Privacy-Preserving Machine Learning

Transcription

1 Privacy-Preserving Machine Learning CS 760: Machine Learning Spring 2018 Mark Craven and David Page 1

2 Goals for the Lecture You should understand the following concepts: public key cryptography linearly homomorphic encryption fully homomorphic encryption differential privacy global sensitivity Laplace mechanism Thanks Eric Lantz and Irene Giacomelli! 2

3 3

4 4

5 5

6 6

7 F(x) 7

8 8

9 F(x) 9

10 F(x) 10

11 F(x) 11

12 12

13 Need for Privacy Large databases of patient information Regulations and expectations of privacy Large potential gains from data mining How to balance utility and privacy? Privacy approaches k-anonymity (Sweeney, 2002), l-diversity (Machanavajjhala, 2007), t- closeness (Li, 2007) Homomorphic encryption Differential privacy (Dwork, 2006) 13

14 Recall: IWPC Warfarin dosing algorithm Over a dozen real-value prediction techniques were used Linear regression and support vector regression were the best performers Fixed Clinical PGx Prediction Error (mg/wk) Age in decades Height in cm Weight in kg VKORC1 A/G VKORC1 A/A VKORC1 genotype unknown CYP2C9 *1/* CYP2C9 *1/* CYP2C9 *2/* CYP2C9 *2/* CYP2C9 *3/* CYP2C9 genotype unknown Asian race Black or African American Missing or Mixed race Enzyme inducer status Amiodarone status = square root of final dose 14

15 Recall: Ridge Regression Data point: (x, y ), x R d and y R Model: w R d vector ofweights 8/ 29

16 Public-Key Encryption sk secret key pk public key Encryption: Decryption: 9/ 29

17 Public-Key Encryption sk secret key pk public key Encryption: c = Enc pk (m) c hides m to everyone that does NOT have sk Decryption: pk m =hello! Enc c =6a7#87t 9/ 29

18 Public-Key Encryption sk secret key pk public key Encryption: c = Enc pk (m) c hides m to everyone that does NOT have sk Decryption: c reveals m to everyone that has sk pk sk m =hello! Enc c =6a7#87t Dec hello! 9/ 29

19 Linearly-Homomorphic Encryption Addition of ciphertexts Enc pk (m 1 ) 83 Enc pk (m 2 ) = Enc pk (m 1 + m 2 ) Multiplication of a ciphertext by a plaintext m 1 [SJ Enc pk (m 2 ) = Enc pk (m 1 m 2 ) 10/ 29

20 Linearly-Homomorphic Encryption Addition of ciphertexts Enc pk (m 1 ) 83 Enc pk (m 2 ) = Enc pk (m 1 + m 2 ) Multiplication of a ciphertext by a plaintext (m 1 is public!) M 1 [SJ Enc pk (m 2 ) = Enc pk (m 1 m 2 ) 10/ 29

21 Linearly-Homomorphic Encryption Addition of ciphertexts Enc pk (m 1 ) 83 Enc pk (m 2 ) = Enc pk (m 1 + m 2 ) Multiplication of a ciphertext by a plaintext (m 1 is public) M 1 [SJ Enc pk (m 2 ) = Enc pk (m 1 m 2 ) Fully homomorphic requires multiplication analog of and currently is much slower. Database (DB): real numbers in [ 2000, 2000] with 3 digits in the fractional part. Times using linearly-homomorphic encryption: - encrypt the DB: 40 minutes - sum of two DBs: 3 seconds - mult. by a constant: 25 mins 10/ 29

22 Illustration D 1 ML Engine D 2.. D t Crypto Provider 11/ 29

23 Illustration D 1 pk ML Engine D 2 pk.. pk pk D t pk pk Crypto Provider (sk, pk) 11/ 29

24 Illustration D 1 pk Enc pk (D 1 ) Enc pk (D 2 ) ML Engine D 2 pk Enc pk (D t ).. D t pk Crypto Provider (sk, pk) 11/ 29

25 Illustration D 1 pk ML Engine Enc pk (D 1 ) Enc pk (D 2 ).. Enc pk (D t ) D 2 pk.. D t pk Crypto Provider (sk, pk) 11/ 29

26 Illustration ML Engine w trained on D 1 D t interactive protocol Crypto Provider 11/ 29

27 Illustration Interactive protocol: 1. the ML engine masks inside the encryption Enc pk (D) Enc pk (D ) 2. the crypto provider decrypts, gets D and computes a masked model, w 3. the ML engine computes the real model w from the masked one

28 Illustration Results for seven UCI datasets (time in seconds): (phase 1 = encryption, phase 2 = interactive protocol) n = training data (number of data points) d = number offeatures

29 Comments on Homomorphic Encryption Benefits High utility because No Noise!!! No one sees data in the clear Disadvantages Models (or even just predictions) may still give away more information about training examples (e.g., patients) than about other examples (patients) Very high (as of now, completely impractical) runtimes for some methods (fully homomorphic encryption) Feasible approaches (e.g., linearly homomorphic encryption) require redeveloping each learning algorithm (e.g., ridge regression) from scratch with limited operations Protections may be lost if/when Quantum Computers become available 29

30 Just Releasing a Learned Model Can Violate Privacy IWPC Warfarin Model Can we predict genotype of training set better than others? 30

31 Privacy Blueprint 31

32 Differential Privacy (Dwork, 2006) Goal Small added risk of adversary learning (private) information about an individual if his/her data in the private database versus not in the database Informally Query output does not change much between neighboring databases E.g.: what is fraction of people in clinic with diabetes? 32

33 Differential Privacy Definition Given Input database D Randomized algorithm f : D -> Range(f ) f is (e, d)-differentially private iff For any S Î Range(f ) and D where d(d,d )=1 ε and d are privacy budget Smaller means more private 33

34 Obtaining Differential Privacy Note: Definition requires stochastic output how to achieve? Perturbation {Laplace Mechanism} (Dwork, 2006) Calculate correct answer f(d) Add noise f(d) + h Soft-max {Exponential Mechanism} (McSherry and Talwar, 2007) Quality function q(d,s) Exponential weighting exp(e q(d,s)) In both cases, noise is proportional to the sensitivity of the function 34

35 Global Sensitivity Given f : D -> R, global sensitivity of f is Worst case Once f and the domain of D are chosen, global sensitivity is fixed 35

36 Add Laplace Noise, μ=0, b a function of sensitivity and ε 36

37 Privacy-Utility Tradeoff for Private Warfarin Model 37

38 Comments on Differential Privacy Provable guarantees, regardless of side information adversary has Elegant formulation that leads to many attractive algorithms Has insights for other areas such as fairness Poor intuition for how to select ε Can kill utility (e.g., accuracy, AUC) unless we have very many examples so good fit for age of Big Data but not for medium data How to set privacy budget? If release DP dataset, can update with new release without adding to previous ε, so must plan far ahead