[Paper Review] Application-driven Privacy-preserving Data Publishing with Correlated Attributes

Aria Rezaei, Chaowei Xiao+3 more|arXiv (Cornell University)|Dec 26, 2018

Privacy-Preserving Technologies in Data50 references6 citations

TL;DR

This paper proposes PR-GAN, a novel privacy-preserving data publishing framework that uses generative adversarial networks to automatically perturb sensor data, hiding sensitive attributes (e.g., identity) while preserving utility for target applications. It achieves strong privacy guarantees under the Pufferfish framework by modeling correlations between target and sensitive attributes, outperforming conventional methods in both inference and training utility with minimal performance drop when transferred across unseen groups.

ABSTRACT

Recent advances in computing have allowed for the possibility to collect large amounts of data on personal activities and private living spaces. To address the privacy concerns of users in this environment, we propose a novel framework called PR-GAN that offers privacy-preserving mechanism using generative adversarial networks. Given a target application, PR-GAN automatically modifies the data to hide sensitive attributes -- which may be hidden and can be inferred by machine learning algorithms -- while preserving the data utility in the target application. Unlike prior works, the public's possible knowledge of the correlation between the target application and sensitive attributes is built into our modeling. We formulate our problem as an optimization problem, show that an optimal solution exists and use generative adversarial networks (GAN) to create perturbations. We further show that our method provides privacy guarantees under the Pufferfish framework, an elegant generalization of the differential privacy that allows for the modeling of prior knowledge on data and correlations. Through experiments, we show that our method outperforms conventional methods in effectively hiding the sensitive attributes while guaranteeing high performance in the target application, for both property inference and training purposes. Finally, we demonstrate through further experiments that once our model learns a privacy-preserving task, such as hiding subjects' identity, on a group of individuals, it can perform the same task on a separate group with minimal performance drops.

Motivation & Objective

• To address privacy leakage in unstructured sensor data where sensitive attributes (e.g., identity, location) are inferable via machine learning.
• To develop a framework that preserves data utility for target applications while effectively hiding sensitive attributes that are correlated with them.
• To model and defend against adversaries with prior knowledge of correlations between target and sensitive attributes.
• To enable private data publishing in IoT and distributed sensing environments without relying on trusted third parties.
• To ensure that privacy-preserving perturbations generalize across different user groups, enabling deployable models from centralized training.

Proposed method

• Formulate the privacy-preserving data publishing problem as an optimization task that balances utility for a target function and privacy for sensitive attributes.
• Use a generative adversarial network (GAN) to learn data perturbations that minimize utility loss for the target application while maximizing privacy for sensitive attributes.
• Incorporate the Pufferfish privacy framework to model prior knowledge and correlations between sensitive and target attributes, ensuring formal privacy guarantees.
• Train the generator to produce perturbations that maintain high accuracy for the target task (e.g., floor detection, identity classification) while reducing the accuracy of sensitive attribute inference.
• Leverage the target application’s labels during training to guide the GAN in generating application-aware perturbations that preserve utility.
• Enable transferability by training the perturbation model on one group and deploying it on a new, unseen group with minimal performance degradation.

Experimental results

Research questions

• RQ1 Can a GAN-based framework effectively hide sensitive attributes in sensor signals while maintaining high utility for a target application?
• RQ2 How does modeling correlations between target and sensitive attributes improve privacy protection compared to ignoring such correlations?
• RQ3 To what extent can a privacy-preserving perturbation model trained on one group of individuals be successfully applied to a completely different group?
• RQ4 How does the proposed method compare to conventional methods (e.g., DP, AP) in terms of privacy-utility trade-off?
• RQ5 Can perturbed data be used effectively to train new models that generalize well on clean data?

Key findings

• PR-GAN achieves a privacy guarantee of 3.71% accuracy for sensitive attribute inference (identity) on a new group, indicating strong privacy protection.
• The target application accuracy remains high at 86.9% when using perturbed data for inference on a new group, showing minimal utility loss.
• On the WiFi dataset, PR-GAN consistently outperforms DP, AP, and baseline GAN methods in the privacy-utility trade-off, especially at higher utility budgets.
• When used for training, the perturbed data achieves 96.72% accuracy on MNIST, 98.84% on PubFig, 72.06% on WiFi, and 99.73% on OccuTherm—close to the performance of clean data.
• The method maintains high utility and strong privacy even when the perturbation model is transferred from a training group to a completely different, unseen group of individuals.
• The framework provides formal privacy guarantees under the Pufferfish model, accounting for prior knowledge and attribute correlations, which strengthens defense against informed adversaries.