Privacy-preserving machine learning with tensor networks

TL;DR

This work identifies a privacy vulnerability in feedforward neural networks where information about irrelevant training-data features can be gleaned from model parameters. It proposes tensor-network architectures, especially matrix product states (MPS), as a framework with inherent reparametrization (gauge) freedom that can be canonically fixed to prevent such leakage without sacrificing accuracy. The authors prove that, for MPS, there exists a univocal, holomorphic, global canonical form that aligns white-box and black-box representations, ensuring attacks cannot extract more information from parameters than from outputs. Empirical results on medical/COVID-19 data show substantial reductions in information leakage when using the canonical MPS form, suggesting privacy-enhanced learning with minimal or no loss in predictive performance.

Abstract

Tensor networks, widely used for providing efficient representations of low-energy states of local quantum many-body systems, have been recently proposed as machine learning architectures which could present advantages with respect to traditional ones. In this work we show that tensor network architectures have especially prospective properties for privacy-preserving machine learning, which is important in tasks such as the processing of medical records. First, we describe a new privacy vulnerability that is present in feedforward neural networks, illustrating it in synthetic and real-world datasets. Then, we develop well-defined conditions to guarantee robustness to such vulnerability, which involve the characterization of models equivalent under gauge symmetry. We rigorously prove that such conditions are satisfied by tensor-network architectures. In doing so, we define a novel canonical form for matrix product states, which has a high degree of regularity and fixes the residual gauge that is left in the canonical forms based on singular value decompositions. We supplement the analytical findings with practical examples where matrix product states are trained on datasets of medical records, which show large reductions on the probability of an attacker extracting information about the training dataset from the model's parameters. Given the growing expertise in training tensor-network architectures, these results imply that one may not have to be forced to make a choice between accuracy in prediction and ensuring the privacy of the information processed.

Figures (2)

• Figure 1: Illustration of the proposed vulnerability. Each point represents a simple neural network model, $f_\theta(\bm x)=\phi\left(W_\text{rel}x_\text{rel} + W_\text{irr}x_\text{irr} + b\right)$ (where $\phi$ is an activation function), that is trained to learn the function $y(\bm{x})=\text{sign}(x_\text{rel})$. Each model is trained on a different dataset where $x_\text{rel}\sim \mathcal{N}(0,1)$, and $x_\text{irr}$ is $+1$ for all datapoints used to train the models depicted by the blue stars and $-1$ for the orange circles. The plots show the values of the neural network weight for the irrelevant variable, $W_\text{irr}$, and the bias of the output neuron, $b$, \ref{['fig:simple_before']} before and \ref{['fig:simple_after']} after training on a different, random dataset for each model. In this architecture, the gradients of any loss function $\mathcal{L}$ are $\partial_{W_\text{irr}}\mathcal{L}=x_\text{irr}\phi'\partial_\phi\mathcal{L}$ and $\partial_{b}\mathcal{L}=\phi'\partial_\phi\mathcal{L}$, implying that $\partial_{W_\text{irr}}\mathcal{L}=x_\text{irr}\partial_{b}\mathcal{L}$. These gradients will naturally drive the parameters to distinguishable regimes, which can be identified after training as demonstrated in \ref{['fig:simple_after']}. The codes for generating these figures are available in the computational appendix compApp.
• Figure 2: Comparison between deep neural networks and MPS architectures when learning a model predicting the outcome of COVID-19 infections given demographics and symptoms. Figures of merit are computed as a function of the percentage of dominant value in the irrelevant feature, namely the parity of the day of reporting. For every such percentage, several trainings are run for each of several different datasets, and statistics are computed over the full ensemble of resulting models. Figures \ref{['fig:NN']} and \ref{['fig:MPS']} show the neural network and MPS architecture used throughout the experiments. In \ref{['fig:MPS']}, each element is a tensor with as many dimensions as legs. The purple squares in the lower row represent the parameters of the MPS. They are arranged in three-dimensional tensors, which are multiplied by their neighboring tensors and by the input. This is encoded in the one-dimensional vectors depicted by the yellow squares in the top row. The final tensor after multiplications via Eq. \ref{['eq:mps']} is a vector encoding the output, because the bottom leg of the orange square in the bottom row is free. The gauge symmetry that allows to erase information about irrelevant features is the decomposition of the identity, represented by the green diamonds, in invertible matrices that are later absorbed by the original tensors. Figures \ref{['fig:models']} and \ref{['fig:attacks']} show, respectively, the performance and vulnerability of neural networks and MPS trained on the COVID dataset, as a function of the imbalance between the two values of the irrelevant feature in the training set. The codes for generating these two figures are available in the computational appendix compApp. Figure \ref{['fig:models']} depicts the average accuracy in the whole database from which the different training sets are generated. The fact that models trained on datasets biased towards different values of the irrelevant feature perform equally indicates that the feature is indeed irrelevant. Figure \ref{['fig:attacks']} represents the accuracy of attacks attempting to predict the majority value of the irrelevant feature in the training dataset. Importantly, the MPS not expressed in canonical form are vulnerable in a similar way to the neural networks, and some information remains in the residual gauge freedom not fixed by the SVD-based canonical form (the green curve denoted by MPS+C). This information is erased when randomizing over the residual freedom (the red curve denoted by MPS+C+S), or by using the univocal canonical form of Theorem \ref{['theo:thm2']} (the purple curve denoted by MPS+U), which completely fixes the gauge.

Theorems & Definitions (4)

• Theorem 2: Informal version
• proof
• Theorem 2
• proof