[Paper Review] Threshold KNN-Shapley: A Linear-Time and Privacy-Friendly Approach to Data Valuation

Jiachen T. Wang, Yuqing Zhu+3 more|arXiv (Cornell University)|Aug 30, 2023

Privacy-Preserving Technologies in Data4 citations

TL;DR

This paper proposes Threshold KNN-Shapley (TKNN-Shapley), a linear-time, privacy-friendly data valuation method that replaces standard KNN-Shapley by using a threshold-based neighbor selection instead of fixed K-nearest neighbors. It enables efficient differentially private data valuation with superior privacy-utility tradeoffs, while maintaining performance comparable to KNN-Shapley on real-world datasets.

ABSTRACT

Data valuation aims to quantify the usefulness of individual data sources in training machine learning (ML) models, and is a critical aspect of data-centric ML research. However, data valuation faces significant yet frequently overlooked privacy challenges despite its importance. This paper studies these challenges with a focus on KNN-Shapley, one of the most practical data valuation methods nowadays. We first emphasize the inherent privacy risks of KNN-Shapley, and demonstrate the significant technical difficulties in adapting KNN-Shapley to accommodate differential privacy (DP). To overcome these challenges, we introduce TKNN-Shapley, a refined variant of KNN-Shapley that is privacy-friendly, allowing for straightforward modifications to incorporate DP guarantee (DP-TKNN-Shapley). We show that DP-TKNN-Shapley has several advantages and offers a superior privacy-utility tradeoff compared to naively privatized KNN-Shapley in discerning data quality. Moreover, even non-private TKNN-Shapley achieves comparable performance as KNN-Shapley. Overall, our findings suggest that TKNN-Shapley is a promising alternative to KNN-Shapley, particularly for real-world applications involving sensitive data.

Motivation & Objective

• Address the overlooked privacy risks in data valuation, particularly for KNN-Shapley, which can leak information about training data points through value scores.
• Identify that KNN-Shapley's high global sensitivity makes it incompatible with differential privacy (DP) without significant utility loss.
• Develop a new data valuation framework that is both computationally efficient and natively compatible with DP guarantees.
• Demonstrate that TKNN-Shapley achieves comparable performance to KNN-Shapley while enabling effective DP through simple counting queries.
• Provide empirical validation of TKNN-Shapley’s robustness and utility across diverse datasets under both non-private and differentially private settings.

Proposed method

• Introduce Threshold-KNN (TKNN), a variant of KNN that includes all training points within a fixed distance threshold of a test point, rather than exactly K nearest neighbors.
• Derive a closed-form expression for the Data Shapley value under the TKNN classifier, enabling exact computation in linear time.
• Show that TKNN-Shapley depends only on three counting queries (e.g., number of neighbors within threshold), which are naturally amenable to differential privacy via Laplace or Gaussian mechanisms.
• Construct DP-TKNN-Shapley by adding calibrated noise to these counting queries, ensuring formal DP guarantees.
• Leverage the structural simplicity of TKNN-Shapley to allow efficient, scalable, and private data valuation without model retraining.
• Use the same embedding-based framework as KNN-Shapley, applying TKNN-Shapley to last-layer neural network representations for high-dimensional data.

Experimental results

Research questions

• RQ1 To what extent does KNN-Shapley expose private information about training data points through its value scores?
• RQ2 What are the technical barriers to applying differential privacy to KNN-Shapley, and why is its global sensitivity prohibitive for DP?
• RQ3 Can a modified KNN-based data valuation method be designed to be both computationally efficient and natively differentially private?
• RQ4 How does the privacy-utility tradeoff of DP-TKNN-Shapley compare to naively privatized KNN-Shapley in detecting mislabeled or noisy data?
• RQ5 Does TKNN-Shapley maintain performance comparable to KNN-Shapley in data quality assessment tasks under non-private settings?

Key findings

• KNN-Shapley poses significant privacy risks, as demonstrated by a membership inference-style attack that infers data point presence/absence using value score variations.
• KNN-Shapley has high global sensitivity, making it inherently incompatible with differential privacy without substantial utility loss.
• TKNN-Shapley achieves performance on par with KNN-Shapley in detecting mislabeled and noisy data across multiple datasets, including 2dPlanes, CPU, and Fraud.
• DP-TKNN-Shapley provides a superior privacy-utility tradeoff compared to naively privatized KNN-Shapley, particularly in identifying low-quality data points.
• The method is computationally efficient, with exact computation in linear time, and supports end-to-end differentially private data valuation via simple counting queries.
• Empirical results show that TKNN-Shapley is robust to hyperparameter choices (e.g., τ and K), maintaining stable performance across different thresholds and neighbor counts.