Privacy-Preserving Collaborative Learning through Feature Extraction

The contributions of this paper include:

• •

  Two collaborative learning methods based on feature extraction (SFE, LTFE) are proposed and compared with a baseline method (i.e., CTFE).

• •

  The proposed methods address the computational bottleneck of privacy-preserving collaborative learning using feature extraction.

• •

  The LTFE differs from any existing methods by incorporating an extra feature-concatenation layer that increases the training security and model accuracy (without even sharing any data since each party benefits from the other parties’ embeddings).

• •

  These methods are evaluated on three datasets.

• •

  Challenges, such as highly-unbalanced training data, accelerating training time, and increasing network accuracy are addressed.

• •

  The privacy aspects of these algorithms are evaluated by utilizing an off-the-shelf attack model.

The first scenario is that each party trains the feature extractor and the classifier simultaneously as

where $(x_{vu},y_{vu})$ denote samples from the set

where $v\neq i$, $D_{v}^{{}^{\prime}}\subset D_{v}$, and $N_{other}$ is the size of this $D_{other}$. $D_{v}^{\prime}$ denotes the portion of $D_{v}$ that is contributed by party $v$ for collaborative learning of other parties. We consider CTFE as a baseline scenario for the problem formulation in Sec. 3. In CTFE, the parties exchange the raw data using SMPC.

In this method, the parties come to an agreement to use a set of data available to all parties called $D_{shared}$ to find a general feature extractor as

where $(x_{shj},y_{shj})$ is the $j^{th}$ sample in $D_{shared}$, $N_{sh}$ is the size of $D_{shared}$, and the feature extractor of $g_{sh}^{*}$ (i.e., $f_{sh}^{*}$) is considered as the global feature extractor available to all the parties. It should be noted that such an agreement is common in collaborative learning settings [59, 60]. Each party can choose what kind of data they want to share. While the utility of cooperative learning is most useful when the data from other parties is different from its own data distribution, parties can choose to hide data they consider critical from other parties. In this context, it is to be noted that in many applications, anomalous data is less confidential since they are non-legitimate data introduced by an adversary. Then, the parties train their classifiers cooperatively by exchanging feature embeddings (using SMPC) as

where $H$ is the set of candidate classifiers, $t_{ij}=f_{sh}^{*}(x_{ij})$, and $t_{vu}=f_{sh}^{*}(x_{vu})$ where $(x_{vu},y_{vu})$ is as in (3).

In this method, unlike in SFE where the global feature extractor is shared and trained using data available to all parties, each party trains their own feature extractor using their data as

where the feature extractor of $g_{i}^{*}$ (i.e., $f_{i}^{*}$) is considered as the $i^{th}$ party’s feature extractor. Since the feature extractors in LTFE are separately trained, the feature embeddings from different parties’ feature extractors are not directly compatible/aligned between the parties. Hence, to be able to leverage the knowledge built into other parties’ feature extractors, the feature embeddings computed by the parties’ feature extractors are concatenated (as shown in Fig. 1) and the overall concatenated feature vector forms the input to the classifier in LTFE. For example, consider party 1’s first data sample (i.e., $x_{11}$). The sample will be passed to each feature extractor to get the corresponding feature embeddings (i.e., $fe_{1}=f_{1}^{*}(x_{11})$ and $fe_{2}=f_{2}^{*}(x_{11})$). Then these feature embeddings are concatenated to form a vector $w_{11}=[fe_{1};fe_{2}]$. Therefore, the parties make an agreement to design their classifier which has the input size of $2\times q$ and each party trains their own classifier as

where $w_{ij}=[f_{1}^{*}(x_{ij}),f_{2}^{*}(x_{ij})]$ is a concatenation of feature embeddings from each party’s feature extractor (considering 2 parties for simplicity), and $w_{vu}=[f_{1}^{*}(x_{vu}),f_{2}^{*}(x_{vu})]$ where $(x_{vu},y_{vu})$ is as in (3). The parties exchange the concatenation of feature embeddings using SMPC.

In this paper, neural networks are considered as candidate functions. The best candidate could be found by minimizing the empirical risk on the data as

where ${\theta}_{i}$ is the vector of the neural network parameters (weights) corresponding to the $i^{th}$ party. For this purpose, we use Stochastic Gradient Descent (SGD). In Algorithms 1, 2, and 3, the detailed procedure of CTFE, SFE, and LTFE are described, respectively. In all the algorithms, the weights’ update of the models using the SGD is represented by functionality $GU$. The number of batches and the number of epochs are represented by $n_{batches}$, and $n_{epochs}$, respectively. In Algorithm 1, the $CTFE\_MAIN$ is the main procedure in which each party trains its model ($M_{i}$ corresponds to $i^{th}$ party’s model) using its own data in non-secure mode and then continues training on the data from other parties in secure mode. In Algorithm 2, in the main procedure ($SFE\_MAIN$), a general feature extractor ($M_{s}$) is trained using the shared data ($D_{s}$) available to all the parties. Then each party passes its own data through this feature extractor to find the feature embeddings ($F_{own}$ corresponds to the $i^{th}$ party feature embeddings, and $F_{other}$ shared by all other parties). Then each party trains its classifier using its own features and then continues training collaboratively the classifier ($M_{i}$ corresponds to $i^{th}$ party’s classifier) using the feature embeddings from other parties in secure mode. In Algorithm 3, $LTFE\_MAIN$ is the main procedure. The parties first train their feature extractors ($N_{i}$ corresponds to the $i^{th}$ party feature extractor) on their local data. Then each party trains its classifier ($M_{i}$ corresponds to $i^{th}$ party model) on a concatenation of secure features from all the parties’ feature extractors. This has been shown by the $Concatenate$ function that concatenates feature vectors from all parties horizontally for each sample. While the $Append$ function concatenates these vectors vertically. It should be noted that in all these algorithms, $\Pi$ denotes the implementation using SMPC, i.e., replacing $\Pi^{f}$ with $f$ throughout yields the non-secure (i.e., plain-text) implementations.

The proposed scenarios have different computational complexities. To have a fair comparison between them, we assume the feature extractors have the same architecture with 4 dense layers (including the input layer) and classifiers as well with 1 dense layer. Assume corresponding weights for each layer are as follows: $W_{n_{1}Q}$, $W_{n_{2}n_{1}}$, $W_{qn_{2}}$, and $W_{Kq}$ where $n_{i}:i=1,2$ are the number of nodes in the first two layers after input layer in feature extractor. We train the model for $n$ epochs and we assume each party shares $t$ training samples. The time complexity of training such a neural network for each party is $\mathcal{O}(npt\times(Qn_{1}+n_{1}n_{2}+n_{2}q+qK))$. In CTFE, each party trains the feature extractor and classifier together, therefore, the time complexity is of an order of $\mathcal{O}(npt\times(Qn_{1}+n_{1}n_{2}+n_{2}q+qK))$. Training the model in SFE for each party is of an order of $\mathcal{O}(npt\times(qK))$ since the feature extractor is fixed during the classifier training. In LTFE, all the parties train their feature extractor simultaneously, however, for training the classifier, each party concatenates the feature embeddings from all the parties which makes the input to the classifiers higher in dimension (i.e., $pK$). Therefore, it is of order of $\mathcal{O}(npt\times(Qn_{1}+n_{1}n_{2}+n_{2}q+qpK)+npt\times(pqK))=\mathcal{O}(npt\times(Qn_{1}+n_{1}n_{2}+n_{2}q+(p+1)qK)$. Therefore, SFE has a lower computational burden compared to LTFE and CTFE. When the feature extractor is relatively simple (e.g., a few fully connected layers), LTFE is more computationally expensive than CTFE. For the case when the feature extractor has CNN layers, CTFE can be more computationally expensive than LTFE.

LTFE has the highest performance (accuracy) under no or very little data sharing among the parties since during inference, each party benefits from the use of other parties’ feature extractors. CTFE has the next higher performance and the last is SFE. However, as more data is shared among parties, the SFE approaches CTFE and both tend towards the performance of LTFE (especially if a large percentage of the data is shared). Lastly, the LTFE provides the highest level of privacy followed by SFE and last is the CTFE. The SFE has the lowest computational burden. LTFE is computationally more expensive than SFE since combining feature embeddings from feature extractors of different parties requires an additional step of concatenation, making the input to the classifiers higher in dimension. In Fig. 2, the trade-off among performance, privacy, and computational speed of the proposed scenarios is shown.

We used three datasets to evaluate the scenarios described in Sec. 5: MNIST and Credit Card Fraud Detection which are off-the-shelf datasets, and a synthetic dataset. Three different datasets are chosen to show the independence of the results from the choice of the dataset.

The MNIST dataset contains images of handwritten digits from 0 to 9. The dataset has 60,000 training samples and 10,000 test samples. The images are grayscale and of size $28\times 28$.

The Credit Card Fraud Detection dataset contains anonymized credit card transactions labeled as fraudulent or genuine. The dataset has 284,807 samples that 492 of which are frauds. It also has 29 features that are obtained with PCA.

The synthetic dataset is generated using the standard sklearn make_classification module ²²2sklearn.datasets.make_classification. The size of the feature vector is $784$, and the number of classes is 10. Then the samples are randomly split between parties. The synthetic dataset has 784 features and 10 classes.

For each dataset, we have split the dataset into 4 parts called global, party 1, party 2, and test data. For the synthetic dataset, each part has 20,000 samples. For the MNIST dataset, we split the 60,000 training samples into 12,600 samples for shared, and 23,700 samples for each party 1 and 2 as shown in Table I. For the test data, we use the 10,000 test samples provided by the dataset. It should be noted that to see the benefit of sharing data between parties, we have split the training data in a way that party 1 has more samples for labels ZERO, ONE, and TWO, while it has fewer samples for labels SEVEN, EIGHT, and NINE. For party 2, it is vice-versa and shared data has more samples for labels THREE, FOUR, and FIVE than the other labels. For the fraud detection dataset, each party has 1,000 normal samples. The fraud samples are distributed as 100 for global data, 50 for party 1, 242 for party 2, and 100 for testing to study the benefit of sharing. The number of epochs is 10 for each of feature extractor training and the classifier training. We set each party to share 30% of their data with other parties using the methods outlined in Sec. 5.

A four-layer fully connected neural network (FCN) is used as the model to classify the pre-processed data. ReLU activation functions are used between each of the layers and for the last layer a semi-sigmoid activation function is used which has the following formula: $ReLU(x)-ReLU(x-1)$ where $x$ is the input vector to the layer. The semi-sigmoid activation function is used instead of sigmoid due to PySyft limitations. A neural network has three main components: the input layer, hidden layers, and classifier layers. The input layer and hidden layers together form the feature extractor. The single output layer functions as the classifier. The pre-processed data is passed through the three-layer feature extractor to generate the feature embeddings in both the SFE and LTFE. The layer sizes are 64, 64, 64, and 10, therefore, the dimension of the feature embeddings is 64. For all the experiments, Mean Squared Error (MSE) is used as the loss function, and SGD [61] is used as the optimizer with a learning rate of 0.1, and an $L2$ regularization with a weight of 0.0002. For the MNIST dataset, we also evaluated the methods on the LeNet-5 [62] architecture in which the dimension of the feature embeddings is 120. However, due to the PySyft limitations, the proposed semi-sigmoid is used as the activation function for all the layers. It should be noted that to be consistent, the input images are zero-padded such that the inputs to the LeNet-5 have the dimension of $32$. The SGD with a learning rate of 0.1 is used for the optimizer.

Each party benefits from the other parties’ data in cooperative learning. The more samples are available from a data distribution, the more information is available for a machine learning algorithm to find the underlying distribution. Therefore, it is expected that feature embedding cooperation between parties has the same effect. To verify this, we have trained and evaluated the model when it has access to 0% to 100% of other party data with a step of 20%. Fig. 3 shows the performance of party 1’s trained model using CTFE, SFE, and LTFE on MNIST data with different percentages of data shared by party 2. The figure shows 4 performance metrics (i.e., accuracy, precision, recall, and F1 score) for samples with a specific label. It is seen that as more data are shared by other parties, the performance of the model increases. It should be noted that since most of the labels are common among all the parties, SEVEN, EIGHT and NINE are chosen in Fig. 3 which have different distributions among parties.

In this work, we use PySyft [51] library which relies on SPDZ protocol [6]. SPDZ enables more complex operations than addition and multiplication, which makes it suitable for training neural networks. Also, we made the following changes to increase training speed and model performance:

• •

  Modifying PySyft internals including modifying message compression settings to trade off computation vs. communication time and replacing multiprocessing-based parallelization (which we found to be a major cause of slowdowns) in SPDZ computations with multithreading (with a tuned optimal number of threads) which is more efficient under larger process memory footprints

• •

  Increasing the precision_fractional variable. A large precision_fractional number allows the modified data to keep more information from the raw data. The original precision_fractional was 3 in PySyft. We changed it to 5.

To quantify the information leakage of the proposed scenarios, we considered an off-the-shelf membership inference attack model as a metric. The purpose of the attack model is to evaluate the algorithms in terms of the source of the data. In other words, a party attempts to identify samples from other parties’ data by analyzing the model output. Without loss of generality, assume we have 2 parties collaborating to train their models using CTFE, SFE, and LTFE, and assume that the attacker is on party 1’s side. For simplicity and to more clearly illustrate the membership inference attack, we consider the scenario where party 1 does not have its own data and only trains its model using all the other party’s data. After the target models are trained, the attacker applies a membership inference attack algorithm. In this paper, we use the attack model described in [3]. However, based on the attacker’s access to the target model, the attack model differs between the scenarios. The attack model for each scenario is depicted in Fig. 4. It could be seen that in CTFE, the attacker has access to the target model weights since the model is trained from input to output on the attacker’s side. Also, in SFE, the attacker has access not only to the classifier but also to the shared model that is available to all parties. However, in LTFE, the attacker has access only to the classifier and does not have access to the other parties’ feature extractors. For all the attack models, we use the same architecture and training procedure proposed in [3].

The performance of party 1’s model using the proposed methods and the Non-Cooperative (NC) case are shown in Tables II, III, IV, and V for MNIST FCN, MNIST LeNet-5, synthetic dataset, and fraud detection cases, respectively. In these tables, the A, P, R, and F1 columns correspond to accuracy, precision, recall, and F1 score, respectively. The NC in these tables corresponds to the case using CTFE where the percentage of sharing is 0% which means the model does not take advantage of other parties’ data and only is trained on the local data. Comparison to the NC indicates improvements in model performance by using other parties’ data. The LTFE has an overall better performance than SFE. This is because LTFE uses concatenated features and therefore can benefit from the use of other parties’ feature extractors, whereas SFE only uses a global feature extractor.

The training time and inference time are shown in Table VI for all the settings. SFE takes the least time since it uses a shared feature extractor, which can be implemented in non-secure mode. Additionally, it can be seen that CTFE is more computationally expensive than SFE since, in CTFE, all of the model’s weights are updated using gradient descent in secure mode while in SFE, only the classifier weights are updated. LTFE could be more computationally expensive than SFE because LTFE involves concatenating features that have to be implemented in secure mode, whereas other methods do not have such a process. The relative training time of CTFE and LTFE is dependent on the network architecture. It could be seen that for the MNIST dataset on the LeNet-5 network, CTFE is more computationally expensive since the feature extractor has CNN layers. However, when fully connected layers are used for the feature extractor, LTFE is more computationally expensive than CTFE.

We evaluated the information leakage of the proposed scenarios in terms of the source of data by the method discussed in Sec. 6.5. Prediction uncertainty is a measure of information leakage [63]. A method with high uncertainty in its prediction reflects the fact that the model leaks less information about the samples. In Fig. 6, membership probabilities for the MNIST dataset are shown for member and non-member samples for the scenarios where label 1 corresponds to the member samples. The member samples probabilities are shown with dark blue and non-member samples with pale blue. In (c), (f), and (i) in Fig. 6, 50% membership probability implies that the model leaks no information since the attacker does not obtain any idea of whether a sample was in the training data or not (i.e., effectively a coin toss). If a model leaks a lot of information, the attack model will output a high membership probability for most training samples and a low membership probability for most non-training samples (i.e., (b), (e), and (h) in Fig. 6). It could be seen that the attack models against LTFE are highly uncertain about the samples’ membership, whereas the attack models against CTFE assign a high probability to training samples and a low probability to non-training samples. The attack models against SFE show a level of uncertainty less than the models against LTFE but greater than the models against CTFE. Additionally, the Receiver Operating Characteristic (ROC) curves of the attack models are plotted in Fig. 5. A larger Area Under the ROC curve (AUC) means that the model leaks more information. We can see that the attack models against LTFE have the smallest AUC, meaning that the attack models have the highest uncertainty and LTFE leaks the least information. The attack models against CTFE have the largest AUC, meaning that the attack models have the lowest uncertainty and CTFE leaks the most information. The amount of information leaked by SFE is between those of LTFE and CTFE. Figs. 5 and 6 are consistent with each other.

The training time for the proposed methods is reported in Table VI for MNIST FCN, MNIST LeNet-5, and synthetic dataset cases. In this table, all the numbers are in minutes. Secure training time, non-secure training time, and the ratio of the secure training time to the non-secure training time are reported in Table VI. It could be seen that for fully connected network architectures, LTFE is the slowest, and SFE is the fastest. However, for LeNet-5 which has a CNN architecture for the feature extractor, the CTFE is the slowest. This observation is consistent with our expectation of the computational cost of the CNN layers with respect to fully connected layers since CNN layers require more mathematical operations. We also empirically observed that the models trained using SFE, CTFE, and LTFE in non-secure mode have comparable accuracy to the models trained in the secure mode. Additionally, since training in non-secure mode sacrifices input data privacy, the training speed in non-secure mode is faster than the speed in the secure mode.

Based on our experimental results (i.e., from Tables II, III, IV, V and VI; Figs. 5 and 6), the comparison of CTFE, SFE, and LTFE with respect to performance, privacy, and training speed is consistent with what we summarized in Fig. 2. Table VII shows the comparison according to our experimental results. For accuracy, LTFE and CTFE have comparable results in most cases. However, we empirically observed that CTFE and SFE are more sensitive to training noise than LTFE. For example, the model weights may be stuck to a local optimum and cannot be further changed during the training process. Therefore, we conclude that LTFE has the overall best performance among the three methods. SFE has the least accuracy. The performance of CTFE is between LTFE’s and SFE’s. As for privacy, Fig. 5 and Fig. 6 show that LTFE leaks the least information, whereas CTFE leaks the most information. SFE has a medium level of privacy. As for the training speed, SFE is the fastest algorithm, whereas LTFE is typically the slowest according to experiments. CTFE is slower than SFE, however, it could be faster than LTFE based on the network architecture. In real-world cases, since each party will have its own machine, the training process can be parallel and therefore may take less time. To apply our algorithms for $n$-party (with $n>2$) scenarios, one possible solution is that each party collaborates with one other party at a time (i.e., pairwise collaborative learning) to train its model. Thus, the n-party case is converted to a general 2-party scenario.

In this section, we highlight the differences between our method and commonly used methods in the literature. In FL [1], there is a model, and each local party updates the weights of the model using its own data, and the nodes send the weights and their gradients to the server. However, in our work, collaborative learning is based on the SMPC approach in which the privacy of the inputs is protected. Also, each party has its own model. In [64], the proposed method sends the extracted features to the cloud instead of the raw data. These extracted features are not encrypted. Moreover, the focus of their work is model inference. However, our method addresses the privacy of the data during training. In [65], the authors proposed privacy-preserving CNN feature extraction on medical images. In their method, the data owner encrypts its data and sends it to the servers. The main difference between our method and their method is that they have assumed that they have the trained parameters of the CNN, while we are training the feature extractor in the secure domain. Also, in their method, they only have one data owner while we are addressing the case where we have two organizations cooperating in the training phase.