Private Machine Learning

Descrizione del progetto

Essere sicuri che i nostri dati privati restino privati

La nostra cronologia di navigazione non è privata. Una massiccia quantità di dati viene raccolta dai colossi di Internet. Tuttavia, le norme relative alla protezione dei dati dell’UE garantiscono la protezione dei nostri dati personali ovunque siano raccolti. Per rafforzare la privacy nell’era digitale, il progetto PRIMAL, finanziato dall’UE, velocizzerà il calcolo sicuro nella pratica. Il suo primo compito sarà la classificazione privata, dove una parte detiene un modello addestrato su un set di dati sensibili e un’altra parte detiene un campione e desidera valutare il modello rispetto a tale campione privato. Il secondo compito riguarda l’apprendimento federato che consente a migliaia di partecipanti di addestrare una rete neurale su dati congiunti. Nello specifico il progetto migliorerà gli elementi costitutivi crittografici specifici e li applicherà per queste applicazioni.

Obiettivo

Machine learning algorithms are data-hungry, and perform better when exposed to more and more data. Such data is being collected in massive amounts by internet giants, and is often sensitive and private. Examples include the purchases and browsing history of users, their health data and exercise activity, locations they travel to and messages they type into their mobile phone. The amount of data being collected can be significantly reduced using cryptographic techniques, in particular, using secure multiparty computation. Secure computation enables mutually distrustful parties to compute a joint function of their inputs without revealing the inputs to one another.

In this research, we will address secure computation techniques of machine learning tasks. The first task is private classification: One party holds a model trained on a sensitive dataset, and another party holds a sample and wishes to evaluate the model on that private sample. Our objective is to fulfill this task while achieving significantly stronger security notion than previous works, that is, security even if one of the parties deviates from the protocol specifications (malicious security). The second task is federated learning, a techniques that enables thousands of participants to train a neural network on their joint data but without revealing the data to one another. However, a recent work showed that such task is susceptible to injection of backdoors, and a user can manipulate the joint model to his/her own benefit, significantly reducing the usefulness of federated learning in practice. Our objective is to guarantee immunity to such injections. The two objectives will be achieved by improving specific cryptographic building blocks, and applying them for these applications.

PRIMAL will speed up secure computation in practice, and carries immense potential to enhance privacy in the digital era.