Recovering from Privacy-Preserving Masking with Large Language Models (2309.08628v3)

Abstract: Model adaptation is crucial to handle the discrepancy between proxy training data and actual users data received. To effectively perform adaptation, textual data of users is typically stored on servers or their local devices, where downstream NLP models can be directly trained using such in-domain data. However, this might raise privacy and security concerns due to the extra risks of exposing user information to adversaries. Replacing identifying information in textual data with a generic marker has been recently explored. In this work, we leverage LLMs to suggest substitutes of masked tokens and have their effectiveness evaluated on downstream LLMing tasks. Specifically, we propose multiple pre-trained and fine-tuned LLM-based approaches and perform empirical studies on various datasets for the comparison of these methods. Experimental results show that models trained on the obfuscation corpora are able to achieve comparable performance with the ones trained on the original data without privacy-preserving token masking.

An Examination of Privacy-Preserving Data Masking Recovery Using LLMs

The paper "Recovering from Privacy-Preserving Masking with LLMs" addresses the critical challenge of balancing privacy preservation in user data with the efficacy of machine learning models. As users' data privacy becomes paramount, approaches that replace sensitive information in text with generic markers or masks have emerged. This paper's central contribution is leveraging LLMs to replace masked tokens in a manner that preserves model performance in downstream language tasks.

Problem Context and Methodology

Deploying machine learning models often faces the challenge of discrepancies between training data and end-user data. This is particularly prominent in the domain of NLP, where models require adaptation to domain-specific textual data that may contain sensitive information. Traditional methods of adapting to user data risk inadvertently revealing private user details.

To mitigate these risks, the paper explores various privacy-preserving masking techniques that effectively obfuscate sensitive data by replacing certain tokens with a generic marker such as “[MASK]”. Three distinctive strategies for automatic token masking are presented:

1. Allow List: Only tokens present in a predefined list of common, nonsensitive words are retained unmasked.
2. Vocabulary Threshold: Common words above a certain frequency in a broad dataset are retained, masking rarer terms presumed to be more sensitive.
3. Entity Tagger: Utilizes Named Entity Recognition (NER) models to identify and subsequently mask named entities like names and locations.

Once masked, the critical research question addressed is selecting suitable substitutes for these masked tokens using LLMs to maintain semantic integrity and model performance.

The methodologies proposed to recover masked data leverage several LLM-based techniques:

• Top-K Selection: Instead of always selecting the single best prediction from an LLM, the model samples from the top-K candidates, introducing variability that can improve model robustness by simulating potential variations of the original data.
• Fine-Tuning: Pre-trained models like BERT, RoBERTa, and LLaMA2 are further fine-tuned on domain-specific data or synthetic data derived from original masking techniques, improving contextual prediction accuracy.

Experimental Evaluations

Empirical evaluations were conducted across datasets such as Fisher, Reddit, and WSJ, with both LLMs and Automatic Speech Recognition (ASR) systems serving as downstream tasks. Key findings are outlined as follows:

• Performance: Methods based on RoBERTa consistently showed superior token recovery performance across datasets. Notably, perplexity scores on LLMing tasks demonstrated that models trained on data with recovered tokens approached those trained on unmasked data, particularly with vocabThres and entityTagger strategies.
• Fine-Tuning Impact: Fine-tuning substantially enhanced token recovery, particularly when domain data was scarce. The distillation of both BERT and RoBERTa models revealed an improvement in prediction fidelity on token substitution.
• ASR Implications: By integrating recovered LLMs with ASR through shallow fusion, substantial improvements in WER were achieved, underlining the practical implications of the token recovery methodology.

Implications and Future Directions

This work paves the way for advancing privacy-preserving model training, particularly focusing on NLP and ASR systems' adaptability to domain-specific contexts. The ability to balance privacy and performance opens new avenues for machine learning applications where sensitive data handling is essential. Future research directions could explore more nuanced token recovery techniques, perhaps incorporating class-specific markers or developing objective functions more directly tied to downstream tasks' performance.

Additionally, ongoing advancements in LLM architectures may further reduce the performance gap between models trained on obfuscation corpora and those using original data, enhancing the viability of privacy-sensitive machine learning solutions in real-world applications.