuring the accuracy and efficiency of CNNs in processing encrypted data. This recommended study demonstrates that while the accuracy slightly decreases for plaintext data and more significantly for ciphertext data, the overall effectiveness of CPA in CNNs is maintained. This advancement enables CNNs to process encrypted data while preserving privacy and marks a significant step in developing privacy-preserving Machine Learning (ML) and encrypted data analysis.