[Paper Review] A Differentially Private Text Perturbation Method Using a Regularized Mahalanobis Metric

Zekun Xu, Abhinav Aggarwal+2 more|arXiv (Cornell University)|Oct 22, 2020

Privacy-Preserving Technologies in Data42 references4 citations

TL;DR

This paper proposes a differentially private text perturbation method that uses a regularized Mahalanobis metric to adaptively scale noise based on word embedding covariance structure, improving privacy in sparse regions without sacrificing utility. The method achieves significantly better privacy statistics—lower word non-replacement rates and higher substitution diversity—compared to the multivariate Laplace mechanism, while maintaining equivalent downstream classification performance.

ABSTRACT

Balancing the privacy-utility tradeoff is a crucial requirement of many practical machine learning systems that deal with sensitive customer data. A popular approach for privacy-preserving text analysis is noise injection, in which text data is first mapped into a continuous embedding space, perturbed by sampling a spherical noise from an appropriate distribution, and then projected back to the discrete vocabulary space. While this allows the perturbation to admit the required metric differential privacy, often the utility of downstream tasks modeled on this perturbed data is low because the spherical noise does not account for the variability in the density around different words in the embedding space. In particular, words in a sparse region are likely unchanged even when the noise scale is large. %Using the global sensitivity of the mechanism can potentially add too much noise to the words in the dense regions of the embedding space, causing a high utility loss, whereas using local sensitivity can leak information through the scale of the noise added. In this paper, we propose a text perturbation mechanism based on a carefully designed regularized variant of the Mahalanobis metric to overcome this problem. For any given noise scale, this metric adds an elliptical noise to account for the covariance structure in the embedding space. This heterogeneity in the noise scale along different directions helps ensure that the words in the sparse region have sufficient likelihood of replacement without sacrificing the overall utility. We provide a text-perturbation algorithm based on this metric and formally prove its privacy guarantees. Additionally, we empirically show that our mechanism improves the privacy statistics to achieve the same level of utility as compared to the state-of-the-art Laplace mechanism.

Motivation & Objective

• To address the privacy-utility tradeoff in text data perturbation, especially for words in low-density regions of embedding space.
• To overcome the limitation of spherical noise in multivariate Laplace mechanisms, which fail to perturb sparse-region words effectively even at high noise scales.
• To design a noise mechanism that accounts for the intrinsic covariance structure of word embeddings to improve substitution likelihood in sparse areas.
• To formally prove metric differential privacy for the proposed Mahalanobis-based perturbation mechanism.
• To empirically validate that the method improves privacy statistics while maintaining utility comparable to state-of-the-art Laplace mechanisms.

Proposed method

• The method maps text to continuous word embeddings and applies elliptical noise using a regularized Mahalanobis norm to calibrate noise scale according to local embedding covariance.
• The Mahalanobis metric is derived from the global covariance matrix of the vocabulary’s word embeddings, stretching noise in directions of high variance to enhance perturbation in sparse regions.
• A regularization term is introduced to the Mahalanobis metric to stabilize the inverse covariance estimate and prevent overfitting to sparse data.
• Noise is sampled from a multivariate Laplace distribution with a covariance structure defined by the regularized Mahalanobis metric, ensuring metric differential privacy.
• The mechanism projects perturbed embeddings back to the discrete vocabulary space using nearest-neighbor lookup.
• The privacy budget ε is calibrated using global sensitivity, with the tuning parameter λ controlling the regularization strength.

Experimental results

Research questions

• RQ1 Can a Mahalanobis-based noise mechanism improve privacy statistics in text perturbation by adapting to embedding space covariance?
• RQ2 Does the proposed mechanism achieve better substitution rates for words in sparse embedding regions compared to spherical noise in the multivariate Laplace mechanism?
• RQ3 To what extent does the Mahalanobis mechanism maintain downstream utility compared to the Laplace mechanism under equivalent privacy budgets?
• RQ4 How does the regularization parameter λ affect the tradeoff between privacy and utility in the proposed framework?
• RQ5 Can the Mahalanobis mechanism be extended to local covariance estimation per word cluster for improved personalization?

Key findings

• The Mahalanobis mechanism significantly reduces the mean number of non-replaced words (Nw) and increases the mean number of distinct substitutions (Sw) across all privacy budgets, especially in the medium ε range (ε = 5, 10, 20).
• For ε = 10, the Mahalanobis mechanism achieved a mean Nw of 12.3 and mean Sw of 87.7, compared to 28.1 and 71.9 for the Laplace mechanism, with 95% confidence intervals confirming statistical significance.
• On the Twitter and SMSSpam datasets, text classification accuracy, precision, and recall remained nearly identical across both mechanisms across all ε and λ values, demonstrating maintained utility.
• The method achieved better privacy statistics than the multivariate Laplace mechanism at the same noise scale, indicating improved privacy guarantees without utility loss.
• Empirical results on both 300-d GloVe and FastText embeddings showed consistent improvements in privacy metrics, validating the method’s robustness across embedding types.
• The regularization parameter λ was found to be effective in tuning the privacy-utility tradeoff, with grid search over [0,1] sufficient for optimization.