[Paper Review] Distributed Privacy-Preserving Prediction.

Lingjuan Lyu, Yee Wei Law+1 more|arXiv (Cornell University)|Oct 25, 2019

Privacy-Preserving Technologies in Data4 citations

TL;DR

This paper proposes a Distributed Privacy-Preserving Prediction (DPPP) framework that enables untrusted aggregators to combine multiple models' predictions without accessing raw data or model parameters, using distributed differential privacy and homomorphic encryption. The framework achieves strong privacy guarantees while maintaining performance comparable to non-private baselines.

ABSTRACT

In privacy-preserving machine learning, individual parties are reluctant to share their sensitive training data due to privacy concerns. Even the trained model parameters or prediction can pose serious privacy leakage. To address these problems, we demonstrate a generally applicable Distributed Privacy-Preserving Prediction (DPPP) framework, in which instead of sharing more sensitive data or model parameters, an untrusted aggregator combines only multiple models' predictions under provable privacy guarantee. Our framework integrates two main techniques to guarantee individual privacy. First, we improve the previous analysis of the Binomial mechanism to achieve distributed differential privacy. Second, we utilize homomorphic encryption to ensure that the aggregator learns nothing but the noisy aggregated prediction. We empirically evaluate the effectiveness of our framework on various datasets, and compare it with other baselines. The experimental results demonstrate that our framework has comparable performance to the non-private frameworks and delivers better results than the local differentially private framework and standalone framework.

Motivation & Objective

• To address privacy leakage in collaborative machine learning where sharing data or model parameters exposes sensitive information.
• To enable secure aggregation of predictions from multiple parties without revealing individual model outputs or parameters.
• To provide provable privacy guarantees in distributed settings where aggregators are untrusted.
• To maintain high predictive performance comparable to non-private learning frameworks.
• To integrate distributed differential privacy and homomorphic encryption for end-to-end privacy protection.

Proposed method

• The framework employs an enhanced analysis of the Binomial mechanism to achieve distributed differential privacy across multiple parties.
• It uses homomorphic encryption to allow the aggregator to compute a noisy sum of predictions without learning individual contributions.
• Each party computes a locally private prediction using the Binomial mechanism, ensuring individual privacy.
• The aggregator aggregates these noisy predictions homomorphically, preserving privacy throughout the process.
• The system ensures that only the final aggregated prediction is revealed, with no leakage of intermediate or individual data.
• The framework is designed to be generally applicable across various machine learning models and datasets.

Experimental results

Research questions

• RQ1 How can we enable secure, privacy-preserving aggregation of model predictions in a distributed setting?
• RQ2 Can we achieve provable privacy guarantees without sharing raw data or model parameters?
• RQ3 How does the integration of distributed differential privacy and homomorphic encryption affect prediction accuracy and system performance?
• RQ4 What is the trade-off between privacy and utility in distributed prediction scenarios?
• RQ5 How does the proposed framework compare to local differential privacy and non-private baselines in terms of accuracy and privacy?

Key findings

• The DPPP framework achieves comparable predictive performance to non-private learning frameworks on various datasets.
• It delivers better results than both local differentially private frameworks and standalone models in terms of accuracy and privacy.
• The integration of distributed differential privacy and homomorphic encryption ensures that the aggregator learns only the final noisy aggregated prediction.
• The framework provides provable privacy guarantees through rigorous analysis of the Binomial mechanism in a distributed setting.
• Empirical evaluation confirms that the system maintains high utility while protecting individual privacy.
• The approach is generally applicable and does not require trust in the aggregator or sharing of sensitive model parameters.