Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Information

Privacy-preserving instance encoding aims to encode raw data as feature vectors without revealing their privacy-sensitive information. When designed properly, these encodings can be used for downstream ML applications such as training and inference with limited privacy risk. However, the vast majority of existing instance encoding schemes are based on heuristics and their privacy-preserving properties are only validated empirically against a limited set of attacks. In this paper, we propose a theoretically-principled measure for the privacy of instance encoding based on Fisher information. We show that our privacy measure is intuitive, easily applicable, and can be used to bound the invertibility of encodings both theoretically and empirically.

Paper

References (82)

Scroll for more · 38 remaining

Similar papers

Peer review

Reviewer AWfY7/10 · confidence 3/52023-06-30

Summary

In this paper the authors propose (diagonal) Fisher information leakage (dFIL) as a theoretically-grounded and practical framework for assessing the privacy guarantees of instance encoding. At its core, dFIL quantifies the potential invertibility of the encoding mapping of an instance encoding scheme. The authors establish, under mild regularity conditions, that the reciprocal of dFIL, plus the information theorist's Fisher information, serves as a lower bound for the mean squared error (MSE) of any input reconstruction attack (Corollary 1). This lower bound is derived from the so-called van Trees' inequality. Furthermore, the authors present extensive numerical experiments that highlight the key features of dFIL as a privacy metric for instance encoding.

Strengths

1. dFIL is a very intuitive privacy metric under unbiased reconstruction attacks. In such cases, the Cramér-Rao bound establishes that the reciprocal of dFIL is a lower bound for the MSE of an adversary attempting to reconstruct the raw data based on the encoding. 2. The limitations of dFIL are discussed thoroughly. 3. The paper is well-written.

Weaknesses

Although dFIL serves as an intuitive privacy metric under unbiased reconstruction attacks, these attacks are uncommon in ML applications. In the case of biased attacks, which are more representative of practical scenarios, the main result (Corollary 1) highlights the need to consider not only dFIL but also the information theorist's Fisher information. Consequently, certain practical and theoretical concerns are shifted to the latter quantity, potentially diminishing the significance of dFIL itself. Furthermore, it is worth mentioning that the paper's technical contribution is minor since the main result is a direct consequence of van Trees' inequality. While this is not a problem in itself, it does not contribute to make the paper stand out.

Questions

One of the key contributions of this paper is the introduction of dFIL as an intuitive privacy metric for instance encoding. However, it is important to note that, for (general) biased attacks, the information theorist's Fisher information plays an equally, if not more significant role than dFIL. Regrettably, the paper lacks a thorough discussion of the empirical and theoretical properties of the latter quantity, apart from its estimation using score matching. Consequently, it becomes challenging to evaluate the relative importance of dFIL compared to the information theorist's Fisher information. Clarifying these aspects would enhance the overall assessment of dFIL's significance. Addendum: In their rebuttal, the authors clarified the relative importance of dFIL and the information theorist's Fisher information.

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

4 excellent

Presentation

4 excellent

Contribution

2 fair

Limitations

The authors addressed the limitations of the proposed method very well.

Reviewer yPPy5/10 · confidence 2/52023-07-05

Summary

This paper discusses the privacy concerns surrounding data encoding methods employed in machine learning (ML) operations. Its primary objective is to present a theoretical framework that quantifies the extent of privacy leakage in an encoding scheme and facilitates the calculation of its invertibility. The authors propose a novel technique that leverages Fisher Information Leakage to compute the lower bound of Mean Squared Error (MSE) for an encoding scheme, considering both unbiased and biased attackers. Finally, The authors evaluate their technique against some simple reconstruction attacks both for training and inference tasks.

Strengths

1. The paper takes a theoretical approach to explain reconstruction attacks. The problem is interesting and the presentation and flow of the paper are good. It was easy to follow and understand. 2. The authors' approach of initially focusing on unbiased attacks and subsequently extending their scheme to encompass attackers with prior knowledge is a good approach and beneficial in comprehending their contributions. The paper also provides evaluation of their technique considering both unbiased and biased attackers. 3. The paper is upfront about many of its limitations. This is commendable and helps understand the solution better and paves the way for identifying future research avenues.

Weaknesses

1. The core contribution of the paper is adopting Fisher Information Leakage and van Trees inequality to come up with a lower bound for MSE. While this is a new idea, it would benefit from more comprehensive construction. Furthermore, the reconstruction attacks examined by the authors to showcase the efficacy of their technique are relatively simplistic. It would be advantageous for the authors to consider incorporating relevant literature from the privacy and security domain and evaluate their approach against more sophisticated and state-of-the-art reconstruction attacks. 2. The paper should provide more rigorous analysis of the privacy and utility trade-off. The paper readily discards Differential Privacy on utility ground, but later adopts noise addition to introduce privacy. Regardless, the privacy guarantee by noise addition and the corresponding utility trade-offs should be analytically explained. While the paper includes an empirical demonstration of the utility trade-off, it falls short of its intended goal of providing a theoretical explanation. 3. The authors should clarify how this lower bound contributes to preventing attacks, developing privacy-preserving encoding techniques, or addressing other important aspects related to data privacy.

Questions

See weakness.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

2 fair

Contribution

2 fair

Limitations

No

Reviewer k1TB6/10 · confidence 3/52023-07-05

Summary

Instance encoding (and some closely related lines of research) aim at finding ways to encode data examples (in a training set) as $E=Enc(e)$, in such a way that one can train models on the encoded examples $E_1,...E_n$, while $E_i$ does not leak much about $e_i$ to an adversary who inspects it. Previous efforts for proposing "private" instance encodings have failed due to (1) subsequent attacks, and (2) lack of formal definitions of what privacy means here. In fact, it is known that such mechanisms cannot be DP in a strong sense, while they are also useful for training. This paper aims to put forward a new way of arguing about privacy of instance encoding, based on Fisher Information (FI). FI is a useful measure of information revealed in random variables about a related random variable. In particular, knowing FI allows one to lower bound the Mean Squared Error (MSE) of the best reconstruction attack, assuming that the adversary has no prior knowledge about the distribution of the original instance. More specifically, using FI, the paper shows how to give an *hardness of inversion* type privacy. The paper shows that both in the (more elementary) case of unbiased attacks (who see the original instances uniformly distributed) as well as more powerful attackers who have some prior information (e.g., know the distribution of the instances), one can lower bound the MSE of the best possible (information theoretic) attack, based on two parameters: FI of the encoding and a second parameter that depends on how flat/concentrated the distribution of the instance x is. Note that the second parameter also inherently shows up as one can approximate x well if it is too concentrated already. The paper also discusses how to compute the two parameters of interest, or at least approximate them, in practical settings. In particular, when the encoder is a Neural Net, the paper discusses how to use tools from previous work to approximate them using smooth functions that will be suitable for computing their FI. The final product is an "average case" notion of privacy that is tailored for inputs coming from (flat enough) distributions. The paper also presents experiments to validate its theory.

Strengths

Differential privacy is the golden standard for privacy at the moment. But it is also a good idea to look for new notions privacy that could be meaningful on their own and useful for certain settings. Hence, I find the overall goal of the paper positive and useful for putting new perspectives on privacy on the table. I also liked the fact that the paper made an effort to algorithmically compute their notion of privacy by approximating the two parameters of interest using tools from previous work.

Weaknesses

(also a limitation) Bounding MSE sometimes might not say anything about privacy, when all an adversary wants to do is finding a specific sensitive feature (and not approximating the instance in $\ell_2$ norm). So, more (context dependent) work is needed for finding whether this notion is actually a good notion of privacy or not. (also a question) The figures are not clear. For example, in Figure 2, what is the column numbers (Ref, 25, 10, 1) next to MNIST images? (also a question and limitation) The paper does experiments in which the MSE of certain encoders are evaluated. However, it is not clear to me how *useful* these encodings are *for training models* over the encoded instances. Note that without knowing how useful the encodings are, there is always a trivial fully private encoding: output $\bot$ all the time.

Questions

see the questions from the previous box. is there any hope that your approach can say something about the expected $\ell_\infty$ distance between adversary's guess and the true instance (rather than MSE) ?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

See the "weakness" section for some comments related to limitations as well. On the positive side, the paper itself has a a good "limitations" section at the end.

Reviewer KGoq7/10 · confidence 3/52023-07-08

Summary

This paper introduces a new theoretical measure, the "diagonal Fisher Information Leakage" (dFIL), for quantifying the privacy leakage in instance encoding mechanisms in machine learning models. The authors construct a framework that balances the trade-off between data privacy and utility in instance encoding. The authors start by developing the mathematical foundation of dFIL, leveraging the principle of Cramér-Rao Lower Bound (CRLB). They present a theoretical analysis which demonstrates that dFIL serves as an upper bound on the Mean Squared Error (MSE) of any estimator trying to reconstruct the original input from the encoded instances. The paper presents two case studies to showcase the practical application of dFIL. The first one focuses on private inference, where instance encoding is applied to an existing pretrained model. The second case study explores the possibility of training a model on instance-encoded data. The results from these studies confirm that models guided by dFIL can achieve reasonable performance while ensuring a high degree of privacy. Despite these advancements, the authors acknowledge the limitations of dFIL, such as the MSE bound not always correlating well with the semantic quality of the reconstruction, the average case bound provided by dFIL, and the difficulties of interpreting dFIL values in certain data types where MSE might not be directly meaningful or accurate. Recognizing these limitations, the paper calls for further research to explore and optimize the use of dFIL in designing and analyzing systems that use instance encoding for private inference and training.

Strengths

Strengths: 1. **Originality**: The concept of Diagonal Fisher Information Leakage (dFIL) is novel, offering a fresh perspective on privacy leakage quantification in instance encoding for machine learning models. The authors have done a commendable job in providing a new metric that has potential broad applications in designing and analyzing private machine learning systems. 2. **Quality**: The theoretical foundation of dFIL is well-crafted and robust, using the Cramér-Rao Lower Bound to derive the maximum leakage. This gives dFIL a solid grounding in statistical theory. The authors carefully reason about the limitations of their approach and provide a roadmap for further exploration. 3. **Clarity**: The paper is well-written and structured, making the complex concept of dFIL comprehensible. The authors articulate the theoretical underpinnings and practical implications of dFIL with clarity and precision. The use of case studies adds to the understanding of how dFIL can be applied in practical scenarios. 4. **Significance**: The presented work is of significant value as it paves a way for protecting data privacy in instance encoding mechanisms, a critical issue in today's data-centric machine learning landscape. The demonstrated applications in private inference and training suggest the potential of dFIL to guide the design of machine learning systems that respect privacy constraints while maintaining utility.

Weaknesses

1. **Limited empirical validation:** Although the theoretical development of dFIL is thorough and robust, the empirical validation seems somewhat limited. The authors conduct case studies on split inference and training with dFIL, which are commendable. However, additional experiments, especially on more diverse datasets and models, could strengthen the validity and generalizability of the dFIL measure. 2. **Absence of comparative analysis:** While the paper introduces dFIL as a novel concept, it doesn't provide a comparative analysis with other similar measures, if any exist. This makes it difficult for readers to evaluate the practical advantages or disadvantages of dFIL in contrast to other measures or approaches. 3. **Limited exploration of potential use-cases:** The authors present two case studies, however, the range of potential applications for dFIL could be broader. Additional use-cases illustrating how dFIL can guide the design of private machine learning systems would provide a more comprehensive view of the practical utility of dFIL. 4. **Interpretability of dFIL:** As the authors acknowledge in the Limitations section, for data types where MSE is not directly meaningful or the bound is inaccurate, interpreting the privacy of an encoding given its dFIL may not be straightforward. More investigation is needed to establish a clear and intuitive interpretation of dFIL values, especially in the context of real-world applications. 5. **Assumptions and constraints:** The assumptions underlying the derivation of dFIL and its applications need further exploration. For example, how sensitive is dFIL to the assumptions of model linearity, Gaussian noise, and others? The impact of violating these assumptions, and how they can be mitigated, would be valuable areas to explore.

Questions

1. The paper uses mean squared error (MSE) as a metric to quantify the quality of reconstructions. However, as the authors acknowledge, this may not always correlate with the semantic quality of reconstructions. Could you please elaborate more on the choice of this metric and how it might affect the overall performance of the system? And the paper mentions that for certain data types where MSE is not directly meaningful, interpreting the privacy of an encoding given its dFIL might be challenging. Could you provide examples of such data types and explain how dFIL might be adapted to handle them?

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

4 excellent

Contribution

3 good

Limitations

The authors have done a commendable job addressing the potential limitations of their work. They detail four specific limitations in section 6: 1. dFIL only bounds the mean squared error (MSE), which may not always correspond well with the semantic quality of reconstructions. 2. The derived bounds are average-case, meaning that individual data instances could experience lower reconstruction MSE than the bound. 3. For data types where MSE is not directly meaningful or the bound is inaccurate, interpreting the privacy of an encoding given its dFIL might be difficult. 4. Systems with the same dFIL may have different invertibility, as the bound from dFIL could be conservative. These limitations are articulated clearly, and the authors also suggest possible directions to address these limitations, such as exploring metrics other than MSE and calculating dFIL dynamically for each sample. In terms of the broader societal impact, the paper does not directly address this aspect. However, it's understandable, given the theoretical nature of the work. Future research could consider potential misuse of this technology, as well as possible regulatory or ethical issues that might arise from its application, particularly in scenarios where private or sensitive data are involved. Nonetheless, the paper's focus on improving privacy in machine learning is itself an important societal contribution, as it addresses a growing need in an increasingly data-driven world.

Reviewer KGoq2023-08-10

Dear Authors, Thank you for your detailed rebuttal in response to my review. I have received and read your explanations concerning the weaknesses, questions, and limitations raised. I will carefully consider your responses as I evaluate the revised version of the manuscript.

Reviewer yPPy2023-08-12

Thanks for the detailed responses. The concerns that I have about this paper are well addressed. I will raise my score.

Reviewer k1TB2023-08-14

thanks

thanks for the response.

Reviewer AWfY2023-08-15

Thanks a lot for your response, now it is easier to understand the relative importance of dFIL and the information theorist's Fisher information. I suggest you to add a comment in the paper on this matter. I updated my score.

Program Chairsdecision2023-09-21

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC