Neural Network Inference Privacy Using Differentially Private Perturbation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing neural network inference systems, particularly in cloud-based INFerence-as-a-Service (INFaaS), pose significant privacy risks as raw data is transmitted, potentially leading to misuse or leakage, necessitating methods to ensure user data privacy without compromising neural network performance.
Innovation Solution
The method involves applying optimal stochastic perturbations using Laplace distributions to obfuscate data features before transmission, ensuring ε-differential privacy and minimizing mutual information loss, controlled by a Lagrange multiplier, to maintain inference accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If raw data is transmitted to cloud-based neural network inference systems, then inference accuracy is maintained, but data privacy is compromised and information leakage risk increases
Solution Approach 1:
The patent applies preliminary action by adding stochastic perturbations to the input data before transmission to the neural network. This preprocessing step obfuscates sensitive information in advance, ensuring privacy protection while maintaining inference functionality. The perturbations are generated using optimized statistical distributions that preserve task-relevant information while removing identifiable personal data.
Solution Approach 2:
The patent introduces an intermediary mechanism - optimized stochastic perturbations - that acts as a mediator between raw private data and the neural network inference system. This intermediary layer transforms the data into a privacy-preserving representation that retains essential information for accurate inference while preventing direct access to sensitive raw data.
2Object-affected harmful factors
If stochastic perturbations are applied to obfuscate data features, then data privacy is improved, but information content is reduced
Solution Approach 1:
The patent applies parameter changes by optimizing the parameters of statistical distributions (such as mean and standard deviation) that generate the stochastic perturbations. By carefully tuning these parameters, the system achieves the right balance between adding enough noise for privacy protection and retaining sufficient information for accurate inference. The optimization process adjusts distribution parameters to minimize information loss while maximizing privacy benefits.
3Object-affected harmful factors
If strong obfuscation is applied to maximize privacy, then mutual information reduction increases, but inference task performance degrades
Solution Approach 1:
The patent applies partial action by adding only the necessary amount of stochastic perturbation required for privacy protection, rather than excessive obfuscation. The optimization process determines the minimal perturbation strength needed to achieve the desired privacy level (measured by mutual information reduction) while maintaining acceptable inference accuracy. This avoids the diminishing returns of overly strong obfuscation that would unnecessarily degrade task performance.
Data Source
Figure 2
Figure 3
Figure 4
AI summary
Methods and systems that provide data privacy for implementing a neural network-based inference are described. A method includes injecting stochasticity into the data to produce perturbed data, wherein the injected stochasticity satisfies an ε-differential privacy criterion and transmitting the perturbed data to a neural network or to a partition of the neural network for inference.