Hacker News Reader

Comment by formalsystem | Hacker News Reader

So let's say I'm in a regime where I'd like to train something like a language model RNN on a private text dataset. If I train the RNN directly on the data then I'm essentially leaking private data to the output. Do you know of any approaches to generate fake data using GANs, train a language model on that fake data and still get a good classifier that does well on test data while still quantifying how much private data is being leaked?

Related: do GANs work well as a data augmentation technique and can their exact contribution to how much a model could potentially be improved be quantified.

EDIT: Added some clarifications

View on HN

You could train your classifier on a labeled private dataset, use it to classify unlabeled samples from a public dataset, then throw away your original classifier and use its classifications on the public dataset to train a replacement. That new classifier will only leak information that could also have been derived from the public dataset, if it had been labeled.

I can think of two ways that procedure can fail:

1. If some aspects of the private data aren't represented in the public dataset (e.g. codewords in classified documents), the final classifier won't recognize them. On the other hand, I'm not sure whether there's an actual use case for making a classifier public that's required to work on data that can only be obtained from a non-public source.

2. If some aspects of your labels are sensitive (e.g. which political opinions you agree with) then labeling the public dataset retains that information. In that case, you'd likely need to apply techniques similar to those studied for removing racial or gender bias from a model.

You can train rnn on encrypted data

Sure but the output would still leak data. E.g: You give the RNN the phrase "Chase Bank" and it outputs "Sell the stock".

Encrypting the data secures the data loading part but it's not like your model didn't learn anything.

The output would be encrypted of course. You’d decrypt it on your end. Whoever hosts the model can’t know what it learned, without breaking your encryption.

Unless you use fully homomorphic encryption (way too expensive for machine learning), the model can't learn anything without breaking your encryption. So you fixed the leak only at the cost of making the model completely useless.

Source? Unless the encryption actually destroys information I don’t see why it would necessarily make the job harder for the rnn.

If you want to learn the function y = f(x), but present x and y as encrypted data x' and y', the problem becomes finding g such that g(x') = y' = encrypt(y) = encrypt(f(x)) = encrypt(f(decrypt(x'))), so the model doesn't just have to learn f, it also has to solve for the decryption and encryption routines.

You look at this as a human, but for an rnn this would be the same as learning to map x to y where both x and y are in a different language. It wouldn't need to also learn how to translate that language into ours.

There might be encryption schemes which make learning such a "language" harder for an rnn, but it does not necessarily mean these methods are harder to break. So it might be possible to find/design an encryption method which is easy to learn (map x to y), but hard to break. I don't know much about encryption though, so I might be wrong.

If an encryption scheme is easy to learn in the sense that if f is learnable, then so is g, then it is also easy to break.

Proof: You can easily train an RNN to return the n-th letter of its input and ignore everything else. Take that function to be f_n. Then g_n is the function that takes the encrypted input and returns the n-th letter, encrypted. If the encryption scheme is learnable in the above sense, then you can also train an RNN to perform that task. You can use multiple of those RNNs to extract an encryption of each individual letter in the input, which is equivalent to having the input encrypted with a substitution cipher. Substitution ciphers are so easy to break with frequency analysis that people have been doing it by hand for more than a thousand years.

Conversely, if you have a secure encryption scheme, then all statistical regularities in the input should be obfuscated so that they cannot be exploited by an RNN.

Good point. I didn't realize the goal of a good cipher is to remove statistical regularities (i.e. make it indistinguishable from random noise).

Reply on news.ycombinator.com