Differentially-private stochastic gradient descent (DP-SGD) represents the de-facto standard for privacy-preserving training of neural networks (NNs) under the differential privacy (DP) model. Its canonical formulation assumes that both the input features and the corresponding labels of training instances require protection. Newer developments explore scenarios in which only the labels are private, while the features are public. Doing so decreases the amount of required noise, leading to improved model accuracy. We investigate a complementary and underexplored setting where labels are non-sensitive, but the input features contain private information. Instead of perturbing gradients, our proposed methodology for training private NNs adds noise at a designated sanitization layer within the network. We analyze key architectural and algorithmic trade-offs inherent in this design and demonstrate how modifying the network architecture to reflect these considerations can lead to improved predictive performance. We also devise two adaptive algorithm optimizations: the first one identifies early stopping conditions in the learning process in order to save privacy budget and boost the protection strength; the second customizes the clipping threshold at each learning iteration in order to improve accuracy. Extensive experiments on real data show that our approach significantly outperforms the DP-SGD baseline.
In this paper, we discuss some practical issues encountered when estimating record-level and file-level disclosure risk measures of re-identification in survey microdata under complex survey designs. We use the probabilistic modelling approach based on the Poisson Distribution and log-linear modelling proposed in Skinner and Shlomo (2008) to estimate disclosure risk in survey microdata files. We examine the robustness of their GOF criteria to violations of model assumptions, particularly in the context of complex survey designs and differential survey weights, using a case study and simulations. We also provide guidance for variable selection with insights on how to proceed with the disclosure risk assessment and provide meaningful results. For the case study, we use the complex survey dataset from the Survey of Doctorate Recipients conducted by the National Center for Science and Engineering Statistics. The results of evaluating the disclosure risk estimates under different approaches of adjusting the probabilistic modelling to account for the complex survey data lead to guidance for a sensitivity analysis that helps to provide better estimates of record-level and file-level risk of re-identification in survey microdata.
We introduce a logical framework named Distributed Labeled Tagged Transition System (DLTTS), using concepts from Probabilistic Automata, Probabilistic Concurrent Systems, and Probabilistic labelled transition systems. We show that DLTTS can be used to formally model how a given piece of private information P (e.g., a set of tuples) stored in a given database D can get captured progressively by an adversary A repeatedly querying D, enhancing the knowledge acquired from the answers to these queries with relational deductions using certain additional non-private data. The database D is assumed protected with generalization mechanisms. We also show that, on a large class of databases, metrics can be defined 'value-wise', and more general notions of adjacency between data bases can be defined, based on these metrics. These notions can also play a role in differentially private protection mechanisms.
Machine learning models can inadvertently expose confidential properties of their training data, making them vulnerable to membership inference attacks (MIA). While numerous evaluation methods exist, many require computationally expensive processes, such as training multiple shadow models. This article presents two new complementary approaches for efficiently identifying vulnerable tree-based models: an ante-hoc analysis of hyperparameter choices and a post-hoc examination of trained model structure. While these new methods cannot certify whether a model is safe from MIA, they provide practitioners with a means to significantly reduce the number of models that need to undergo expensive MIA assessment through a hierarchical filtering approach. More specifically, it is shown that the rank order of disclosure risk for different hyperparameter combinations remains consistent across datasets, enabling the development of simple, human-interpretable rules for identifying relatively high-risk models before training. While this ante-hoc analysis cannot determine absolute safety since this also depends on the specific dataset, it allows the elimination of unnecessarily risky configurations during hyperparameter tuning. Additionally, computationally inexpensive structural metrics serve as indicators of MIA vulnerability, providing a second filtering stage to identify risky models after training but before conducting expensive attacks. Empirical results show that hyperparameter-based risk prediction rules can achieve high accuracy in predicting the most at risk combinations of hyperparameters across different tree-based model types, while requiring no model training. Moreover, target model accuracy is not seen to correlate with privacy risk, suggesting opportunities to optimise model configurations for both performance and privacy.
Privacy regulations require that images depicting humans be anonymized before they are publicly released or shared for secondary use. However, current image anonymization methods significantly degrade the analytical utility of protected images. This paper addresses the challenge of balancing privacy protection and utility preservation in image anonymization. We propose a general disclosure risk-aware anonymization framework that leverages explainability techniques to target identity-revealing features in images. Contrary to conventional methods, which uniformly perturb all image pixels, our proposal focuses on perturbing the pixels that contribute most to disclosure. Moreover, pixel perturbation is enforced incrementally and it is driven by the observed residual risk. Our framework is not tied to a specific pixel perturbation mechanism, and is versatile enough to support a wide variety of techniques, including blurring, pixelation, noise addition and pixel masking. Empirical results show that even with the simplest perturbation techniques, our approach significantly improves the privacy/utility trade-off compared to conventional and advanced state-of-the-art methods.
