PEOPL: Characterizing Privately Encoded Open Datasets with Public Labels
Allowing organizations to share their data for training of machine learning
(ML) models without unintended information leakage is an open problem in
practice. A promising technique for this still-open problem is to train models
on the encoded data. Our approach, called Privately Encoded Open Datasets with
Public Labels (PEOPL), uses a certain class of randomly constructed transforms
to encode sensitive data. Organizations publish their randomly encoded data and
associated raw labels for ML training, where training is done without knowledge
of the encoding realization. We investigate several important aspects of this
problem: We introduce information-theoretic scores for privacy and utility,
which quantify the average performance of an unfaithful user (e.g., adversary)
and a faithful user (e.g., model developer) that have access to the published
encoded data. We then theoretically characterize primitives in building
families of encoding schemes that motivate the use of random deep neural
networks. Empirically, we compare the performance of our randomized encoding
scheme and a linear scheme to a suite of computational attacks, and we also
show that our scheme achieves competitive prediction accuracy to raw-sample
baselines. Moreover, we demonstrate that multiple institutions, using
independent random encoders, can collaborate to train improved ML models.