arXiv:2505.15721cs.LGstat.ML2025-05中稿 · COPA 2025被引 6

在本地差分隐私下实现可信的置信预测,保护用户数据与标签隐私。

Privacy-Preserving Conformal Prediction Under Local Differential Privacy

  • 用户上传带噪声的特征和标签,或噪声化置信度得分,避免暴露真实信息。
  • 即使在严重随机化下仍保证有限样本覆盖率,结果稳定可靠。
  • 适用于医疗影像、大模型查询等高敏感场景,支持不计算得分的用户使用。

置信预测(CP)能提供包含真实类别的候选类别集合,并保证一定概率覆盖。然而,传统方法依赖带有干净标签的校准集。本文针对聚合器不可信且仅能访问扰动标签的隐私敏感场景,提出两种互补方法:第一种中,用户不访问模型,仅通过 k 元随机响应提供输入特征和扰动标签;第二种在更严格隐私约束下,用户通过二分搜索响应对自身置信度加噪,需访问分类模型但同时保护数据与标签隐私。两种方法均直接从噪声数据计算置信阈值,无需获取真实标签。理论证明了有限样本覆盖保证,在极端随机化下仍保持稳健覆盖。该方法实现了强本地隐私与预测不确定性控制的统一,适用于医疗影像或大语言模型查询等敏感应用,无论用户能否(或是否愿意)自行计算置信度。

原文摘要 · Abstract (English)

Conformal prediction (CP) provides sets of candidate classes with a guaranteed probability of containing the true class. However, it typically relies on a calibration set with clean labels. We address privacy-sensitive scenarios where the aggregator is untrusted and can only access a perturbed version of the true labels. We propose two complementary approaches under local differential privacy (LDP). In the first approach, users do not access the model but instead provide their input features and a perturbed label using a k-ary randomized response. In the second approach, which enforces stricter privacy constraints, users add noise to their conformity score by binary search response. This method requires access to the classification model but preserves both data and label privacy. Both approaches compute the conformal threshold directly from noisy data without accessing the true labels. We prove finite-sample coverage guarantees and demonstrate robust coverage even under severe randomization. This approach unifies strong local privacy with predictive uncertainty control, making it well-suited for sensitive applications such as medical imaging or large language model queries, regardless of whether users can (or are willing to) compute their own scores.

置信预测差分隐私隐私保护机器学习安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。