Towards Differentially Private Text Representations

Introduction

The proliferation of deep learning (DL) has led to notable success in natural language processing (NLP), meanwhile, a series of privacy and efficiency challenges arise (Hovy et al., 2015; Li et al., 2018; Coavoux et al., 2018). In NLP tasks, the input text often provides sufficient clues to portray the authors, such as their genders, ages, and other important attributes. Concretely, sentiment analysis tasks often impose privacy-related implications on the authors whose text is used to train models, and user attributes can be easily detectable from online review data, as evidenced by (Hovy et al., 2015). Private information can take the form of key phrases explicitly contained in the text. However, it can also be implicit (Preoţiuc-Pietro et al., 2015). For example, the input representation after the embedding layer, or the intermediate hidden representation may still carry sensitive information which can be exploited for adversarial usages. It has been justified that an attacker can recover private variables with higher than chance accuracy, using only the hidden representation (Coavoux et al., 2018; Li et al., 2018). Such attack would occur in scenarios where end users send their learned representations to the cloud for grammar correction, translation, or text analysis tasks (Li et al., 2018).

To protect privacy, previous efforts resorted to a trusted aggregator to ensure centralized DP (CDP) (Abadi et al., 2016). On the other hand, when participants are reluctant to directly share their crowd-sourced data with the server, federated learning becomes a promising learning paradigm that pushes model training to the edge (McMahan et al., 2017). However, running complex deep neural networks (DNNs) with millions of parameters comes with resource limitations and user experience penalties. Moreover, most federated learning frameworks still assume a trusted aggregator who can have access to local model parameters or gradients (McMahan et al., 2017). The recent work pointed out the limitation of the trusted server and the associated privacy issues (Lyu et al., 2020b, a). Without an untrusted server, Shokri and Shmatikov (2015) proposed to blur local model gradients by adding noise using differential privacy. However, their privacy bounds are given per-parameter, the gigantic amount of model parameters prevents their technique from providing a meaningful privacy guarantee. The other cryptograph-based methods can be resource-hungry or overly complex for users (Bonawitz et al., 2017). More recently, Li et al. (2018) and Coavoux et al. (2018) proposed to train deep models with adversarial learning. However, both works provide only empirical privacy, without any formal privacy guarantees.

To address the aforementioned problems, we are inspired to take a different approach by utilizing LDP. Our contributions include:

We are the first to train on differentially private crowd-sourced representations for NLP tasks. We propose a novel LDP protocol to preserve the privacy of the extracted representation from user inputs. It offers enhanced flexibility in choosing the randomization probabilities in LDP.

Experimental results on various NLP tasks show that our framework delivers comparable or even better performance than the non-private framework, and our LDP protocol demonstrates advantages over the existing LDP protocols.

Preliminaries and Related work

For the scenario where data are sourced from multiple individuals, while the server is untrusted, LDP (Duchi et al., 2013) is needed to enable data owners to perturb their private data before publication. LDP roots in randomized response (Warner, 1965), and it has been deployed in many real-world applications such as Google’s Chrome browser, Apple’s iOS, and US Census Bureau. A formal definition of LDP is provided in Definition 1.

A randomized algorithm $\mathcal{A}$ satisfies $\epsilon$-LDP if and only if for any two input tuples $v$ and $v^{\prime}$, we have

for $\forall o\in Range(\mathcal{A})$, where $Range(\mathcal{A})$ denotes the set of all possible outputs of the algorithm $\mathcal{A}$.

Compared to CDP (Dwork and Roth, 2014; Abadi et al., 2016), LDP offers a stronger level of protection. As illustrated in Figure 1, in DL with CDP, the trusted server owns the data of all users (Abadi et al., 2016), and the server implements CDP algorithm before answering queries from end users. This approach can pose a privacy threat to data owners when the server is untrusted. Moreover, DL algorithms with CDP are inherently computationally complex (Abadi et al., 2016). By contrast, in DL with LDP, data owners are willing to contribute their data for social good, but do not fully trust the server, so it necessitates data perturbation before releasing it to the server for further learning.

2. LDP Protocols

The most relevant LDP protocol is called Unary Encoding (UE), which consists of two steps (Wang et al., 2017):

Encoding. Any single input $v$ is encoded into a $d$-bit vector ($d$ is domain size), where only the $v$-th bit equals to 1, i.e., $\vec{B}$= Encode($v$), such that B[v]=1 and B[i]=0 for $i\neq v$. Hence each $d$-bit vector contains $d-1$ zeros and only 1 one, and the maximum difference between two adjacent binary vectors is 2, i.e., sensitivity $\Delta f=2$.

Perturbing. Each bit with value 1 is preserved with probability $p$, thus, Perturb($\vec{B}$) outputs $\vec{B}^{\prime}$ as

Here two key parameters in perturbation are $p=\Pr\{1\rightarrow 1\}$, the probability that 1 remains 1 after perturbation, and $q=\Pr\{0\rightarrow 1\}$, the probability that 0 is flipped to 1.

Depending on the choice of $p$ and $q$, UE based LDP protocols can be classified into (Wang et al., 2017):

Symmetric Unary Encoding (SUE): SUE assumes the probability that a bit of 1 is preserved ($p$) equals the probability that a bit of 0 is preserved ($1-q$), i.e., $p+q=1$, $p=\frac{e^{\epsilon/\Delta f}}{1+e^{\epsilon/\Delta f}},q=\frac{1}{1+e^{\epsilon/\Delta f}}$.

Optimized Unary Encoding (OUE): OUE optimizes SUE by using the optimized choices of $p,q$ for $\epsilon$-LDP. Setting $p$ and $q$ can be viewed as splitting $\epsilon$ into $\epsilon_{1}+\epsilon_{2}$ such that $\frac{p}{1-p}=e^{\epsilon_{1}}$ and $\frac{1-q}{q}=e^{\epsilon_{2}}$. That is, $\epsilon_{1}$and $\epsilon_{2}$ are the privacy budgets spent on transmitting 1’s and 0’s respectively. If there are more 0’s than 1’s in the encoded representation, it is reasonable to allocate as much privacy budget for transmitting the 0 bits as possible to maintain utility. In the extreme, setting $\epsilon_{1}=0$ and $\epsilon_{2}=\epsilon$ gives $p=\frac{1}{2}$ and $q=\frac{1}{1+e^{\epsilon/\Delta f}}$.

Deep Learning with LDP

As both SUE and OUE are dependent on the domain size $d$, which may not scale well when $d$ is large. To remove the dependence on $d$, we propose a new LDP protocol called Optimized Multiple Encoding (OME). The key idea is to map each real value $v_{i}$ of the embedding vector into a binary vector with a fixed size $l$. Therefore, for the extracted embedding vector $\vec{v}=\{v_{1},v_{2},\cdots,v_{r}\}$ with $r$ elements, changing all elements of $\vec{v}$ results in $\Delta f=2r$ in both SUE and OUE, and $\Delta f=rl$ in OME. To enhance flexibility and utility in OME, we follow the intuition behind OUE (Wang et al., 2017) to perturb 0 and 1 differently.

In particular, we introduce a randomization factor $\lambda$ to adjust the randomization probabilities in OME. As implied in Theorem 1, by increasing $\lambda$, we can decrease $q$, thus increasing the probability of keeping the original 0’s. For the value of $p$, we increase the probability of preserving the original 1’s for half of the bit vector while decreasing the corresponding probability for the other half. In this way, OME maintains both privacy and utility.

For any inputs $v,v^{\prime}$ and any encoded bit vector $B$ with sensitivity $rl$, OME provides $\epsilon$-LDP given

Let $v$ and $\vec{B}$ represent an input and its encoded bit representation. Given that $\vec{B}$ has a sensitivity of $rl$, the privacy budget $\epsilon$ needs to be divided by the sensitivity for each bit. By setting

Then for any inputs $v,v^{\prime}$, we have

2. Framework Realization

As shown in Figure 2, the general setting for our proposed deep learning with LDP consists of three main modules: (1) embedding module outputs a 1-D real representation with length $r$; (2) randomization module produces local differentially private representation; and (3) classifier module trains on the randomized binary representations to generate a differentially private classifier as per the post-processing invariance of DP (Dwork and Roth, 2014). The detailed training process is summarised in Algorithm 1.

Performance Evaluation

For performance evaluation, we focus on a range of NLP tasks: 1) sentiment analysis; 2) intent detection; and 3) paraphrase identification. In these tasks, the original sentences might carry some sensitive information such as name entities or monetary descriptions. These private information should be protected, meanwhile the performance for these tasks should not be heavily penalised.

Datasets. For sentiment analysis, we use three datasets: IMDb, Amazon, and Yelp, derived from (Kotzias et al., 2015), where each review is labelled with a binary sentiment (positive vs. negative). For all sentiment datasets, we perform a train:test split into 8:2.

Intent detection aims to classify each query into seven intents. We derive Intent dataset from (Coucke et al., 2018), which consists of 13,784 training examples and 700 test examples in total.

For paraphrase identification, we use Microsoft Research Paraphrase Corpus (MRPC) from (Dolan and Brockett, 2005). This task decides whether given two sentences are semantically equivalent. Following Wang et al. (018b), we partition this data into train/test (3.7k/1.7k).

Model and Training. To extract the intermediate features, we use GloVe word embeddings with a dimension size of 50 (Pennington et al., 2014) for sentiment analysis, and use the pretrained BERT-base (Devlin et al., 2018) for both Intent and MRPC.

For binary encoding of the extracted features, we use 10 bits (1 bit for the sign, 4 bits for the integer part, and 5 bits for the fraction part) to represent each element of the embedding vector.

The classifier module is a multi-layer perceptron with 128 hidden units for sentiment analysis and 768 units for Intent and MRPC. For all datasets, we train the models for 50 epochs using SGD optimizer with learning rate 0.01, decay $10^{-6}$, momentum 0.9, and a batch size of 32, and apply a dropout rate of 0.5 on the representation. For each dataset, we average the results over 20 runs.

Experimental Results. We first compare our local differentially private NN (LDPNN) with the non-private NN (NPNN), where the randomization module is removed. Table 1 shows that our LDPNN delivers comparable or even better results than the NPNN across various privacy budgets $\epsilon$ when the randomization factor $\lambda\geq 50$. We hypothesise that LDP acts as a regularization technique to avoid overfitting. We conjecture another important reason is that the enlarged feature space through encoding produces more powerful representation than the conventional 1-D output of the embedding layer. As LDPNN performance is directly related to the randomization probabilities $p$ and $q$, the higher $p$ and the lower $q$, the lower the randomization of the binary vector, and the better performance will be expected. When the embedding size $r$ and encoding size $l$ are fixed, $p$ is determined by the randomization factor $\lambda$, and $q$ is determined by both the privacy budget $\epsilon$ and randomization factor $\lambda$, as indicated in Equation 2 and Equation 3. Hence we next investigate how $\epsilon$ and $\lambda$ impact the model accuracy.

Impact of $\epsilon$. Contrary to the heuristic study in deep learning with CDP (Abadi et al., 2016), from Table 1, we observe that accuracies are relatively stable when the privacy budget $\epsilon$ is changed within a wide range of values. The reason lies in the large sensitivity of the encoded binary representation. When $\lambda$ is a constant, the large sensitivity $rl$ in OME weakens the effect of $\epsilon$ on the randomization probabilities, as evidenced by Figure 3 (left), $p=\{p_{1},p_{2}\}$ and $q$ of OME keep nearly consistent when $\epsilon$ changes. This also explains high accuracy even under a very tight privacy budget (e.g. $\epsilon$=0.5).

We also compare with the other two LDP protocols (SUE and OUE in Section 2.2) on sentiment analysis task. Table 2 shows that our OME significantly outperforms both SUE and OUE. The reason lies in the optimized randomization probabilities of OME, as shown in Figure 3 (left), $p$ and $q$ in both SUE and OUE are fluctuating around 0.5, causing low accuracies.

Impact of $\lambda$. For randomization factor $\lambda$, according to Equation 3, without the randomization factor $\lambda$, i.e., $\lambda=1$, lower $\epsilon$ values and higher $rl$ values will result in higher $q$ values, which may compromise utility. To alleviate this problem, OME calibrates the value of $\lambda$ to adjust randomization probabilities. As observed in Figure 3 (right), with the increasing $\lambda$, OME can largely decrease $q$ – the probability of perturbing 0 to 1. Although the probability $p_{2}$ of preserving the original 1’s decreases for half of the bit vector, the corresponding probability $p_{1}$ increases for the other half. This partially explains why OME can maintain both privacy and utility.

Overall, all these results show that our OME offers the reduced impact of the privacy budget $\epsilon$ on model accuracy, and significantly outperforms the most state-of-the-art LDP protocols.

CONCLUSION

We formulated a new deep learning framework, which allows data owners to send differentially private representations for further learning on the untrusted servers. A novel LDP protocol was proposed to adjust the randomization probabilities of the binary representation while maintaining both high privacy and accuracy under various privacy budgets. Experimental results on a range of NLP tasks confirm the effectiveness and superiority of our framework.

References