CAPE: Context-Aware Private Embeddings for Private Language Learning

CAPE: Context-Aware Private Embeddings for Private Language Learning Richard Plant, Valerio Giuffrida, Dimitra Gkatzia Edinburgh Napier University {r.plant, v.giuffrida, d.gkatzia}@napier.ac.uk Abstract Neural language models have contributed to state-of-the-art results in a number of down- stream applications including sentiment anal- ysis, intent classification and others. However, obtaining text representations or embeddings using these models risks encoding personally identifiable information learned from language and context cues that may lead to privacy leaks. To ameliorate this issue, we propose Context- Aware Private Embeddings (CAPE), a novel approach which combines differential privacy and adversarial learning to preserve privacy during training of embeddings. Specifically, CAPE firstly applies calibrated noise through differential privacy to maintain the privacy of text representations by preserving the encoded semantic links while obscuring sensitive infor- mation. Next, CAPE employs an adversarial training regime that obscures identified private variables. Experimental results demonstrate that our proposed approach is more effective in reducing private information leakage than either single intervention, with approximately a 3% reduction in attacker performance com- pared to the best-performing current method. 1 Introduction Deep learning has provided remarkable advances in language understanding and modelling tasks in recent years (Vaswani et al., 2017; Devlin et al., 2019; Brown et al., 2020). However, this increased utility may harm user privacy, as neural models trained with datasets containing personal identifi- able information can unintentionally leak informa- tion that users may prefer to keep private (Carlini et al., 2019; Song et al., 2017). Even seemingly innocuous collections of metadata (Xu et al., 2008) such as data provided by the users (e.g. at regis- tration time on social media) or data which has been cleansed of identifying attributes (Sun et al., 2012), can provide latent information for the re- identification of participants. Using social media data can also raise ethi- cal considerations (Townsend and Wallace, 2016). Users may have edited or deleted posts that mod- els continue to rely on in existing datasets, and may unintentionally reveal information they would rather keep private (Bartunov et al., 2012; Pontes et al., 2012; Goga et al., 2013). Research has shown practical attacks that exploit trained models to es- tablish whether a particular individual formed part of a model’s training dataset, in an attack known as membership inference (Leino and Fredrikson, 2020; Truex et al., 2019). Personally identifiable attributes such as age, gender, or location can be reliably reconstructed given the output of such a model (Fredrikson et al., 2015; Zhang et al., 2020). Neural representations of input data, including lan- guage embeddings, have proven to be a vulnera- bility for these inferences (Song and Raghunathan, 2020), thus privacy-preserving techniques should be applied to these text representations when they form part of a machine learning pipeline. To minimise the risk of such attacks in uncover- ing sensitive information, previous work has em- ployed an adversarial training objective (Coavoux et al., 2018; Li et al., 2018) by modifying the loss function of the model to impose a penalty when a simulated attacker task, such as predicting a private variable …

Content truncated to 500 words