[论文解读] Privacy-Preserving Machine Learning: Methods, Challenges and Directions

Runhua Xu, Nathalie Baracaldo+1 more|arXiv (Cornell University)|Aug 10, 2021

Privacy-Preserving Technologies in Data参考文献 197被引用 75

一句话总结

对隐私保护机器学习（PPML）的系统性综述，介绍 PGU 三元组（Phase, Guarantee, Utility）以评估 PPML 解决方案，并概述分类体系、挑战与未来方向。

ABSTRACT

Machine learning (ML) is increasingly being adopted in a wide variety of application domains. Usually, a well-performing ML model relies on a large volume of training data and high-powered computational resources. Such a need for and the use of huge volumes of data raise serious privacy concerns because of the potential risks of leakage of highly privacy-sensitive information; further, the evolving regulatory environments that increasingly restrict access to and use of privacy-sensitive data add significant challenges to fully benefiting from the power of ML for data-driven applications. A trained ML model may also be vulnerable to adversarial attacks such as membership, attribute, or property inference attacks and model inversion attacks. Hence, well-designed privacy-preserving ML (PPML) solutions are critically needed for many emerging applications. Increasingly, significant research efforts from both academia and industry can be seen in PPML areas that aim toward integrating privacy-preserving techniques into ML pipeline or specific algorithms, or designing various PPML architectures. In particular, existing PPML research cross-cut ML, systems and applications design, as well as security and privacy areas; hence, there is a critical need to understand state-of-the-art research, related challenges and a research roadmap for future research in PPML area. In this paper, we systematically review and summarize existing privacy-preserving approaches and propose a Phase, Guarantee, and Utility (PGU) triad based model to understand and guide the evaluation of various PPML solutions by decomposing their privacy-preserving functionalities. We discuss the unique characteristics and challenges of PPML and outline possible research directions that leverage as well as benefit multiple research communities such as ML, distributed systems, security and privacy.

研究动机与目标

• 由于 ML 流水线中的隐私风险和监管约束，提出对 PPML 的需求动机。
• 提出一个整体框架（PGU），用于在阶段、保障和效用维度评估 PPML 方法。
• 将 PPML 解决方案归类为数据发布、数据处理、体系架构和混合类别。
• 从面向对象和面向流水线的角度分析隐私保障。

提出的方法

• 提出 PGU（Phase, Guarantee, Utility）三元组以分解 PPML 的功能。
• 将 PPML 解决方案映射到隐私保护的阶段：数据准备、模型生成、服务端部署和推断。
• 区分面向对象的隐私保障（输入数据和模型权重）与面向流水线的保障（本地、全局、全链隐私）。
• 将 PPML 技术分类为数据发布、数据处理、架构化和混合方法，并评估它们对效用的影响。
• 讨论衡量隐私、攻击/防御策略及效率考量方面的挑战与方向。

实验结果

研究问题

• RQ1 PPML 方法在整个 ML 流水线中提供的核心隐私保护功能是什么？
• RQ2 如何使用 PGU 框架来评估 PPML 解决方案中隐私保障的强度和范围？
• RQ3 哪种分类法最能准确描述 PPML 的技术方法及其对效用的影响？
• RQ4 未来 PPML 研究面临的开放挑战与有前景的方向有哪些？

主要发现

• PPML 解决方案多样，可通过 Phase、Guarantee 与 Utility (PGU) 视角来理解。
• 隐私保障可以从面向对象（数据/模型）和面向流水线（本地/全局/全链）视角进行分析。
• 四分分类法（数据发布、数据处理、架构、混合）涵盖主要的 PPML 方法及其效用权衡。
• 隐私保护的数据准备通常依赖去识别化或差分隐私，而基于密码学的训练/推断则利用同态加密/联邦学习等相关技术。
• 完整的隐私保护流水线仍然罕见，需要将隐私保护训练和服务策略整合。
• 本文概述了跨越测量、攻击/防御、效率、隐私-效用权衡以及基准测试的未解问题与方向。