On the Privacy–Utility Trade-Off in Differentially Private Hierarchical Text Classification
Source abstract
Abstract
Hierarchical text classification consists of classifying text documents into a hierarchy of classes and sub-classes. Although Artificial Neural Networks have proved useful to perform this task, unfortunately, they can leak training data information to adversaries due to training data memorization. Using differential privacy during model training can mitigate leakage attacks against trained models, enabling the models to be shared safely at the cost of reduced model accuracy. This work investigates the privacy–utility trade-off in hierarchical text classification with differential privacy guarantees, and it identifies neural network architectures that offer superior trade-offs. To this end, we use a white-box membership inference attack to empirically assess the information leakage of three widely used neural network architectures. We show that large differential privacy parameters already suffice to completely mitigate membership inference attacks, thus resulting only in a moderate decrease in model utility. More specifically, for large datasets with long texts, we observed Transformer-based models to achieve an overall favorable privacy–utility trade-off, while for smaller datasets with shorter texts, convolutional neural networks are preferable.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Privacy-Preserving Technologies in Data · Adversarial Robustness in Machine Learning · Internet Traffic Analysis and Secure E-voting
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
SAP SE, 76131 Karlsruhe, Germany
Karlsruhe Institute of Technology, 76131 Karlsruhe, Germany
Department of Network Engineering, Universitat Politècnica de Catalunya, 08034 Barcelona, Spain
Funding
European Union · “la Caixa” Foundation · Alexander von Humboldt Post-Doctoral Fellowship · Spanish Government
References (55)
Show source-provided references
1. Uncertainty in big data analytics: Survey, opportunities, and challenges10.1186/s40537-019-0206-3 ↗
2. Taylor, C. (2022, April 06). What’s the Big Deal with Unstructured Data? 2013. Wired. Available online: https://www.wired.com/insights/2013/09/whats-the-big-deal-with-unstructured-data/.
3. Mao, Y., Tian, J., Han, J., and Ren, X. (2019, January 3–7). Hierarchical Text Classification with Reinforced Label Assignment. Proceedings of the Conference on Empirical Methods in Natural Language Processing, Hong Kong, China.10.18653/v1/D19-1042 ↗
4. An evaluation of classification models for question topic categorization10.1002/asi.22611 ↗
5. Agrawal, R., Gupta, A., Prabhu, Y., and Varma, M. (2013, January 13–17). Multi-label learning with millions of labels: Recommending advertiser bid phrases for web pages. Proceedings of the International Conference on World Wide Web, Rio de Janeiro, Brazil.10.1145/2488388.2488391 ↗
6. DeepMeSH: Deep semantic representation for improving large-scale MeSH indexing10.1093/bioinformatics/btw294 ↗
7. Shokri, R., Stronati, M., Song, C., and Shmatikov, V. (2017, January 22–26). Membership Inference Attacks against Machine Learning Models. Proceedings of the IEEE Symposium on Security and Privacy, San Jose, CA, USA.10.1109/SP.2017.41 ↗
8. Nasr, M., Shokri, R., and Houmansadr, A. (2019, January 19–23). Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-Box Inference Attacks against Centralized and Federated Learning. Proceedings of the 2019 IEEE Symposium on Security and Privacy, San Francisco, CA, USA.10.1109/SP.2019.00065 ↗
9. Zhang, C., Bengio, S., Hardt, M., Recht, B., and Vinyals, O. (2017, January 24–26). Understanding Deep Learning Requires Rethinking Generalization. Proceedings of the International Conference on Learning Representations, Toulon, France.
10. Carlini, N., Liu, C., Erlingsson, Ú., Kos, J., and Song, D. (2019, January 14–16). The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks. Proceedings of the USENIX Security Symposium, Santa Clara, CA, USA.
11. Dwork, C. (2006, January 10–14). Differential Privacy. Proceedings of the International Colloquium on Automata, Languages and Programming, Venice, Italy.10.1007/11787006_1 ↗
12. Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., and Zhang, L. (2016, January 24–28). Deep Learning with Differential Privacy. Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria.10.1145/2976749.2978318 ↗
13. Hayes, J., Melis, L., Danezis, G., and De Cristofaro, E. (2019). LOGAN: Membership Inference Attacks Against Generative Models. Proceedings on Privacy Enhancing Technologies, De Gruyter.10.2478/popets-2019-0008 ↗
14. Bagdasaryan, E., Poursaeed, O., and Shmatikov, V. (2019, January 8–14). Differential Privacy Has Disparate Impact on Model Accuracy. Proceedings of the Advances in Neural Information Processing Systems 32 (NeurIPS 2019), Vancouver, BC, Canada.
15. Membership Inference Attack against Differentially Private Deep Learning Model
16. Jayaraman, B., and Evans, D. (2019, January 14–16). Evaluating Differentially Private Machine Learning in Practice. Proceedings of the USENIX Security Symposium, Santa Clara, CA, USA.
17. Bernau, D., Grassal, P.W., Robl, J., and Kerschbaum, F. (2020). Assessing Differentially Private Deep Learning with Membership Inference. arXiv.
18. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, L., and Polosukhin, I. (2017, January 4–9). Attention is All You Need. Proceedings of the International Conference on Neural Information Processing Systems, Long Beach, CA, USA.
19. Dwork, C., and Roth, A. (2014). The Algorithmic Foundations of Differential Privacy. Foundations and Trends in Theoretical Computer Science, Now Publishers.10.1561/9781601988195 ↗
20. Mironov, I. (2017, January 21–25). Renyi Differential Privacy. Proceedings of the Computer Security Foundations Symposium, Santa Barbara, CA, USA.10.1109/CSF.2017.11 ↗
21. van Erven, T., and Harremoës, P. (2010, January 13–18). Rényi Divergence and Majorization. Proceedings of the Symposium on Information Theory, Austin, TX, USA.10.1109/ISIT.2010.5513784 ↗
22. Manning, C., and Schütze, H. (1999). Foundations of Statistical Natural Language Processing, MIT Press. Chapter 16: Text Categorization.
23. Murphy, G. (2004). The Big Book of Concepts, MIT Press.
24. Goyal, P., Pandey, S., and Jain, K. (2018). Deep Learning for Natural Language Processing, Apress.10.1007/978-1-4842-3685-7 ↗
25. Mikolov, T., Chen, K., Corrado, G., and Dean, J. (2013, January 2–4). Efficient Estimation of Word Representations in Vector Space. Proceedings of the International Conference on Learning Representations, Scottsdale, AZ, USA.
26. Pennington, J., Socher, R., and Manning, C. (2014, January 25–29). Glove: Global Vectors for Word Representation. Proceedings of the Conference on Empirical Methods in Natural Language Processing, Doha, Qatar.10.3115/v1/D14-1162 ↗
27. An Analysis of Hierarchical Text Classification Using Word Embeddings10.1016/j.ins.2018.09.001 ↗
28. Vu, X.S., Tran, S.N., and Jiang, L. (2019, January 9). dpUGC: Learn Differentially Private Representation for User Generated Contents. Proceedings of the International Conference on Computational Linguistics and Intelligent Text Processing, La Rochelle, France.
29. Fernandes, N., Dras, M., and McIver, A. (2019, January 6–11). Generalised Differential Privacy for Text Document Processing. Proceedings of the Confernece on Principles of Security and Trust, Prague, Czech Republic.10.1007/978-3-030-17138-4_6 ↗
30. Weggenmann, B., and Kerschbaum, F. (2018, January 8–12). SynTF: Synthetic and Differentially Private Term Frequency Vectors for Privacy-Preserving Text Mining. Proceedings of the International ACM SIGIR Conference on Research and Development in Information Retrieval, Ann Arbor, MI, USA.10.1145/3209978.3210008 ↗
31. Misra, V. (2019, January 6). Black Box Attacks on Transformer Language Models. Proceedings of the Debugging Machine Learning Models, Workshop during the International Conference on Learning Representations, New Orleans, LA, USA.
32. Yeom, S., Giacomelli, I., Fredrikson, M., and Jha, S. (2018, January 9–12). Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting. Proceedings of the Computer Security Foundations Symposium, Oxford, UK.10.1109/CSF.2018.00027 ↗
33. Humphries, T., Rafuse, M., Tulloch, L., Oya, S., Goldberg, I., and Kerschbaum, F. (2020). Differentially Private Learning Does Not Bound Membership Inference. arXiv.
34. Babbar, R., Partalas, I., Gaussier, E., and Amini, M.R. (2013, January 5–10). On Flat versus Hierarchical Classification in Large-Scale Taxonomies. Proceedings of the Advances in Neural Information Processing Systems 26 (NIPS 2013), Lake Tahoe, NV, USA.
35. Joulin, A., Grave, E., Bojanowski, P., and Mikolov, T. (2017, January 3–7). Bag of Tricks for Efficient Text Classification. Proceedings of the Conference of the European Chapter of the Association for Computational Linguistics, Valencia, Spain.10.18653/v1/E17-2068 ↗
36. Kowsari, K., Jafari Meimandi, K., Heidarysafa, M., Mendu, S., Barnes, L., and Brown, D. (2019). Text Classification Algorithms: A Survey. Information, 10.10.3390/info10040150 ↗
37. Kalchbrenner, N., Grefenstette, E., and Blunsom, P. (2014, January 23–25). A Convolutional Neural Network for Modelling Sentences. Proceedings of the Annual Meeting of the Association for Computational Linguistics, Baltimore, MD, USA.10.3115/v1/P14-1062 ↗
38. Natural language processing (almost) from scratch
39. Kim, Y. (2014, January 25–29). Convolutional Neural Networks for Sentence Classification. Proceedings of the Conference on Empirical Methods in Natural Language Processing, Doha, Qatar.10.3115/v1/D14-1181 ↗
40. Devlin, J., Chang, M.W., Lee, K., and Toutanova, K. (2019, January 2–7). BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. Proceedings of the Conference of the North American Chapter of the Association for Computational Linguistics, Minnesota, MI, USA.
41. Wolf, T., Debut, L., Sanh, V., Chaumond, J., and Delangue, C. (2019). HuggingFace’s Transformers: State-of-the-Art Natural Language Processing. arXiv.10.18653/v1/2020.emnlp-demos.6 ↗
42. A Survey of Hierarchical Classification across Different Application Domains10.1007/s10618-010-0175-9 ↗
43. Evaluation Measures for Hierarchical Classification: A Unified View and Novel Approaches10.1007/s10618-014-0382-x ↗
44. Lee, J., and Clifton, C. (2012, January 12–16). Differential Identifiability. Proceedings of the International Conference on Knowledge Discovery and Data Mining, Beijing, China.10.1145/2339530.2339695 ↗
45. Quantifying identifiability to choose and audit epsilon in differentially private deep learning10.14778/3484224.3484231 ↗
46. An introduction to ROC analysis10.1016/j.patrec.2005.10.010 ↗
47. Nissim, K., Raskhodnikova, S., and Smith, A. (2007, January 11–13). Smooth Sensitivity and Sampling in Private Data Analysis. Proceedings of the Symposium on Theory of Computing, San Diego, CA, USA.10.1145/1250790.1250803 ↗
48. RCV1: A New Benchmark Collection for Text Categorization Research
49. DBpedia—A Large-Scale, Multilingual Knowledge Base Extracted from Wikipedia10.3233/SW-140134 ↗
50. Yang, Z., Dai, Z., Yang, Y., Carbonell, J., Salakhutdinov, R., and Le, Q.V. (2019, January 8–14). XLNet: Generalized Autoregressive Pretraining for Language Understanding. Proceedings of the Advances in Neural Information Processing Systems 32 (NeurIPS 2019), Vancouver, BC, Canada.
51. Minaee, S., Kalchbrenner, N., Cambria, E., Nikzad, N., Chenaghlu, M., and Gao, J. (2020). Deep Learning Based Text Classification: A Comprehensive Review. arXiv.10.1145/3439726 ↗
52. McMahan, H.B., Andrew, G., Erlingsson, U., Chien, S., Mironov, I., Papernot, N., and Kairouz, P. (2018, January 2–8). A General Approach to Adding Differential Privacy to Iterative Training Procedures. Proceedings of the Privacy Preserving Machine Learning, Workshop during the Conference on Neural Information Processing Systems, Montréal, QC, Canada.
53. Ezen-Can, A. (2020). A Comparison of LSTM and BERT for Small Corpus. arXiv.
54. Neal, B., Mittal, S., Baratin, A., Tantia, V., Scicluna, M., Lacoste-Julien, S., and Mitliagkas, I. (2019). A Modern Take on the Bias-Variance Tradeoff in Neural Networks. arXiv.
55. Papernot, N., Thakurta, A., Song, S., Chien, S., and Erlingsson, Ú. (2020). Tempered Sigmoid Activations for Deep Learning with Differential Privacy. arXiv.10.1609/aaai.v35i10.17123 ↗