[论文解读] DeepObfuscator: Obfuscating Intermediate Representations with Privacy-Preserving Adversarial Learning on Smartphones

Ang Li, Jiayi Guo+3 more|arXiv (Cornell University)|Sep 9, 2019

Adversarial Robustness in Machine Learning参考文献 40被引用 8

一句话总结

DeepObfuscator 是一种隐私保护对抗性训练框架，通过在智能手机上混淆中间特征，防止原始图像的重建和性别、年龄等私有属性的推断。通过对抗性地训练混淆器以对抗重建器和分类器，将 MS-SSIM 从 0.9458 降低至 0.3175，私有属性准确率降至接近随机猜测水平（性别为 58.85%），同时仅导致目标分类准确率下降 2%。

ABSTRACT

Deep learning has been widely applied in many computer vision applications, with remarkable success. However, running deep learning models on mobile devices is generally challenging due to the limitation of computing resources. A popular alternative is to use cloud services to run deep learning models to process raw data. This, however, imposes privacy risks. Some prior arts proposed sending the features extracted from raw data to the cloud. Unfortunately, these extracted features can still be exploited by attackers to recover raw images and to infer embedded private attributes. In this paper, we propose an adversarial training framework, DeepObfuscator, which prevents the usage of the features for reconstruction of the raw images and inference of private attributes. This is done while retaining useful information for the intended cloud service. DeepObfuscator includes a learnable obfuscator that is designed to hide privacy-related sensitive information from the features by performing our proposed adversarial training algorithm. The proposed algorithm is designed by simulating the game between an attacker who makes efforts to reconstruct raw image and infer private attributes from the extracted features and a defender who aims to protect user privacy. By deploying the trained obfuscator on the smartphone, features can be locally extracted and then sent to the cloud. Our experiments on CelebA and LFW datasets show that the quality of the reconstructed images from the obfuscated features of the raw image is dramatically decreased from 0.9458 to 0.3175 in terms of multi-scale structural similarity. The person in the reconstructed image, hence, becomes hardly to be re-identified. The classification accuracy of the inferred private attributes that can be achieved by the attacker is significantly reduced to a random-guessing level.

研究动机与目标

• 通过防止从提取的特征中重建原始图像，解决基于云的深度学习中的隐私泄露问题。
• 防御从发送到云端的中间表示中推断私有属性（例如性别、年龄）的攻击。
• 在强混淆条件下，仍保持对目标分类任务（例如图像分类）的高实用性。
• 通过高效模型设计实现在资源受限智能手机上的实时部署。
• 通过联合对抗性训练，同时防御图像重建和私有属性推断攻击。

提出的方法

• 提出一种端到端的对抗性训练框架，包含可学习的混淆器、云端分类器以及两个对抗模型：重建器和分类器。
• 混淆器被训练以最小化主任务的效用损失，同时最大化对抗模型在重建原始图像和推断私有属性方面的错误率。
• 采用多尺度结构相似性（MS-SSIM）作为对抗重建器的感知损失，替代欧氏距离，以更好地反映人类视觉感知。
• 采用类似 GAN 的极小化-极大化博弈：混淆器隐藏泄露隐私的信息，而对抗模型则尝试恢复这些信息，通过对抗性竞争构建鲁棒防御。
• 将训练好的混淆器部署在智能手机上，本地处理原始图像并生成具有隐私保护特性的特征，再发送至云端。
• 引入双重对抗损失：一个用于图像重建（基于 MS-SSIM），一个用于私有属性推断（交叉熵），两者在联合训练方案中进行优化。

实验结果

研究问题

• RQ1 混淆框架能否同时防止从中间特征中重建图像和推断私有属性？
• RQ2 所提出的对抗性训练框架在降低重建图像的感知质量的同时，对主任务实用性的保持效果如何？
• RQ3 该框架对目标云端分类任务准确率的降级程度如何？
• RQ4 混淆后的特征是否可在不同数据集间迁移，表明其泛化能力与实际应用潜力？
• RQ5 在移动设备上部署时，混淆器的实时性能表现如何？

主要发现

• 原始图像与重建图像之间的 MS-SSIM 从 0.9458 降低至 0.3175，表明重建图像在感知上已无法辨认，人物不再可识别。
• 性别等私有属性的分类准确率从 97.36% 降低至 58.85%，接近 50% 的随机猜测水平。
• 在混淆后，云端目标图像分类任务的准确率仅下降 2%，证明了其在隐私与实用性之间具有出色的权衡能力。
• 跨数据集评估证实了混淆器的可迁移性，表明其在不同数据分布下均具有鲁棒性和泛化能力。
• 混淆器在智能手机上实现了实时性能，证实其在移动和边缘环境中的可部署性。
• 将损失函数替换为欧氏距离（如 PAN 中所用）会导致重建图像仍保留可识别的面部特征，而 DeepObfuscator 基于 MS-SSIM 的损失则产生了显著更优的隐私保护效果。