Deep learning based on artificial neural networks is a very popular approach to modeling, classifying, and recognizing complex data such as images, speech, and text The unprecedented accuracy of deep learning methods has turned them into the foundation of new AI-based services on the Internet Commercial companies that collect user data on a large scale have been the main beneficiaries of this trend since the success of deep learning techniques is directly proportional to the amount of data available for training Massive data collection required for deep learning presents obvious privacy issues Users' personal, highly sensitive data such as photos and voice recordings is kept indefinitely by the companies that collect it Users can neither delete it, nor restrict the purposes for which it is used Furthermore, centrally kept data is subject to legal subpoenas and extra-judicial surveillance Many data owners--for example, medical institutions that may want to apply deep learning methods to clinical records--are prevented by privacy and confidentiality concerns from sharing the data and thus benefitting from large-scale deep learning In this paper, we design, implement, and evaluate a practical system that enables multiple parties to jointly learn an accurate neural-network model for a given objective without sharing their input datasets We exploit the fact that the optimization algorithms used in modern deep learning, namely, those based on stochastic gradient descent, can be parallelized and executed asynchronously Our system lets participants train independently on their own datasets and selectively share small subsets of their models' key parameters during training This offers an attractive point in the utility/privacy tradeoff space: participants preserve the privacy of their respective data while still benefitting from other participants' models and thus boosting their learning accuracy beyond what is achievable solely on their own inputs We demonstrate the accuracy of our privacy-preserving deep learning on benchmark datasets

/pdf/privacy-preserving-deep-learning-3rlsmam417.pdf

Privacy-Preserving Deep Learning

Some machine learning applications involve training data that is sensitive, such as the medical histories of patients in a clinical trial. A model may inadvertently and implicitly store some of its training data; careful analysis of the model may therefore reveal sensitive information. 
To address this problem, we demonstrate a generally applicable approach to providing strong privacy guarantees for training data: Private Aggregation of Teacher Ensembles (PATE). The approach combines, in a black-box fashion, multiple models trained with disjoint datasets, such as records from different subsets of users. Because they rely directly on sensitive data, these models are not published, but instead used as "teachers" for a "student" model. The student learns to predict an output chosen by noisy voting among all of the teachers, and cannot directly access an individual teacher or the underlying data or parameters. The student's privacy properties can be understood both intuitively (since no single teacher and thus no single dataset dictates the student's training) and formally, in terms of differential privacy. These properties hold even if an adversary can not only query the student but also inspect its internal workings. 
Compared with previous work, the approach imposes only weak assumptions on how teachers are trained: it applies to any model, including non-convex models like DNNs. We achieve state-of-the-art privacy/utility trade-offs on MNIST and SVHN thanks to an improved privacy analysis and semi-supervised learning.

Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data

Today's Internet services rely heavily on text-based passwords for user authentication. The pervasiveness of these services coupled with the difficulty of remembering large numbers of secure passwords tempts users to reuse passwords at multiple sites. In this paper, we investigate for the first time how an attacker can leverage a known password from one site to more easily guess that user's password at other sites. We study several hundred thousand leaked passwords from eleven web sites and conduct a user survey on password reuse; we estimate that 43- 51% of users reuse the same password across multiple sites. We further identify a few simple tricks users often employ to transform a basic password between sites which can be used by an attacker to make password guessing vastly easier. We develop the first cross-site password-guessing algorithm, which is able to guess 30% of transformed passwords within 100 attempts compared to just 14% for a standard password-guessing algorithm without cross-site password knowledge.

/pdf/the-tangled-web-of-password-reuse-1gv2lzmmxe.pdf

The Tangled Web of Password Reuse

In recent years, signal processing applications that deal with user-related data have aroused privacy concerns. For instance, face recognition and personalized recommendations rely on privacy-sensitive information that can be abused if the signal processing is executed on remote servers or in the cloud. In this tutorial article, we introduce the fusion of signal processing and cryptography as an emerging paradigm to protect the privacy of users. While service providers cannot access directly the content of the encrypted signals, the data can still be processed in encrypted form to perform the required signal processing task. The solutions for processing encrypted data are designed using cryptographic primitives like homomorphic cryptosystems and secure multiparty computation (MPC).

Encrypted signal processing for privacy protection: Conveying the utility of homomorphic encryption and multiparty computation

Machine learning algorithms based on neural networks have achieved remarkable results and are being extensively used in different domains. However, the machine learning algorithms requires access to raw data which is often privacy sensitive. To address this issue, we develop new techniques to provide solutions for running deep neural networks over encrypted data. In this paper, we develop new techniques to adopt deep neural networks within the practical limitation of current homomorphic encryption schemes. We focus on training and classification of the well-known neural networks and convolutional neural networks. First, we design methods for approximation of the activation functions commonly used in CNNs (i.e. ReLU, Sigmoid, and Tanh) with low degree polynomials which is essential for efficient homomorphic encryption schemes. Then, we train neural networks with the approximation polynomials instead of original activation functions and analyze the performance of the models. Finally, we implement neural networks and convolutional neural networks over encrypted data and measure performance of the models.

/pdf/privacy-preserving-machine-learning-as-a-service-2xcwkzq6q4.pdf

Privacy-preserving Machine Learning as a Service

Alice possesses a sample of private data from which she wishes to obtain some probabilistic inference. Bob possesses Hidden Markov Models (HMMs) for this purpose, but he wants the model parameters to remain private. This paper develops a framework that enables Alice and Bob to collaboratively compute the so-called forward algorithm for HMMs while satisfying their privacy constraints. This is achieved using a public-key additively homomorphic cryptosystem. Our framework is asymmetric in the sense that a larger computational overhead is incurred by Bob who has higher computational resources at his disposal, compared with Alice who has limited computing resources. Practical issues such as the encryption of probabilities and the effect of finite precision on the accuracy of probabilistic inference are considered. The protocol is implemented in software and used for secure keyword recognition.

/pdf/privacy-preserving-probabilistic-inference-with-hidden-4p9dxyqyi1.pdf

Privacy preserving probabilistic inference with Hidden Markov Models

Alice and Bob possess strings x and y of length m and n respectively and want to compute the Levenshtein distance L(x, y) between the strings under privacy and communication constraints. The Levenshtein distance, or edit distance, has a dynamic programming formulation that solves a series of minimum-finding problems. Based on this formulation, there are known symmetric privacy-preserving protocols for the computation of L(x, y), in which the two parties incur equal protocol overhead. In this work, we propose an asymmetric two-party protocol in which a lightweight client Bob with a string y interacts with a single powerful server Alice containing string x in its database. We present a privacy-preserving minimum-finding protocol based on semantically secure homomorphic functions and additive secret sharing. This protocol is executed repeatedly, to enable private computation of the edit distance. Our protocol supports arbitrary finite insertion/deletion costs and a variety of substitution costs. While Alice requires similar effort as in previous approaches, the advantage is that Bob incurs far fewer ciphertext operations and transmissions, making the protocol well-suited for client-server querying applications.

Privacy preserving string comparisons based on Levenshtein distance

Alice and Bob possess sequences x and y respectively and would like to compute the l 1 distance, namely || x — y || 1 under privacy and communication constraints. The privacy constraint requires that Alice and Bob do not reveal their data to each other. The communication constraint requires that they accomplish the secure distance calculation with a small number of protocol transmissions and key exchanges. This paper describes and analyzes a privacy-preserving approximation protocol for the l 1 distance that keeps the communication overhead manageable by performing a Johnson-Lindenstrauss embedding into the l 1 space. Then, it performs secure two-party computation of l 1 distances using Paillier homomorphic encryption. The protocol is implemented for private querying of face images, while maintaining a low communication overhead between the querying party and a remote database of face feature vectors.

/pdf/privacy-preserving-approximation-of-l1-distance-for-4r4lu8fgbp.pdf

Privacy-preserving approximation of L1 distance for multimedia applications

Alice and Bob possess sequences xn and yn respectively and would like to compute d(xn, yn) where d(· , ·) is a distortion measure. However, Alice and Bob do not trust each other and do not wish to reveal their data to each other. This paper describes and analyzes a protocol that uses homomorphic encryption for secure calculation of some special distortion functions without revealing xn and yn. The resulting distortion result is also in encrypted form. Two variants of the protocol are presented, one for the Hamming distance between binary vectors, and the other for squared error distortion between integer vectors. An application of the protocol for private biometric authentication is described in which Bob interacts with a remote encrypted fingerprint database (Alice) to achieve access control without revealing his own identity.

/pdf/secure-distortion-computation-among-untrusting-parties-using-49atsy726w.pdf

Secure distortion computation among untrusting parties using homomorphic encryption

Embodiments of the invention discloses a system and a method for determining a result of applying a function to signals including a first signal and a second signal, wherein the function is a polynomial function of the signals such that a monomial in the function includes the first signal having a power less than or equal to a first maximum power, and wherein the first signal is partitioned into a first subsignal and a second subsignal, comprising a processor for performing steps of the method, comprising the steps of acquiring a second signal and a second subsignal; acquiring a set of encrypted powers of the first subsignal, wherein the set of encrypted powers of the first subsignal includes homomorphically encrypted powers of the first subsignal; and determining an encrypted result of the function based on a second subsignal, the set of encrypted powers of the first subsignal, and the second signal.

Wei Sun

Papers

Privacy preserving probabilistic inference with Hidden Markov Models

Privacy preserving string comparisons based on Levenshtein distance

Privacy-preserving approximation of L1 distance for multimedia applications

Secure distortion computation among untrusting parties using homomorphic encryption

Method for Determining Functions Applied to Signals