Search papers, labs, and topics across Lattice.
This paper introduces a novel approach to privacy-preserving collaborative learning through Geometric Data Perturbation (GDP), where participants apply independent transformations to their private data and upload perturbed representations. The authors address the challenge of analyst-participant collusion, demonstrating that while participant-specific transformations can resist data recovery attacks, they lead to incompatible representation spaces that hinder model performance. By adding noise to shared anchor representations instead of private data, the method achieves a superior privacy-utility trade-off, as shown in experiments on MNIST and CelebA, where it outperforms traditional noise addition techniques in terms of learning accuracy and leakage control.
Adding noise to shared anchor representations instead of private data significantly enhances learning accuracy while maintaining privacy in collaborative settings.
Geometric Data Perturbation (GDP) enables one-shot, privacy-preserving collaborative learning: each participant applies a distance-preserving transformation to its private data and uploads only the resulting representation to a central analyst. We study GDP under analyst-participant collusion, in which the analyst combines all uploaded representations with the private data and transformations disclosed by colluding participants to recover a non-colluding participant's private data. Participant-specific independent transformations resist this attack but map participants'data into incompatible representation spaces, degrading downstream model performance. Shared-anchor alignment from Data Collaboration (DC) analysis restores compatibility and improves utility, but we show that disclosing the DC anchor matrix enables exact recovery of non-colluding participants'private data even in the presence of collusion. Adding noise directly to the private-data representations mitigates this vulnerability but substantially reduces utility. We propose adding noise to the anchor representations instead. Each participant independently transforms its private data and the shared anchor matrix, perturbs only the resulting anchor representation, and uploads both representations in a single round. Using the noisy anchor representations, the analyst aligns the private-data representations by solving a Generalized Orthogonal Procrustes Problem. We characterize alignment and recovery errors, specialize a conservative sufficient condition for convergence of the alignment to our setting, and analyze three recovery attacks. Experiments on MNIST and CelebA show that, across the evaluated attacks and deployment settings, anchor noise achieves higher learning accuracy than private-data noise at comparable measured leakage, yielding a more favorable privacy-utility trade-off under the specified collusion model.
