Loss-based differentiation strategy for privacy preserving of social robots

Abstract

The training and application of machine learning models encounter the leakage of a significant amount of information about their training dataset that can be investigated by inference attack or model inversion in the fields, such as computer vision, social robots. The conventional methods for the privacy preserving exploit to apply differential privacy into the training process, which might bring a negative influence on the convergence or robustness. We first conjecture the necessary steps to carry out a successful membership inference attack in a machine learning setting and then explicitly formulate the defense based on the conjecture. This paper investigates the construction of new training parameters with a Loss-based Differentiation Strategy (LDS) for a new learning model. The main idea of LDS is to partition the training dataset into some folds and sort their training parameters by similarity to enable privacy-accuracy inequality. The LDS-based model leakages less information on MIA than the primitive learning model and makes it impossible for the adversary to generate the representative samples. Finally, extensive simulations are conducted to validate the proposed scheme and the results demonstrate that the LDS can lower the MIA accuracy in terms of most CNNs models.

Appendix A Proof

1.1 A.1 Membership inference advantage

Lemma 2

$Adv^{Sa} \le Adv^{Agg}$

Proof

$$\begin{aligned} \begin{aligned} Adv^{Sa}&= Pr^{Sa}\left( A=1\mid x \in D_{T} \right) - \alpha Pr^{Sa}\left( A=1\mid x \in D_{P} \right) \\&\quad - \beta Pr^{Sa}\left( A=1\mid x \in D_{O} \right) \\&= \underset{x\in D_{T}}{E^{Sa}}\left( 1-\frac{L(\cdot )}{A} \right) -\alpha \underset{x\in D_{P}}{E^{Sa}}\left( 1-\frac{L(\cdot )}{A} \right) \\&\quad - \beta \underset{x\in D_{O}}{E^{Sa}}\left( 1-\frac{L(\cdot )}{A} \right) \\&= \frac{1}{A} \left[ \alpha \cdot \underset{x\in D_{P}}{E^{Sa}}L(\cdot ) + \beta \cdot \underset{x\in D_{O}}{E^{Sa}}L(\cdot ) \right. \left. - \underset{x\in D_{T}}{E^{Sa}} L(\cdot )\right] \\&\le \frac{1}{A} \left[ \alpha \underset{x\in D_{O}}{E^{Sa}}L(\cdot )+\beta \underset{x\in D_{O}}{E^{Sa}}L(\cdot ) \right. \left. - \underset{x\in D_{T}}{E^{Sa}} L(\cdot ) \right] \\&= \frac{1}{A} \left[ \underset{x\in D_{O}}{E^{Sa}} L(\cdot )-\underset{x\in D_{T}}{E^{Sa}} L(\cdot ) \right] \\&\le \frac{1}{A} \left[ \underset{x\in D_{O}}{E^{Sa}} L(\cdot ) -\underset{x\in D_{T}}{E^{Agg}}L(\cdot ) \right] \\&= Adv^{Agg}. \end{aligned} \end{aligned}$$

(A1)

$\square$

where $L(\cdot )$ denotes L((x, y), F).

1.2 A.2 Membership adversary

Lemma 3

$$\begin{aligned} \varepsilon _{eq} = \sigma _{2} \sqrt{\frac{2ln\left( \sigma _{2}/ \sigma _{1} \right) }{\left( \sigma _{2}/ \sigma _{1} \right) ^{2}-1}}. \end{aligned}$$

(A2)

Intersects at two points $\sigma _{1} < \sigma _{2}$.

Proof

Let $f\left( \varepsilon ,\sigma \right)$ be standard normal distribution.

$$\begin{aligned} \begin{aligned} \int _{-x}^{x}f\left( \varepsilon ,\sigma \right) d\varepsilon&= \int _{-x}^{x} \frac{1}{\sqrt{2\pi }\sigma }\cdot e^{-\frac{\varepsilon ^{2}}{2\sigma ^{2}}}d\varepsilon \\&= \frac{1}{\sqrt{\pi }}\cdot \int _{-x}^{x}\frac{1}{\sqrt{2}\sigma }\cdot e^{-\frac{\varepsilon ^{2}}{2\sigma ^{2}}}d\varepsilon \\&= \frac{1}{\sqrt{\pi }}\cdot \int _{-x}^{x} e^{-\frac{\varepsilon ^{2}}{2\sigma ^{2}}}d\left( \frac{\varepsilon }{\sqrt{2}\sigma } \right) \\&=\frac{1}{\sqrt{\pi }}\cdot \int _{-\frac{x}{\sqrt{2}\sigma }}^{\frac{x}{\sqrt{2}\sigma }}e^{-t^{2}}d\left( t \right) \\&= \mathrm{erf}\left( \frac{x}{\sqrt{2}\sigma } \right) . \end{aligned} \end{aligned}$$

(A3)

where $\frac{\varepsilon }{\sqrt{2}\sigma } = t$, when $\varepsilon = x$, $t = \frac{x }{\sqrt{2}\sigma }$.

Hence, we can get:

$$\begin{aligned} \begin{aligned}&\mathrm{erf} \left( \frac{\varepsilon _{eq}^{\mathrm{Agg}}}{\sqrt{2}\sigma _{T}^{F}} \right) - \mathrm{erf}\left( \frac{\varepsilon _{eq}^{\mathrm{Agg}}}{\sqrt{2}\sigma _{N}^{F}} \right) \\&\quad = \mathrm{erf}\left( \frac{\sigma _{N}^{F}}{\sigma _{T}^{F}}\sqrt{\frac{ln\left( \sigma _{N}^{F}/\sigma _{T}^{F} \right) }{\left( \sigma _{N}^{F}/\sigma _{T}^{F} \right) ^{2}-1}} \right) - \mathrm{erf}\left( \sqrt{\frac{ln\left( \sigma _{N}^{F}/\sigma _{T}^{F} \right) }{\left( \sigma _{N}^{F}/\sigma _{T}^{F} \right) ^{2}-1}} \right) \\&\quad = \sigma _{N}^{F} \sqrt{\frac{2ln\left( \sigma _{N}^{F}/\sigma _{T}^{F} \right) }{\left( \sigma _{N}^{F}/\sigma _{T}^{F} \right) ^{2}-1}} \\&\quad =\varepsilon _{eq}^{\mathrm{Agg}}. \end{aligned} \end{aligned}$$

$\square$

Meanwhile: For the sake for simplify, let $ln(\cdot )$ denote $\sqrt{\frac{\ln {\left( \sigma _{O}^{S}/\sigma _{O}^{T} \right) }}{\left( \sigma _{O}^{S}/\sigma _{O}^{T} \right) ^{2}-1}}$.

$$\begin{aligned} \begin{aligned} \mathrm{Adv}^{Sa}&= Pr\left( A=1\mid x \in D_{T} \right) - \alpha Pr\left( A=1\mid x \in D_{P} \right) \\&\quad - \beta Pr\left( A=1\mid x \in D_{O} \right) \\ {}&=Pr (\varepsilon< \varepsilon _{eq}^{Sa}\mid x \in D_{T} ) - \alpha ( \varepsilon< \varepsilon _{eq}^{Sa}\mid x \in D_{P} ) \\&\quad - \beta ( \varepsilon < \varepsilon _{eq}^{Sa}\mid x \in D_{0} ) \\&= \mathrm{erf}\left( \frac{\varepsilon _{eq}^{Sa}}{\sqrt{2}\sigma _{T}^{S}} \right) - \alpha \cdot erf\left( \frac{\varepsilon _{eq}^{Sa}}{\sqrt{2}\sigma _{P}^{S}} \right) \\&- \beta \cdot \mathrm{erf}\left( \frac{\varepsilon _{eq}^{Sa}}{\sqrt{2}\sigma _{O}^{S}} \right) \\&= \mathrm{erf} \left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}}ln(\cdot ) \right) - \alpha \cdot erf\left( \frac{\sigma _{O}^{S}}{\sigma _{P}^{S}}ln(\cdot ) \right) \\&\quad - \beta \cdot \mathrm{erf} \left( ln(\cdot ) \right) . \end{aligned} \end{aligned}$$

The advantage of the two structures is expressed as:

$$\begin{aligned} \mathrm{Adv}^{\mathrm{Agg}} = \mathrm{erf}\left( F_{1}\left( \frac{\sigma _{N}^{F}}{\sigma _{T}^{F}} \right) \right) - \mathrm{erf}\left( F_{2}\left( \frac{\sigma _{N}^{F}}{\sigma _{T}^{F}} \right) \right) \\ \mathrm{Adv}^{Sa} = \mathrm{erf}\left( F_{1}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right) - \left( \alpha \cdot \mathrm{erf}\left( \frac{\sigma _{O}^{S}}{\sigma _{P}^{S}}F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right) \right.&\\ \left. + \beta \cdot \mathrm{erf}\left( F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right) \right) . \end{aligned}$$

Lemma 4

$\frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \le \frac{\sigma _{N}^{F}}{\sigma _{T}^{F}}$

Proof

At the beginning, assuming that $F_{1}$ and $erf \left( x \right)$ increases as x increases, we can get:

$$\begin{aligned} F_{1}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \le F_{2}\left( \frac{\sigma _{N}^{F}}{\sigma _{T}^{F}} \right) . \end{aligned}$$

(A4)

and

$$\begin{aligned} \mathrm{erf}\left( F_{1}\left( \frac{\sigma _{N}^{F}}{\sigma _{T}^{F}} \right) \right) \ge \mathrm{erf}\left( F_{1}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right) . \end{aligned}$$

(A5)

We also get $\mathrm{erf} \left( \frac{\sigma _{O}^{S}}{\sigma _{P}^{S}}F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right) \ge \mathrm{erf}\left( F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right)$ since $\sigma _{P}^{S} \le \sigma _{O}^{S}$.

$\therefore$

$$\begin{aligned} \begin{aligned} \alpha \cdot \mathrm{erf}\left( \frac{\sigma _{O}^{S}}{\sigma _{P}^{S}}F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right) + \beta \cdot \mathrm{erf}\left( F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right)&\\ \ge \mathrm{erf}\left( F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right) . \end{aligned} \end{aligned}$$

(A6)

and

$$\begin{aligned} \sigma _{T}^{S} \ge \sigma _{T}^{F}. \end{aligned}$$

(A7)

Finally,

$$\begin{aligned} \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \le \frac{\sigma _{N}^{F}}{\sigma _{T}^{F}}. \end{aligned}$$

(A8)

$\square$

$\because$ $F_{2}$ increases as x decreases. $\therefore$

$$\begin{aligned} F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \ge F_{2}\left( \frac{\sigma _{N}^{F}}{\sigma _{T}^{F}} \right) . \end{aligned}$$

(A9)

and

$$\begin{aligned} \mathrm{erf}\left( F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right) \ge \mathrm{erf}\left( F_{2}\left( \frac{\sigma _{N}^{F}}{\sigma _{T}^{F}} \right) \right) . \end{aligned}$$

(A10)

$$\begin{aligned} \begin{aligned} \alpha \cdot \mathrm{erf}\left( \frac{\sigma _{O}^{S}}{\sigma _{P}^{S}}F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right) + \beta \cdot \mathrm{erf}\left( F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right)&\\ \ge \mathrm{erf}\left( F_{2}\left( \frac{\sigma _{N}^{F}}{\sigma _{T}^{F}} \right) \right)&\\ - \left[ \alpha \cdot \mathrm{erf}\left( \frac{\sigma _{O}^{S}}{\sigma _{P}^{S}}F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right) + \beta \cdot erf\left( F_{2}\left( \frac{\sigma _{O}^{S}}{\sigma _{T}^{S}} \right) \right) \right]&\\ \le -\mathrm{erf}\left( F_{2}\left( \frac{\sigma _{N}^{F}}{\sigma _{T}^{F}} \right) \right) . \end{aligned} \end{aligned}$$

Hence, we can get $\mathrm{Adv}^{\mathrm{Agg}} > \mathrm{Adv}^{Sa}$.

1.3 A.3 Probability

Lemma 5

$$\begin{aligned} \begin{aligned} \mathrm{Adv}^{Sa} = P\left( \left( x^{*},y \right) \in D_{T} \right) - \underset{{D}'\subseteq D and {D}'\bigcap D_{T} = \emptyset }{\mathrm{max}P\left( \left( x^{*},y \right) \in {D}' \right) }&\\ <0. \end{aligned} \end{aligned}$$

(A11)

Proof

$\because$ $P\left( \left( x^{*},y \right) \in D_{P} \right) < \underset{{D}'\subseteq D and {D}'\bigcap D_{T} = \emptyset }{\mathrm{max}P\left( \left( x^{*},y \right) \in {D}' \right) }$

$\therefore$ $\mathrm{Adv}^{Sa} < P\left( \left( x^{*},y \right) \in D_{T} \right) - P\left( \left( x^{*},y \right) \in D_{P} \right)$

We can get

$$\begin{aligned} \begin{aligned} \mathrm{Adv}^{Sa}&=P ((x^{*}, y) \in D_{T})-\max _{D^{\prime } \subseteq D and D^{\prime } \cap D_{T}=\emptyset }((x^{*}, y) \in D^{\prime }) \\&=P\left( |\varepsilon |> |\varepsilon _{eq}|\right) -P\left( |\varepsilon |< |\varepsilon _{eq}|\right) \\&=2 \int _{ |\varepsilon _{e q}|}^{+\infty } \frac{1}{\sqrt{2 \pi } \sigma } e^{-\frac{\varepsilon ^{2}}{2 \sigma ^{2}}} d \varepsilon -2 \int _{-|\varepsilon _{e q}|}^{0} \frac{1}{\sqrt{2 \pi } \sigma } e^{-\frac{\varepsilon ^{2}}{2 \sigma ^{2}}} d \varepsilon \\&=\frac{2}{\sqrt{\pi }} \int _{|\varepsilon _{e q}|}^{+\infty } e^{-\frac{\kappa ^{2}}{2 \sigma ^{2}}} d\left( \frac{\varepsilon }{\sqrt{2 \pi } \sigma }\right) \\&\quad -\frac{2}{\sqrt{\pi }} \int _{-|\varepsilon _{e q}|}^{0} e^{-\frac{\varepsilon ^{2}}{2 \sigma ^{2}}} d\left( \frac{\varepsilon }{\sqrt{2 \pi } \sigma }\right) , \varepsilon \sim N(0, \sigma ). \end{aligned} \end{aligned}$$

let t = $\frac{\varepsilon \sigma }{\sqrt{2}\sigma }$, when $\varepsilon \rightarrow +\infty$,$t \rightarrow +\infty$, when $\varepsilon \rightarrow 0,\ t \rightarrow 0,\ \varepsilon \rightarrow |\varepsilon _{eq} |,\ t \rightarrow \frac{|\varepsilon _{eq} |}{\sqrt{2}\sigma }$.

$$\begin{aligned} \begin{aligned} \mathrm{Adv}^{Sa}&= \frac{2}{\sqrt{\pi }}\int _{\frac{|\varepsilon _{eq} |}{\sqrt{2}\sigma }}^{+\infty }e^{-t^{2}}dt - \frac{2}{\sqrt{\pi }}\int _{-|\varepsilon _{eq} |}^{0}e^{-t^{2}}dt \\&= \mathrm{erf}c\left( \frac{|\varepsilon _{eq} |}{2\sigma } \right) -\mathrm{erf}\left( \frac{|\varepsilon _{eq} |}{2\sigma } \right) . \end{aligned} \end{aligned}$$

Known $F\left( x \right) = \mathrm{erf}c\left( x \right) -\mathrm{erf}\left( x \right) = 1-2erf\left( x \right)$ $F^{'} = -2\cdot e^{-x^{2}}< 0$ and $F\left( x \right)$ increases as x decreases, and $F\left( 1/2 \right) <0$, we get

$$\begin{aligned} \frac{|\varepsilon _{eq} |}{2\sigma } = \frac{\sigma _{T}^{S}}{\sigma }\sqrt{\frac{ln\left( \sigma _{T}^{S}/\sigma \right) }{\sigma _{T}^{S}/\sigma _{P}^{S}}}\ge \frac{\sigma _{T}^{S}}{\sigma _{P}^{S} }\sqrt{\frac{ln\left( \sigma _{T}^{S}/\sigma _{P}^{S} \right) }{\left( \sigma _{T}^{S}/\sigma _{P}^{S} \right) ^{2}-1}} \end{aligned}$$

$F\left( x \right) = \frac{x^{2}ln\left( x \right) }{x^{2}-1}$, and monotonically increases.

$\lim _{x\rightarrow 1}F\left( x \right) = \lim _{x\rightarrow 1}\frac{x^{2}lnx}{x^{2}-1} = \lim _{x\rightarrow 1}\frac{2xlnx + x}{2x} = 1/2$

$$\begin{aligned} \frac{\sigma _{T}^{S}}{\sigma _{P}^{S} }\sqrt{\frac{ln\left( \sigma _{T}^{S}/\sigma _{P}^{S} \right) }{\left( \sigma _{T}^{S}/\sigma _{P}^{S} \right) ^{2}-1}} \ge \frac{1}{\sqrt{2}}> \frac{1}{2} \end{aligned}$$

$F\left( x \right)$ increases as x decreases $F\left( \frac{1}{\sqrt{x}} \right)< F\left( \frac{1}{2} \right) < 0$

$\therefore$ $\mathrm{erf}c\left( \frac{|\varepsilon _{eq} |}{2\sigma } \right) - \mathrm{erf}\left( \frac{|\varepsilon _{eq} |}{2\sigma } \right) < 0$

$$\begin{aligned} \begin{aligned} \mathrm{Adv}^{Sa}&= P\left( \left( x^{*},y \right) \in D_{T} \right) - \underset{{D}'\subseteq D and {D}'\bigcap D_{T} = \emptyset }{\mathrm{max}P\left( \left( x^{*},y \right) \in {D}' \right) } \\&\le P\left( \left( x^{*},y \right) \in D_{T} \right) -P\left( \left( x^{*},y \right) \in D_{P} \right) \\&= \mathrm{erf}c\left( \frac{|\varepsilon _{eq} |}{2\sigma } \right) - \mathrm{erf}\left( \frac{|\varepsilon _{eq} |}{2\sigma } \right) \\&< \mathrm{erf}c\left( 1/2 \right) - \mathrm{erf}\left( 1/2 \right) < 0.\\ \end{aligned} \end{aligned}$$

$\square$