Method to obtain statistical information on data while protecting privacy

Abstract

It is disclosed a method to obtain statistical information on an original dataset A, wherein statistical information on the original dataset A might be obtained by querying the original dataset A but wherein said queries from the original dataset A have to be avoided as a measure for protection of privacy of individual data of the original dataset A. The method including the steps of: a) providing the original dataset A, b) providing a parameter representative of a loss of privacy, c) learning a differentially private (DP) sum product network (SPN) taking in input the original dataset A and the parameter representative of the loss of privacy, d) using the differentially private sum product network (DPSPN) to obtain statistical information on the original dataset A without querying the original dataset A.

Description

[0001] Title: Method to obtain statistical information on data while protecting privacy

[0002] Filed of invention

[0003] It is known that querying a dataset of original data collected from users is becoming more and more important for different applications that might take advantage from statistical information on the original dataset, to cite one example, medical applications based on Artificial Intelligence. At the same time, it is well known that such possibility of querying the original data must be carefully limited for privacy protection, especially when the original dataset includes sensitive data, still to cite only one example, medical information.

[0004] Differential privacy (DP) is a system for publicly sharing information about the original dataset while withholding information about individuals in the dataset, and therefore protecting privacy. This is generally accomplished by modifying the original data, and in particular by methodically adding noise to its records. Eventually querying the noisy dataset thus obtained, yields result that no longer disclose individual information of records in the original dataset, while maintaining its general informative content. This allows the results to be fruitfully shared publicly without any privacy concerns.

[0005] In order to reduce predictability of individual data, Differential Privacy usually limits the number of queries that generate information to be publicly shared. Indeed, an attack is generally ineffective if it is not sufficiently reiterated. However, by doing so, also the usability of the published information is limited.

[0006] Moreover, in the era of big data, where vast amounts of personal data are collected and analyzed for various purposes, models are learned from data (i.e. the original dataset) and subsequently shared to indirectly provide statistical information on the original dataset. In other words, it is not necessarily the original dataset to be queried but rather the model. Therefore, Differential Privacy has to be implemented into the model in order to protect the original data. In this context, Bayesian Networks (BNs) and Generative Adversarial Networks (GANs) have been engineered to generate a Differentially Private (BNs or GANs) model starting from the original dataset. Once the model is generated, statistical information on the original dataset is retrieved by querying the model, and not by querying the original dataset.

[0007] These approaches however useful, suffer from some limitations. GANs, or neural networks more in general, typically require many queries to the original dataset to be learned. To counterbalance this "intrusion" in the original data, one is forced then to increase the amount of noise to be added to it. On the side of BNs, instead, they are by nature not too well suited to represent certain types of variables of the original dataset, such as continuous variables. Therefore, their complexity and latency further increase due to introduction in the learning and inference phases of methods for handling said types of variables, for instance adoption of methods for variables discretization or nodes derived from Gaussian mixture models, which are heterogeneous with respect to BNs models.

[0008] The technical problem at the basis of the present invention is how to obtain statistical information from an original dataset while protecting privacy on such dataset, at the same time reducing the number of queries to it, and consequently the computational time required for learning a model from the original dataset and / or computational time for making inference, and substantially overcoming the drawbacks that currently affect the prior art methods.

[0009] Summary of the invention

[0010] The idea at the basis of the present invention is to provide a method suitable to obtain statistical information on an original dataset while protecting privacy, wherein the method supports representation of different types of variables of the original dataset in a more efficient way than BNs or GANs, and is suitable to learn a model from the original dataset and make inference therefrom more efficiently.

[0011] Based on this idea of solution, the technical problem mentioned above is solved by the method according to claim 1.

[0012] Preferred embodiments of the method of the present invention are given in the dependent claims 2- 15.

[0013] The main features of the method are summarized as follows.

[0014] Statistical information on an original dataset A has to be retrieved. Such information might be obtained by querying the original dataset A but the queries therefrom have also to be avoided as a measure for protection of privacy.

[0015] Therefore, the method provides the steps of: a) taking the original dataset A, b) taking a parameter representative of a loss of privacy, c) learning a differentially private sum product network (DPSPN) taking in input the original dataset A and the parameter representative of the loss of privacy, d) and using the DPSPN to obtain statistical information on the original dataset A without querying the original dataset A.

[0016] The DPSPN is a sum product network (SPN) wherein statistical noise is introduced in the process of learning it. The degree of statistical noise is set based on a value of the parameter representative of the loss of privacy. With respect to a traditional SPN, i.e., a machine learning model that does not introduce statistical noise in the data, the DPSPN differs in that it makes arbitrarily unlikely (through the loss of privacy parameter) to retrieve information on individual data of the original dataset, i.e., a training set.

[0017] Advantageously, the step of obtaining statistical information on the original dataset A (by means of the DPSPN) may be repeated without limits and without loss of privacy of individual data in the original dataset A. Moreover, the DPSPN is suitable to represent different types of variables of the original dataset, such as continuous and categorical variables, and does not require complex adaptations like in BNs. And finally, the complexity and latency in the learning and inference phases is much lighter than competing approaches (like BNs and GANs). The above-mentioned step c) of learning the DPSPN includes processing a statistical methodology on the original dataset A. This methodology is used for instance to partition the original dataset A and learning from data partitioned nodes of the differentially private SPN. For instance, the statistical methodology includes at least one of the following:

[0018] -hypothesis testing and clustering,

[0019] -score based methodology,

[0020] -likelihood based methodology,

[0021] -frequentist or Bayesian methodology,

[0022] -parametric methodology,

[0023] -non parametric methodology.

[0024] In particular, the step c) of learning the DPSPN includes a plurality of iterations.

[0025] A first iteration takes in input the entire original dataset A, splits (partitions) the input into a plurality of subsets of data, and computes one node of the DPSPN through said subsets of data of the original dataset A. This node is a root of the model. The DPSPN is indeed a graphical statistical model.

[0026] A plurality of intermediate iterations is also processed. Each of the iterations takes in input one subset of data returned by the first iteration on by another intermediate iteration, splits (partitions) the input into a plurality of subsets of data and computes another node of the DPSPN. The node resulting from the intermediate iteration is a sum node or a product node or a leaf node.

[0027] A leaf node may be a statistical distribution, suitable for handling a continuous or categorical variable.

[0028] However, the leaf node may be (also) a kernel, for handling more complex data, such as videos or images or sounds.

[0029] At one or more of said plurality of iterations, the statistical noise is introduced. In one embodiment, the statistical noise is introduced at any iteration. The statistical noise depends on the parameter representative of the loss of privacy. The lower is the value of the parameter, the greater is the statistical noise introduced. The noise therefore may be introduced at the step of determining one or more nodes among the sum nodes, the product nodes or the leaf nodes, or also at each node determination.

[0030] For instance, at the plurality of iterations computing a sum node, a statistical non-parametric clustering methodology may be used, such as a kernel k-means. The non-parametric clustering methodology takes the subsets of the input as clusters and measure distance values between rows of the subsets and centers of the clusters. In one embodiment, the statistical noise is introduced in the step of measuring the distance values.

[0031] In a similar way, at the plurality of iterations computing a product node, a statistical non-parametric hypothesis testing for independence methodology may be used, for instance a kernel-based independence test. The non-parametric hypothesis testing for independence methodology takes all the couples of columns from the subsets of the input and, for each couple: a) computes a predetermined statistic; b) compares the result of the predetermined statistic with a data- dependent threshold and c) determine dependence or independence of the columns (the columns are variables of the input).

[0032] The statistical noise is introduced in the predetermined statistic and / or in the threshold (computation). Also in this case, the statistical noise depends on the parameter representative of the loss of privacy.

[0033] In a similar way, at the plurality of iterations computing a leaf node, statistical noise is introduced in a step of learning the statistical distribution of the leaf node from data in the subset of data.

[0034] Examples are given in the detailed description.

[0035] Accordingly, the DPSPN is reliable in protecting data of the original dataset A. The DPSPN does not include any data of the original dataset A but it is a statistical model from which information on the original dataset A may be indirectly retrieved. Moreover, the statistical model constituted by the DPSPN is de-coupled from the original dataset A since the statistical methodology used in determining the model, i.e., in determining the nodes of the model, is affected by noise. This means that, also in case hackers are aware or may retrieve information on the statistical methodology used in determining the model by learning from data, they have no way to attempt retrieving data because of the noise that has been introduced into the statistical methodology.

[0036] According to different embodiment, the step d) (i.e. “using the DPSPN to obtain statistical information on the original dataset A without querying the original dataset A”) may be carried in different ways.

[0037] In particular, in one embodiment, the step d) of using the DPSPN includes

[0038] -running the DPSPN to generate a synthetic private dataset B, and

[0039] -querying the synthetic private dataset B,

[0040] The synthetic private dataset B is a dataset created by querying the DPSPN. Values of the synthetic private dataset B are different than those of the original dataset A. However, statistical properties are kept.

[0041] Querying the synthetic private dataset B provides statistical information on the synthetic private dataset B and the statistical information on the synthetic private dataset B are substantially equivalent to the statistical information on the original dataset A, i.e., the information which would have been obtained if the original dataset A was queried. Individual data of the dataset B provide no information on individual data of the original dataset A, so as privacy protection on individual data of the dataset A is safeguarded.

[0042] “Substantially equivalent” means that the statistical information retrieved from the synthetic private dataset B for the intended application purpose (such as developing a medical application) are so similar to the information which would have been obtained from the original dataset A that can be used in replacement thereof. In another embodiment, the step d) of using the DPSPN includes

[0043] -executing a statistical query directly from the DPSPN by means of an application program interface (API), wherein the statistical query provides statistical information corresponding to the statistical information on the original dataset A, i.e., the information which would have been obtained if the original dataset A was queried.

[0044] Further details of the method according to the present invention will be apparent from an example given in the detail description, for instance: the step a) of providing the original dataset A further includes specifying -one or more variables (for instance age, income, health insurance, ...) among the variables of the original dataset A for which statistical information have to be obtained,

[0045] -a type (real, discrete, ...) for each one of said one or more variables and

[0046] -a domain for each one of said one or more variables.

[0047] The step of running the DPSPN may generate the synthetic private dataset B including only variables for which statistical information have to be obtained.

[0048] Advantageously, according to the method of the invention, the type of the variables includes a categorical (discrete) type or a continuous (real) type, and these types of variables are handled without introducing complexity. Advantageously, the synthetic private dataset B may include variables of mixed types, wherein some of the variables have a categorical (discrete) type and other of the variables have continuous type.

[0049] The loss of privacy is a scalar value. The higher is the value of the loss of privacy, the lower is the difference between the values of variables stored in the original dataset A and values of variables stored in the synthetic private dataset B. Further embodiments of the method according to the present invention is provided in the following description, given with reference to the enclosed figures only for exemplificative and non-limiting purpose.

[0050] Brief description of the drawings

[0051] Fig. 1 is a schematic representation of iterations for learning the DPSPN according to the method of the present invention.

[0052] Fig. 2 is a schematic representation of a step of the method according to the present invention, wherein a sum node of the DPSPN is generated.

[0053] Fig. 3 is a schematic representation of a step of the method according to the present invention, wherein product nodes of the DPSPN are generated.

[0054] Fig. 4 is a schematic representation of a step of the method according to the present invention, wherein leaf nodes of the DPSPN are generated.

[0055] Detailed description of the invention

[0056] In Fig. 1 an original dataset A, or training set A, is taken in consideration to learn a DPSPN, according to an example of the present invention.

[0057] In Fig. la instructions of an algorithm to learn the DPSPN are reported in a pseudo language.

[0058] The original dataset A includes a plurality of variables V on columns, and a plurality of instance T of said variables on rows.

[0059] The algorithm is recursive, i.e., it includes a plurality of iterations.

[0060] The scope of the algorithm is to learn the DPSPN based on the original dataset A, i.e. based on T and V.

[0061] At each iteration of the algorithm, a partition of the variables into subsets of variables Vj is determined or a partition of the instances into subsets of instances Ti is determined.

[0062] The partition of the variables establishes approximate independence between variables belonging to the subsets Vj of variables.

[0063] The partition of the instances group similar instances into subsets of instances Ti.

[0064] The step of partitioning is also referred in the following description as "splitting” or “split”.

[0065] When the partition of the variables is determined, a product node of the network is also generated.

[0066] When the partition of the instances is determined, a sum node is also generated. A weight is associated to each edge of the sum node, based on the number of instances grouped in each subset of instances Ti.

[0067] The process is reiterated, meaning that a DPSPN based on the subsets Vj, Ti is learned.

[0068] When the number of variables to learn in a subset of variable Vj is equal to one, no further partition is processed but the statistical distribution of the variable is determined, based on the values of instances of the subset Ti. This statistical distribution is a leaf node of the DPSPN.

[0069] According to the present invention, the algorithm to process the DPSPN (T, V) receives in input, further than the entire dataset A, a loss of privacy parameter.

[0070] This parameter is representative of a degree of statistical noise to attribute to the steps of partitioning variables, partitioning instances or determining the statistical distribution of the variables.

[0071] These steps are based on statistical methodologies, such as those cited in the summary.

[0072] It is the statistical methodology that is changed based on the parameter representing the loss of privacy.

[0073] A more detailed example is given with reference to Figures 2-4, data of Table 1 below, and with reference to a frequentist learning approach, nonparametric hypothesis testing and nonparametric clustering methodology (but the invention is not limited to this methodology).

[0074] Table 1 - the original dataset A

[0075] Some variables, types of variables, domains of the variables and values are indicated but any other variable, type, domain or application may be taken into account. The original dataset A includes values bi of blood pressures of patients (diastolic, systolic). The patients are affected by a certain Di disease. Values bi are of a type continuous (real) and disease Di is of a type discrete in a domain including a predetermined number of diseases previously classified. Time h is the measurement interval and is of type real.

[0076] Since the blood pressure bi is a real value, in probability theory, it may be associated to a continuous probability distribution, which is a distribution having a density function. Intuitively, the blood pressure is a continuous variable that can take a continuous set of values, as opposed to discrete distributions (such as the disease Di), for which the set of possible values has countable cardinality. Furthermore, while for a discrete distribution an event with zero probability is infeasible, this is not true for a continuous random variable. For example, when measuring the pressure, it is possible to obtain the result 83, 1 mmHg, but this has zero probability since there are infinitely many possible values between 83,0 mmHg and 83,2 mmHg. Each of these has zero probability but the probability that the pressure is between 83,0 mmHg and 83,2 mmHg is nonzero. This apparent paradox is caused by the fact that the probability that the continuous variable bt takes on values in an infinite set, such as a range, cannot be calculated simply by adding the probabilities of the individual values.

[0077] The variables may be predefined by the user through a dictionary of distributions. The weighted sums and the products of the variables are the root or intermediate nodes of the DPSPN. The weighted sums can be interpreted as mixtures / clusters, whereas the products as independence statements. This weighted sum of products must obey to structural constraints, such as decomposability and completeness.

[0078] The DPSPN is decomposable when each product node has children nodes with disjoint scopes. The scope of the node is the set of variables that appear in the sub-DPSPN rooted at the node. The DPSPN is complete when each sum node has children nodes with identical scopes. A DPSPN is valid if it is decomposable and complete. This guarantees that queries to the DPSPN, such as the computation of marginal and conditional probabilities, are computed efficiently.

[0079] The algorithm to learn the DPSPN from the original dataset A takes as input, for each variable (or subset of variables) in the original dataset A, a list of valid (parametric or non-parametric) distributions.

[0080] Therefore, the input to the algorithm is: i) the parameter representing the loss of privacy, ii) the entire original dataset A and, iii) for each variable in the original dataset A, a list of valid distributions.

[0081] The list of distribution iii) may be:

[0082] -Multivariate Gaussian Distribution, for Blood Pressure (systolic), Blood Pressure (diastolic);

[0083] -Gaussian distribution, for Time;

[0084] -Categorical distribution, for Disease. For each variable (or subset of variables) in the original dataset A, the algorithm returns as output either

[0085] -a DPSPN (for frequentist learning) or

[0086] -a distribution over DPSPNs (for Bayesian learning).

[0087] The amount of statistical noise added during learning depends on the DPSPN learning algorithm that is used to learn, for example whether based on hypothesis testing or score based, or likelihood based, frequentist or Bayesian, parametric or nonparametric.

[0088] Few iterations on the dataset in Table 1 may be, for instance:

[0089] Iteration 1 : the algorithm splits (partitions) the rows of the original dataset into two clusters using a nonparametric clustering method, such as kernel k-means. Kernel k-means uses a kernel to measure the distance between the rows in the original dataset A and the cluster centers. Advantageously, this kernel methods allows to cluster mixed- type variables, for instance continuous and categorical variables. The algorithm to learn the DPSPN ensures differential privacy by adding statistical noise to the computed distance values. The noise scale is determined by the privacy parameter (for example, epsilon= 10), which guarantees the desired privacy level. The output of iteration 1 are two subsets of the original dataset, such as for instance those reported in Tables 2a and 2b. This partitioning is different than that obtainable in absence of statistical noise.

[0090] Table 2a - 1stsubset T1 of the original dataset A

[0091] Table 2a - 2ndsubset T2 of the original dataset A

[0092] The algorithm also generates the first sum node of the DPSPN, with weights equal to the ratio of the number of rows in each split-dataset to the number of rows in the original dataset (Fig. 2).

[0093] Iteration 2: For each split-dataset from Iteration 1, the algorithm splits the columns of the dataset using a nonparametric statistical hypothesis testing for independence, such as kernel-based independence test. For each pair of columns, the kernel-based independence test uses a kernel to compute a statistic which, when compared to a data-dependent threshold, allows to assess statistically the (in)dependence between the two variables. The algorithm ensures DP by adding statistical noise to both the statistic and the threshold. Also in this case, the noise scale is determined by the privacy parameter, which guarantee the desired privacy level. The output of iteration 2 are for instance five subsets of the dataset T1 and T2 reported in Tables 3a to 3e. Also this partitioning is different than that obtainable in absence of statistical noise.

[0094] Table 3a - 1stsubset VI of the dataset T1

[0095] Table 3b - 2ndsubset V2 of the dataset T 1

[0096] Table 3c - 3rd subset V3 of the dataset T1 and

[0097] Table 4a - 1stsubset VI of the dataset T2

[0098] Table 4b - 2ndsubset V2 of the dataset T2

[0099] The algorithm also creates two product nodes. The number of edges leaving the product node is equal to the number of datasets split by the independence test: three in the first case (from dataset Tl) and two in the second (from dataset Tl).

[0100] Iteration 3: Assuming that, the algorithm does not cluster the rows in the three sub-datasets related to the left node, this iteration creates leaf nodes for each of the three datasets. These three datasets are used to learn a parametric distribution. For example, for time, since the chosen distribution was a Gaussian distribution, the mean and variance of the Gaussian are learned in a private way as follows:

[0101] Mean = (15+ 19+25J / 3 + noise 1

[0102] Variance = (15A2+ 19A2+25A2) / 3 -((15+ 19+25) / 3)A2 + noise2 where noise 1, noise2 are determined by the definition of privacy parameter, in order to guarantee the desired privacy level.

[0103] This parametric distribution is different than that obtainable in absence of statistical noise.

[0104] Iteration 4: The learning algorithm may continue processing the two datasets in the right node iteratively until it creates leaf nodes.

[0105] Once all the leaf nodes are created, the algorithm terminates.

[0106] The DPSPN is learnt.

[0107] Any number of queries on the DPSPN may be performed without violating the privacy of the individuals in the original dataset.

[0108] The learned DPSPN may be used also to sample the synthetic dataset B, such as the one shown below, which preserves the statistical information of the original dataset A without revealing the private information of the single individuals.

[0109] Table 5 - Syntetic Dataset

[0110] Although the example provided above relates to categorical variables and continuous variables, the method of the present invention is also suitable to handle different and more complex data. For this purpose, the leaf nodes of the DPSPN may be associated to a kernel for handling complex data such as videos, sounds, images etc.

[0111] Accordingly, the DPSPNs may be used in a variety of applications, including image and speech recognition, natural language processing, and recommendation systems.

Claims

CLAIMS1. Method to obtain statistical information on an original dataset (A) wherein statistical information on the original dataset (A) might be obtained by querying the original dataset (A) but wherein said queries from the original dataset (A) have to be avoided as a measure for protection of privacy of individual data of the original dataset (A), the method including the steps of: a) providing the original dataset (A), b) providing a parameter representative of a loss of privacy, c) learning a differentially private sum product network (DPSPN) taking in input the original dataset (A) and the parameter representative of the loss of privacy, d) using the DPSPN to obtain statistical information on the original dataset (A) without querying the original dataset (A), wherein said step obtaining statistical information on the original dataset (A) is repeatable with no limitations of the number of times and with no deduction on privacy protection of individual data of the original dataset (A).

2. Method according to claim 1, wherein said step c) of learning the DPSPN includes processing at least one of the following statistical methodologies on the original dataset (A):-hypothesis testing and clustering,-score based methodology,-likelihood based methodology,-frequentist or Bayesian methodology,-parametric methodology,-non parametric methodology.

3. Method according to claim 2, wherein said step c) of learning the DPSPN includes a plurality of iterations comprising:-a first iteration which takes in input the entire original dataset (A), splits the input into a plurality of subsets of data, and computes one node of the DPSPN through said subsets of data of the original dataset (A),-a plurality of intermediate iterations, each taking in input one subset of data returned by the first iteration on by another intermediate iteration, splitting the input into a plurality of subsets of data and computing another node of the DPSPN, said another node being a sum node or a product node or a leaf node, wherein at one or more of said plurality of iterations a statistical noise is introduced, the statistical noise depending on the parameter representative of the loss of privacy, the lower is the value of the parameter, the greater is the statistical noise introduced.

4. Method according to claim 3, wherein the leaf node is a statistical distribution.

5. Method according to claim 3, wherein the leaf node is a kernel.

6. Method according to claim 3, wherein at said plurality of iterations computing a sum node, a non-parametric clustering methodology is used, preferably a kernel k-means, the non-parametric methodology takes the subsets of the input as clusters and measure distance values between rows of the subsets and centers of the clusters, wherein said statistical noise is introduced in the step of measuring said distance values.

7. Method according to claim 3, wherein at said plurality of iterations computing a produced node, a non-parametric hypothesis statistical testing for independence methodology is used, preferably a kernel-based independence test, said methodology taking all the couples of columns from the subsets of the input and, for each couple:-computes a predetermined statistic;-compares the result of the predetermined statistic with a data- dependent threshold and-determines dependence or independence of the columns, wherein the columns represent variable in the input, and wherein said statistical noise is introduced in said predetermined statistic and / or in said threshold.

8. Method according to claim 3, wherein at said plurality of iterations computing a leaf node, statistical noise is introduced in a step of learning the statistical distribution of the leaf node from data in the subset of data.

9. Method according to claim 1, wherein said step of using the DPSPN includes-running the DPSPN to generate a synthetic private dataset (B),-querying the synthetic private dataset (B), wherein said step of querying the synthetic private dataset (B) provides statistical information on the synthetic private dataset (B) and wherein the statistical information on the synthetic private dataset (B) are equal to the statistical information on the original dataset (A), which would have been obtained if the original dataset (A) were queried, whereas individual data of the dataset (B) provide no information on individual data of the original dataset (A), so as privacy protection on individual data of the dataset (A) is safeguarded.

10. Method according to claim 1, wherein said step of using the DPSPN includes executing a statistical query directly from the DPSPN by means of an application program interface (API), wherein the statistical query provides statistical information corresponding to the statistical information on the original dataset (A) .

11. Method according to claim 1 , wherein said step a) of providing theoriginal dataset (A) further includes specifying one or more variables (age, income, health insurance, ...) among the variables of the original dataset (A) for which statistical information has to be obtained, a type (real, discrete, ...) and a domain for each one of said one or more variables, and wherein said step of running the DPSPN generates the synthetic private dataset (B) including only variables of said type in said domain for which statistical information has to be obtained.

12. Method according to claim 10, wherein the type of the variables includes a categorical (discrete) type or a continuous (real) type.

13. Method according to claim 11, wherein the synthetic private dataset (B) includes variables of mixed types, wherein some of the variable have a categorical (discrete) type and other of the variable have continuous type.

14. Method according to claim 12, wherein the categorical variables are represented by means of categorical distributions and the continuous variables are represented using univariate or multivariate continuous distributions.

15. Method according to claim 12, wherein the loss of privacy is a scalar value, and wherein the higher is the value of the loss of privacy the lower is the difference between the values of variables stored in the original dataset (A) and values of variables stored in the synthetic private dataset (B).

Images