[Paper Review] Generative Models for Effective ML on Private, Decentralized Datasets

Sean Augenstein, H. Brendan McMahan+6 more|arXiv (Cornell University)|Nov 15, 2019

Privacy-Preserving Technologies in Data46 references43 citations

TL;DR

The paper demonstrates that privacy-preserving federated generative models can debug data quality and labeling issues when direct access to private, decentralized data is unavailable, using DP-FedAvg-trained RNNs for text and DP-FedAvg-GANs for images.

ABSTRACT

To improve real-world applications of machine learning, experienced modelers develop intuition about their datasets, their models, and how the two interact. Manual inspection of raw data - of representative samples, of outliers, of misclassifications - is an essential tool in a) identifying and fixing problems in the data, b) generating new modeling hypotheses, and c) assigning or refining human-provided labels. However, manual data inspection is problematic for privacy sensitive datasets, such as those representing the behavior of real-world individuals. Furthermore, manual data inspection is impossible in the increasingly important setting of federated learning, where raw examples are stored at the edge and the modeler may only access aggregated outputs such as metrics or model parameters. This paper demonstrates that generative models - trained using federated methods and with formal differential privacy guarantees - can be used effectively to debug many commonly occurring data issues even when the data cannot be directly inspected. We explore these methods in applications to text with differentially private federated RNNs and to images using a novel algorithm for differentially private federated GANs.

Motivation & Objective

• Identify challenges in ML workflows when data cannot be inspected due to privacy or decentralization.
• Propose a workflow using auxiliary, privacy-preserving generative models to replace data inspection for debugging tasks.
• Demonstrate DP-enabled federated generative models for text (RNNs) and images (GANs) that reveal data issues without exposing private data.
• Show how these models can detect and help fix real-world data bugs in FL settings.

Proposed method

• Combine three technologies: deep generative models, federated learning (FL), and differential privacy (DP) to train privacy-preserving generative models on decentralized data.
• Express inspection tasks as data selection criteria and train generative models on the selected subsets to mimic non-inspectable data (T1–T6).
• Adapt GANs to the federated DP setting with a server-side generator and DP-discriminator updates in a DP-FedAvg-GAN algorithm.
• Use DP-FedAvg for RNNs to train word-language models on-device, enabling detection of tokenization and OOV-related bugs (T3).
• Train two complementary models (primary model on-device and auxiliary DP model) to synthesize representative private data without leaking sensitive information.

Experimental results

Research questions

• RQ1 How can privacy-preserving federated generative models substitute direct data inspection for debugging in FL settings?
• RQ2 Can DP-FedAvg-trained RNNs and GANs accurately reveal common data-quality and preprocessing bugs without exposing private data?
• RQ3 What privacy budgets (ε, δ) are achievable at realistic population scales while preserving utility for debugging?
• RQ4 How do auxiliary generative models assist in diagnosing issues in text preprocessing, labeling, and bias detection under DP and FL constraints?

Key findings

• DP federated generative models enable debugging of data issues without inspecting private data.
• DP-FedAvg-RNNs can reveal tokenization bugs and increased OOV rates indicative of preprocessing errors.
• DP-FedAvg-GANs can reveal image preprocessing bugs (e.g., pixel inversion) by contrasting outputs from subpopulations with varying accuracy.
• With realistic population sizes, single-digit privacy budgets (ε in the range ~1.5–2.4) are achievable while maintaining useful synthetic data quality.
• The approach demonstrates practical privacy guarantees and utility trade-offs in both text and image debugging scenarios.