# Towards Privacy-, Budget-, and Deadline-Aware Service Optimization for Large
Medical Image Processing across Hybrid Clouds
††thanks: This work has been funded by the European Union project CLARIFY
(860627), partially funded by $\text{ENVRI}^{\text{FAIR}}$ (824068),
BlueCloud-2026 (101094227) and LifeWatch ERIC.

Yuandou Wang  Multiscale Networked Systems, University of Amsterdam, The
Netherlands  Neel Kanwal  Department of Electrical Engineering and Computer
Science, University of Stavanger, Norway  Kjersti Engan  Department of
Electrical Engineering and Computer Science, University of Stavanger, Norway
Chunming Rong  Department of Electrical Engineering and Computer Science,
University of Stavanger, Norway  Paola Grosso  Multiscale Networked Systems,
University of Amsterdam, The Netherlands  Zhiming Zhao  Multiscale Networked
Systems, University of Amsterdam, The Netherlands

###### Abstract

Efficiently processing medical images, such as whole slide images in digital
pathology, is essential for timely diagnosing high-risk diseases. However,
this demands advanced computing infrastructure, e.g., GPU servers for deep
learning inferencing, and local processing is time-consuming and costly.
Besides, privacy concerns further complicate the employment of remote cloud
infrastructures. While previous research has explored privacy and security-
aware workflow scheduling in hybrid clouds for distributed processing,
privacy-preserving data splitting, optimizing the service allocation of
outsourcing computation on split data to the cloud, and privacy evaluation for
large medical images still need to be addressed. This study focuses on
tailoring a virtual infrastructure within a hybrid cloud environment and
scheduling the image processing services while preserving privacy. We aim to
minimize the use of untrusted nodes, lower monetary costs, and reduce
execution time under privacy, budget, and deadline requirements. We consider a
two-phase solution and develop 1) a privacy-preserving data splitting
algorithm and 2) a greedy Pareto front-based algorithm for optimizing the
service allocation. We conducted experiments with real and simulated data to
validate and compare our method with a baseline. The results show that our
privacy mechanism design outperforms the baseline regarding the average lower
band on individual privacy and information gain for privacy evaluation. In
addition, our approach can obtain various Pareto optimal-based allocations
with users’ preferences on the maximum number of untrusted nodes, budget, and
time threshold. Our solutions often dominate the baseline’s solution and are
superior on a tight budget. Specifically, our approach has been ahead of
baseline, up to 85.2% and 6.8% in terms of the total financial and time costs,
respectively.

###### Index Terms:

Distributed Data Processing, Hybrid Clouds, Medical Images, Optimization,
Privacy

##  I Introduction

Medical data collected by hospitals and clinics are usually stored and
processed in individual infrastructures due to privacy concerns. In recent
years, deep learning (DL) technologies have been widely used in many
diagnostic and prognostic tasks, for example, in digital pathology (DP) [1,
2], dealing with large whole slide images (WSI) produced by microscopy
scanners. This is because DL can potentially improve the accuracy of automated
diagnosis systems and save clinicians’ time by providing second opinions.
Clinicians or researchers might want to use DL-based methods over thousands of
images, but WSIs are gigapixel images and one WSI may size up to 20GB in
uncompressed form [1], thus it becomes computationally heavy. For instance,
finding a segmentation map for different tissue types in a WSI using deep
neural network (DNN)-based features may take a few hours, and running the DNN
models for datasets like TCGA111The Cancer Genome Atlas Program (TCGA).
https://www.cancer.gov/ccg/research/genome-sequencing/tcga. Retrieved 4
October 2023. (with over 30,000 WSIs from 25 cancer types) may take several
years to conclude using a single GPU machine [3]. Hospitals or individual
research institutes usually do not have an inexhaustible infrastructure that
supports complicated computation and it is expensive for a hospital to conduct
such computation in their local machines.

Cloud computing offers ample and highly scalable storage and computational
resources with various pricing models and ubiquitous access through
virtualization technology. Many companies, institutes, or organizations are
outsourcing some of their information technology and data processing to the
cloud [4]. Nevertheless, large medical image processing is accompanied by
large challenges:

  1. 1.

_Privacy concerns_. Medical images, such as WSIs, usually contain sensitive
personal information. Many medical data custodians are reluctant to export
their sensitive data over public cloud computing due to the sensitive nature
of the data, privacy concerns with upgraded legal data protection requirements
(e.g., GDPR222GDPR, applicable as of May 25, 2018. https://gdpr-info.eu/ and
HIPAA333Public Law 104-191 HIPAA, approved on August 21, 1996.
https://www.govinfo.gov/app/details/PLAW-104publ191), together with security
concerns on frequent data breaches mainly centered around the public cloud
service providers (CSPs) [4, 5]. Not only can the CSPs access, use, or even
sell the data outsourced by their customers, but the service might also suffer
from attacks or emerging threats that can lead to data breaches and compromise
data confidentiality.

  2. 2.

_The requirement of privacy-preserving and cost-effective solutions_. Running
DNN models is resource-hungry, and cloud customers could be billed with a
“pay-as-you-go” pricing model based on their actual resource usage (e.g., GPU
services) over a specific period, such as an hour or minute. Introducing data
and task parallelism for distributed processing over clouds is common to
reduce time and cost [6]. However, privacy concerns further complicate the way
of distributed processing. Consequently, customizing a virtual infrastructure
and scheduling the image processing workflow under privacy, budget, and time
requirements are highly important and must be addressed.

In recent years, hybrid cloud (HC) has received much attention since it
provides the best of the private and public worlds, combining the economies
and efficiencies of public cloud computing with the security and control of
private cloud computing [7, 8, 9]. Several existing works have studied privacy
and security-aware workflow scheduling problems for distributed processing in
HCs [10, 11, 12, 13]. However, most solutions focus on one or two objectives
optimization (e.g., the execution time and monetary cost reductions). In those
solutions, there are no explicit key metrics for privacy evaluation in the
deployment and execution of applications. The vulnerabilities and
uncertainties of the system are implicitly described in the data movement or
task execution in the whole workflow execution procedure, which may not solve
the data privacy issues in the distributed data processing for different
purposes. This paper aims to overcome those limits by providing a two-phase
solution to protect data privacy during the distributed processing service,
minimize the number of untrusted processing nodes, reduce the financial cost,
and decrease the execution time over an HC. Those constraints and optimization
objectives are formally stated as a multi-objective optimization (MOO)
problem.

Our novel contributions can be summarized as follows:

  * •

We design and implement a privacy-preserving data splitting algorithm for
large medical images to not only introduce data parallelism but also achieve
the goal of data protection for distributed processing. This is a critical
prerequisite for privacy-preserving workflow scheduling in the HC environment.

  * •

We develop a greedy Pareto front-based approach to seek 3-dimensional (3D)
Pareto optimal solutions of the MOO problem, enabling to improve the
algorithm’s efficiency with less search space.

  * •

We demonstrate how to analyze, quantify, compare and understand our algorithms
by conducting experiments based on a use case from the DP domain.

The remainder of this paper is structured as follows. Section II presents
related work on cryptographic and non-cryptographic techniques to data
processing, and privacy-aware workflow scheduling in HCs. Section III provides
related concepts used for the methodology and evaluation. In Section IV, we
propose our system model and formulate the problem statement. Section V
illustrates our proposed two-step approach for problem-solving. Section VI
details the experimentation and Section VII discusses the results. Finally, we
conclude our work in Section VIII.

##  II Related Works

This paper involves a solution to privacy and security-aware workflow
scheduling over HCs for sensitive data based on multiple disciplines.
Therefore, this section reviews the state of the art on privacy-preserving
techniques to data processing and existing works for privacy-aware MOO
problems over HCs.

###  II-A Privacy-preserving Techniques to Data Processing

In the past few decades, various privacy-preserving techniques have been
developed to protect sensitive data from unauthorized or untrusted CSPs,
broadly categorized into two types, namely, cryptographic and non-
cryptographic [4, 14]:

####  II-A1 Cryptographic Techniques

Cryptographic techniques provide robust mechanisms to preserve privacy by
transforming data into directly unreadable form. Approaches based on
differential privacy [15], secure multiparty computation (MPC) [16],
homomorphic encryption (HE) [17, 18], attribute access control [19],
searchable encryption [20], and lightweight cryptographic procedures [21], are
a few examples for cryptographic (or encryption) techniques which can provide
good privacy [22]. However, a critical shortcoming of such approaches is the
high computational and /or communication complexities.

Differential privacy is a theoretical framework that assumes an extreme
scenario where all nodes in the network are corrupted ($k_{i}=n-1$) except for
node $i$. Nevertheless, it has a trade-off between privacy and utility which
has been proved in [23] in several examples, such as distributed average
consensus and privacy-preserving distributed average consensus. It is argued
that approaches based on differential privacy are information-theoretically
possible but computationally intractable while maintaining a non-constant
error increase, especially for data with a considerable size [24]. Because of
the high noise levels imposed by differential privacy approaches, it might not
be the optimal choice for big data privacy [22].

Even though MPC-based approaches can obtain full utility without compromising
privacy, it is hard to generalize to problems other than distributed average
consensus, and the robustness over $n-1$ corrupted nodes is no longer
achievable [23]. Besides, Boyle et al. [25] demonstrates the existence of
$n$-party functions with $k$ bits of input for each part that has bottleneck
complexity $\Theta(nk)$, which is defined as the maximum communication
required by any party. In addition, MPC has to exchange information between
nodes in the processing and could, hence, reveal some information about the
private data [23], which may increase the way of distributed processing. HE-
based approaches draws significant attention as a privacy-preserving way for
cloud computing because it allows users to compute the encrypted data (called
ciphertexts) without decrypting it [26], but the computation on ciphertext is
arithmetically heavy, especially HE multiplication. For example, the execution
time for computation on encrypted data (ciphertext) increases from 100s to
10,000s of times compared to that on native, unencrypted messages [27]. Thus,
implementing these techniques is rather expensive and impractical (especially
for big data privacy) with respect to efficiency in distributed systems.

####  II-A2 Non-cryptographic Techniques

Compared to cryptographic techniques, non-cryptographic ones such as data
perturbation and data splitting approaches for big data privacy provide
lightweight and efficient implementation; therefore, they are more
appropriately fitting for outsourcing data in the cloud. Some of the common
manifold non-cryptographic techniques are access-controls [28],
pseudonymization [29], data anonymization [30], and privacy-preserving data
splitting [4, 31].

Data anonymization methods, currently the most widely used utility-based
approach [32], rely on obscuring or removing sensitive information from
medical data. There are two types of data anonymization considering masking
methods [33]: 1) non-perturbative masking introduces partial suppression or
reductions in certain values which does not alter the truthfulness of the data
but it reduces their accuracy, and 2) perturbative masking, which perturb (or
alter) original values to limit disclosure risk by creating uncertainty around
the true values. The latter is better than the former since it may preserve
statistical properties for big data privacy, and thus, we investigate more on
perturbative masking [4, 23]. The best-known perturbative masking methods
include noise addition [34], random-value perturbation [35], rank swapping
[36], data shuffling [37], and microaggregation [38] methods. Due to the
modifications, perturbative methods often suffer from utility. Various privacy
models are introduced [22] to address the utility-privacy trade-off, e.g.,
$k-$anonymity [39], entropy $l-$diversity [40], and $t-$closeness [41].
However, these models may suffer from the composition attack [42], foreground
information [43], and $p-$optimality attack [44].

Data splitting, as another non-cryptographic approach, aims to protect data
privacy by fragmenting sensitive data and storing the fragments in different
locations so that individual parts do not disclose identities or confidential
information [4, 31]. Sánchez et al. [45] presented a semantic data splitting
approach for data outsourced to the cloud. The authors assess the semantics of
the data to be protected and the user’s privacy requirement. The work of
Farràs et al. [31] is related to the data splitting approach we propose in
this paper. It also has the potential for seeing the data splitting problem as
a graph-coloring problem (i.e., hypergraph-coloring problem) and outsource
computation on split data, however it differs from our proposed method in
important ways. It cannot be straightforwardly applied for large image
splitting because it is based on plain textual documents instead of gigapixel
medical images. In addition, the method of Farràs et al. [31] still has
several limitations related to customizing a virtual infrastructure for
distributed data processing.

###  II-B Privacy-aware Workflow Scheduling in HCs

There is a scarcity of literature that formulates privacy-aware workflow
scheduling as an optimization problem adhering to privacy and security
requirements. Sharif et al. [11] presented a multi-level task partition method
to minimize the overall execution cost of workflows in HCs while considering
the trade-off between time and privacy. Three multiterminal-cut for privacy in
hybrid clouds (MPHC) policies are introduced to preserve the privacy of tasks.
Zhou et al. [12] introduced the special privacy requirements and formulated
the process mapping problem in geo-distributed data centers as a constraint
optimization problem, aiming at minimizing the overall communication cost
function of the application while meeting data privacy constraints. However,
such approaches are highly dependent on the application structure and heavily
limited by the allocation map related to privacy privileges defined by
authors. Similarly, Lei et al. [13] investigated how to effectively reduce
monetary cost when deploying a workflow application in an HC under the
deadline and privacy constraints. Wen et al. [10] proposed a multi-objective
privacy-aware (MOPA) scheduling algorithm based on genetic algorithm (GA),
which aims to obtain a set of Pareto trade-off solutions between execution
makespan and monetary cost reductions while meeting the set of privacy
protection constraints.

The main weakness of all these solutions is that they are said to satisfy
privacy requirements while reducing the cost or the execution time. However,
they do not solve any privacy issues relevant to realistic applications. As a
result, such workflow scheduling problem formulations and solutions still have
the disadvantages of privacy protection and no explicit metrics for privacy
evaluation, even though they had good strategies for the execution time and
monetary cost.

##  III Background

###  III-A Threat and Adversary Models

In this work, we consider CSPs that are honest-but-curious, in which CSPs
honestly fulfill their role in the storage and processing services, but may
inspect the information that users store or process [4, 31]. Adversary models
are used to evaluate the robustness of the system under different security
attacks [23]. We consider two widely-used adversary models, i.e., passive and
eavesdropping adversary.

####  III-A1 Passive Adversary

The passive adversary is known as a semi-honest or honest-but-curious threat
[46]. It typically tries to collude with a number of nodes to infer and reason
sensitive information of the other nodes to gain insights without directly
altering the data or system. These colluding nodes are called corrupted nodes,
and the others are referred to as honest nodes. In a network graph, an edge is
corrupted when there is one corrupted node at its ends. The passive adversary
will know all the messages transmitted along such an edge.

####  III-A2 Eavesdropping Adversary

The eavesdropping adversary works by secretly monitoring communication
channels or data transmissions to capture sensitive information without the
knowledge of the communication parties [47, 23]. In practice, we can configure
secure channel for communication, such as SSL/TLS certificates, so that we
assume the transmitted messages can be protected from eavesdropping
adversaries.

###  III-B Key Aspects for Privacy Evaluation

To evaluate algorithms in the context of privacy preservation, we focus on
information-theoretic security metrics, such as the average increase in
information entropy, output utility, and individual privacy, since they assume
a stronger adversary and are more efficient concerning both communication and
computational demands [48, 49, 23].

####  III-B1 Definitions of Entropy and Mutual Information

The Shannon entropy $H(\cdot)$ is an essential concept in the information
theory of communication to quantify the uncertainty (or randomness) of an
information source, which is often utilized to quantify the privacy (for the
case of discrete random variables) [50, 51]. Let $x_{j}$ be the random value
of variables $X$, $n$ denotes the number of data points in $X$, where $j\in
n$. The entropy can be calculated as,

$H(X)=-\sum^{n}_{j=1}x_{j}log_{2}x_{j}$ (1)

The mutual information $I(X;Z)$ between two random variables $X$ and $Z$
measures the dependence between $X$ and $Z$ [52, 23], quantifying the average
reduction in uncertainty about $X$ that results from learning the value of
$Z$, which can be stated formally as,

$I(X;Z)=H(X)-H(X|Z)$ (2)

where $H(X)$ is the entropy for data $X$ and $H(X|Z)$ is the conditional
entropy for $X$ given $Z$.

####  III-B2 Average Information Gain

Let $Z_{i}\subset Z$ and $S_{i}\subset S$ be the $i^{th}$ encoded and private
sub datasets, respectively. $n$ is the number of sub datasets. Information
gain is calculated by comparing the entropy of the private data $S$ with the
encoded data $Z$, which can be quantified as:

$AIG(S;Z)=\frac{\sum^{n}_{i=1}H(Z_{i})-H(S_{i})}{n},\quad i=1,...,n$ (3)

$AIG$ examines the amount of uncertainty reduced by altering the original
dataset. A positive $AIG$ value indicates that identifying the original data
$S$ using $Z$ is difficult.

####  III-B3 Output Utility

The output utility is to measure how close the estimated value $\hat{Y}_{i}$
of a privacy-preserving distributed processing algorithm is to its desired
output $Y_{i}$, for each node $i\in\mathcal{N}$,

$u_{i}=I(Y_{i};\hat{Y}_{i}),\quad\forall i\in\mathcal{N}$ (4)

where $0\leq u_{i}\leq I(Y_{i};Y_{i})$ and $u_{i}=I(Y_{i},Y_{i})$ indicates
perfect output utility [23].

####  III-B4 Individual Privacy

Let $\mathcal{V}$ denotes the set of random variables containing all
information collected by the adversaries throughout the whole processing. The
individual privacy of honest node $i\in\mathcal{N}_{h}$ quantifies the amount
of information about the private data $S_{i}$ learned by the adversaries,
which is given by,

$\rho_{i}=I(S_{i};\mathcal{V}),\quad\forall i\in\mathcal{N}_{h}$ (5)

The smaller $\rho_{i}$, the more private the data is. The lower bound on
individual privacy is defined by,

$\rho_{i,min}=I(S_{i};\\{S_{j},\hat{Y}_{j}\\}_{j\in\mathcal{N}_{c}})$ (6)

in which, based on the definitions of adversary models, it can be concluded
that adversaries always have knowledge of the private data
$\\{s_{j}\\}_{j}=S_{j}\in\mathcal{N}_{c}$ and estimated outputs over corrupted
nodes $\\{\hat{y}_{j}\\}_{j}=\hat{Y}_{j}\in\mathcal{N}_{c}$ where the maximum
number of corrupted nodes denotes $\mathcal{N}-1$ out of $\mathcal{N}$,
regardless of the algorithm used. Hence,
$\\{S_{j},\hat{Y}_{j}\\}_{j\in\mathcal{N}_{c}}\subseteq\mathcal{V}$ is the
information known by the passive adversary model, we have
$I(S_{i};\\{S_{j},\hat{Y}_{j}\\}_{j\in\mathcal{N}_{c}})\leq\rho_{i}\leq
I(S_{i};S_{i})$ [23].

###  III-C Multi-Objective Optimization

####  III-C1 Multi-objective Optimization Problem

Multi-objective optimization aims to simultaneously optimize a group of often
conflicting objectives. The general MOO problem is posed as follows [53]:

$\displaystyle\text{Minimize}_{\mathbf{x}}\quad\mathbf{F(x)}$
$\displaystyle=[f_{1}(\mathbf{x}),f_{2}(\mathbf{x}),...,f_{n}(\mathbf{x})]^{T}$
(7) $\displaystyle\text{subject to, \quad}g_{j}(\mathbf{x})$
$\displaystyle\leq 0,\quad j=1,2,...,m$ (8) $\displaystyle h_{l}(\mathbf{x})$
$\displaystyle=0,\quad l=1,2,...,e$ (9)

where $n$ is the number of objective functions, $m$ is the number of
inequality constraints, and $e$ is the number of equality constraints.
$\mathbf{x}\in\mathbb{R}^{n}$ is a vector of decision variables and the set
$\mathbf{X}\subseteq\mathbb{R}^{n}$ is the feasible set of $\mathbf{x}$, in
which it depends on the $n$-dimensional application domain. $\mathbf{F(x)}$ is
a vector of objective functions, $f_{i}(\mathbf{x})$, also called criteria,
payoff functions, or value functions.

####  III-C2 Feasible Solutions

The gradient of $f_{i}(\mathbf{x})$ regarding $\mathbf{x}$ is formulated as
$\nabla_{\mathbf{x}}f_{i}(\mathbf{x})\in\mathbb{R}^{n}$. The feasible set of
decision vectors $\mathbf{X}$ is defined as the set
$\\{\mathbf{x}|g_{j}(\mathbf{x})\leq
0,j=1,2,...,m;h_{l}(\mathbf{x})=0,l=1,2,...,e\\}$. Correspondingly, the
feasible criterion space (also called the feasible cost space or the
attainable set), $\mathbf{Z}$ is defined as the set
$\\{\mathbf{F}(\mathbf{x})|\mathbf{x}\in\mathbf{X}\\}$. The feasibility here
implies that no constraint is violated, while attainability means that a point
in the criterion space maps to a point in the design space. Each point in the
design space must map to a point in the criterion space; however, every data
point in the criterion space does not necessarily correspond to a single data
point $\mathbf{x}\in\mathbf{X}$. This is the main reason why there is
typically no single global solution in MOO, and it is often necessary to
determine a set of points that all fit a predetermined definition for an
optimum.

####  III-C3 Pareto Front

MOO aims to find a set of solutions $\mathbf{x}^{*}\in\mathbf{X}$, where no
solution is superior to another in all objectives. Evaluating the solutions
involves assessing the quality and trade-offs among all objectives. Pareto
dominance represents a measure of the efficiency of the feasible solutions.
From the mathematical point of view, the definition of the dominance between
two candidate solutions can be expressed as $\mathbf{x_{1}}$ dominates
$\mathbf{x_{2}}$ if $f_{i}(\mathbf{x_{1}})\leq f_{i}(\mathbf{x_{2}})$,
$\forall i=1,2,...,n$. Therefore, a solution $\mathbf{x}^{*}\in\mathbf{X}$ is
called to be nondominated or Pareto optimal if and only if there does not
exist any other point $\mathbf{x}\in\mathbf{X}$, such that
$\mathbf{F}(\mathbf{x})\leq\mathbf{F}(\mathbf{x^{*}})$ and
$f_{i}(\mathbf{x})<f_{i}(\mathbf{x^{*}})$ for at least one function [54].
Pareto front (or Pareto frontier) is the set of all such non-dominated Pareto
optimal solutions.

Figure 1: Workflow of the proposed privacy-preserving distributed data
processing with a very large volume of data. Figure 2: System setup and
adversary models.

##  IV System Model and Problem Formulation

###  IV-A System Model

####  IV-A1 System Architecture

In order to customize a virtual infrastructure and schedule the privacy-
preserving distributed processing, it is critical that we provide the user
with a workflow for assessing the system. As depicted in Fig. 1, our system
model is composed of three main functionalities - viz _Privacy-preserving Data
Splitting_ (steps 0$\to$1$\to$2$\to$3), _Outsourcing Computation on Split
Data_(steps 3$\to$4$\to$5$\to$6), and _Data Aggregation_ (steps
6$\to$7$\to$8$\to$9). The trusted zone 1) prepares the encoded data sets using
our privacy-preserving data splitting, 2) containerizes the computational
tasks (e.g., DNN inferences) as reusable fine-grained services (task
containerization), 3) assigns split data and inference services to processing
nodes, 4) aggregates the final results from decoded data. The untrusted zone
consists of a set of available cloud instances in HCs, which may suffer from
threats of adversaries.

Specifically, Fig. 2 presents the system setup and adversary models. Let
$\mathcal{G}=(\mathcal{N},\mathcal{E})$ denotes a network from a provisioned
infrastructure where $\mathcal{N}=\\{S_{\text{trust}},I_{1},...,I_{K}\\}$
denotes the set of $K+1$ nodes and
$\mathcal{E}\subseteq\mathcal{N}\times\mathcal{N}$ denotes the set of
undirected edges, assuming it exists. We assume that $S_{\text{trust}}$ is a
trusted zone that no adversary can interfere with.
$\mathcal{I}=\\{I_{1},...,I_{K}\\}$ is assumed to be untrusted nodes where
each node is modelled as a tuple
$I_{k}=(\text{gpu},\text{vcpu},\text{ram},\text{sto},b,\text{loc},p,\text{perf})_{k}$,
equipped with the configurations about GPU devices, virtual CPU, RAM, local
storage, network bandwidth, location, unit price, and performance score. These
two zones cooperate, performing as a master-worker distributed computing
model. The distributed data processing application can be defined as a tuple:

$\mathcal{A}=(\mathcal{M},\varepsilon,\mathcal{D},\mathcal{R},\mathcal{I},req)$
(10)

where $\mathcal{M}$ denotes a set of lighweighted interconnected pipeline
steps which can also be seen as fine-grained _services_. For instance, a
_splitting_ service $m_{\text{splt}}$ processes the data stream produced by
the source data set $\mathcal{D}$. A _inference_ service $m_{\text{inf}}$ is
used for outsourcing the computation on split data. An _aggregating_ service
$m_{\text{aggr}}$ is responsible for aggregating the final results
$\mathcal{R}$. $\varepsilon$ indicates a set of _data streams_ $d_{u,i}$
flowing from an upstream service $m_{u}$ to a downstream service
$m_{i}\in\mathcal{M}$. $\mathcal{I}$ denotes a set of _cloud instances_ over
an HC and $req$ is a set of user requirements, e.g., privacy preservation,
time and cost reduction.

####  IV-A2 Privacy Guarantees

We remove the privacy-sensitive information in the metadata from images to
satisfy the privacy requirements. Then, we apply a privacy mechanism to
generate distributed data fragments for outsourcing computation to available
cloud instances. The mechanism is designed to hide critical attributes to
prevent attackers from reconstructing the original image data considering the
_honest-but-curious_ threat model. It protects privacy by avoiding exchanging
the original data fragments among processing nodes. The output of the
mechanism is a set of encoded split data sets
$\\{D_{e,1},D_{e,2},...,D_{e,K}\\}$. Each node $I_{k}\in\mathcal{I}$ stores
and processes the split data $D_{e,k}$ with its private attributes $S_{k}$ and
has its desired output $Y_{e,k}$.

$f_{m_{\text{inf}}}:\mathbb{R}^{K}\mapsto\mathbb{R}^{K},\quad
Y_{e,k}=f_{m_{\text{inf}}}(D_{e,k},I_{k}),\quad k\in K$ (11)

where $\mathbb{R}^{K}$ is the set of $K-$dimensional real vectors.
$f_{m_{\text{inf}}}$ represents the outsource computation on split data with
the service $m_{\text{inf}}$. Meanwhile, the total number of processing nodes
should satisfy that,

$\sum_{k=1}^{\mathcal{N_{I}}}x_{k}\geq\chi(\mathcal{D}),$ (12)

where $x_{k}$ is a boolean value that if $m_{\text{inf}}$ and $D_{e,2}$ is
mapping to $\mathcal{I}_{k}$, then $x_{k}$ equals 1; otherwise, 0.
$\chi(\mathcal{D})$ is the smallest number of split data sets. Nevertheless,
the ideal number of processing nodes in the distributed pipeline must still
comply with the performance and cost requirements.

####  IV-A3 Time Model

The total time cost of the application can be comprised of the deployment time
and execution time.

Deployment time. The time for deploying one single task service $T_{d}$
typically consists of time cost for transmitting the data fragment $D_{e,k}$
and inference service $m_{\text{inf}}$ from the trusted zone to the target
node (e.g., $I_{k}$) $T_{f}$, and installing the component $T_{i}$,
respectively. Let bandwidth information for provisioned infrastructure as a
set of $B=\\{b_{1},b_{2},...,b_{K}\\}$, where $b_{k}$ denotes the bandwidth of
$I_{k}$. The request of deployment service $r_{k}$ can be modelled as a tuple
$r_{k}=(m_{\text{inf}},D_{e,k})$. If $I_{k}$ responds to the deployment
service request $r_{k}$, the deployment time is be given by,

$T^{(k)}_{d}=T^{(k)}_{f}+T^{(k)}_{i}$ (13)

where $T^{(k)}_{f}=\frac{size(r_{k})}{b_{k}}$ is measured by the size of the
request $r_{k}$ and the network bandwidth between the trusted and target
servers. In many cases, $T_{f}$ is much bigger than $T_{i}$ [55]. Note that
installation time prediction is not the focus of this work, and the size of
$m_{\text{inf}}$ can be a constant, and hence we assume $T_{i}$ can be
negligible and we only focus on the size of $D_{e,k}$.

Execution time. The time for executing an application $T_{\text{exe}}$
typically consists of the time cost of on-site computation and transmitting
the output to the trusted node. Let $T^{(k)}_{\text{comm.}}$ be the
communication overhead between the trusted zone and distributed processing
nodes during the execution period, the time cost over $I_{k}$ is given by,

$T^{(k)}_{\text{exe}}=T^{(k)}_{\text{compt.}}+T^{(k)}_{\text{comm.}}$ (14)

where $T^{(k)}_{\text{comm.}}=\frac{size(Y_{e,k})}{b_{k}}$ and the processing
time mainly depends on the performance of $I_{k}$ and the complexity of the
deployed service, i.e., $T^{(k)}_{\text{compt.}}=\text{perf}_{k}(r_{k})$.
Hence, the total time cost of the application over untrusted servers can be,

$T_{\text{tot}}=\max(T^{(k)}_{d}+T^{(k)}_{\text{compt.}}+T^{(k)}_{\text{comm.}})$
(15)

Note that the processing time $T^{(k)}_{\text{compt.}}$ typically far
outweighs the communication time $T^{(k)}_{\text{comm.}}$ due to the far
smaller size of output $Y_{e,k}$ than that of input $D_{e,k}$. Thus
$T^{(k)}_{\text{comm.}}$ in the processing period is negligible.

####  IV-A4 Pricing Model

Let $p$ be the unit prices of $\mathcal{I}$, in which we consider commercial
CSPs provide $\mathcal{I}_{c}$ with a pay-as-you-go pricing model and
participating organizations offer $\mathcal{I}_{\mathcal{N_{I}}\setminus c}$
for free. For untrusted nodes, the total monetary cost is,

$\text{Cost}=\sum_{k=1}^{K}(T^{(k)}_{\text{d}}+T^{(k)}_{\text{exe}})\times
p_{k}$ (16)

where if $k\in\mathcal{I}_{c}$, then $p_{k}\in R^{+}$; otherwise, $p_{k}=0$.

###  IV-B Problem Formulation

We aim to reduce the total number of distributed processing nodes $f_{1}$, the
total monetary cost $f_{2}$, and the maximum completion time over untrusted
nodes $f_{3}$ under privacy, budget, and time constraints for the application
deployment and execution, that requires MOO. Therefore, our service allocation
problem is formulated as follows:

$\displaystyle\min f_{1}=$ $\displaystyle\sum_{k=1}^{\mathcal{N_{I}}}x_{k}$
(17) $\displaystyle\min f_{2}=$
$\displaystyle\sum_{k=1}^{\mathcal{N_{I}}}(T^{(k)}_{\text{d}}+T^{(k)}_{\text{exe}})\times
p_{k}\times x_{k}$ (18) $\displaystyle\begin{split}\min
f_{3}=&\max((T^{(k)}_{d}+T^{(k)}_{\text{compt.}}+T^{(k)}_{\text{comm.}})\times
x_{k})\end{split}$ (19) subject to, $\displaystyle\chi(\mathcal{D})\leq
f_{1}\leq\text{{Nodes}},$ (20) $\displaystyle\quad\quad 0\leq$ $\displaystyle
f_{2}\leq\text{{Budget}},$ (21) $\displaystyle\quad 0<$ $\displaystyle
f_{3}\leq\text{{Time Threshold}},$ (22) $\displaystyle x_{k}=$
$\displaystyle\begin{cases}1,\text{if service $m_{\text{inf}}$ maps to
}I_{k},\\\ 0,\text{otherwise}.\end{cases}$ (23)

where the total number of distributed processing nodes $f_{1}$ is limited to
the privacy-preserving data splitting method and the maximum available
resource nodes. The total monetary cost $f_{2}$ is limited to the user budget,
and the maximum completion time $f_{3}$ is constrained by the user-defined
time threshold.

##  V Our Solution: A Two-phase Approach

This section explains our method to address the formulated problem with two
phases: i) privacy mechanism design and ii) greedy Pareto frontier-based
service allocation, respectively.

###  V-A Phase I: Privacy mechanism design

Phase I solves the privacy-preserving data splitting problem with image
splitting and data perturbation techniques into two steps: (i) First it
greedily assigns (based on graph theory) the available colors to vertices $V$
with a random sequential (RS) strategy [56]; (ii) we adopt the random-value
perturbation technique to hide critical information of image data sets.

Input: WSI dataset $\mathcal{D}$, patch size $b$

Output: $K$, a new coordinate system $A_{e}$, and encoded data sets
$D_{e,1},D_{e,2},...,D_{e,K}$.

1

2Patch set $D\leftarrow$ create_patches($\mathcal{D}$, $b$)

3$G\leftarrow$ create_new_coordinates($D$)

4$\chi(\mathcal{D}),C\leftarrow$ graph_coloring($G$, ‘random_sequential’)

5$D_{x,1},...,D_{x,K}\leftarrow$ divide $D_{x}$ into $\chi(\mathcal{D})$ sub
data sets

6for  _$D_{x,k}\in D_{x,1},...,D_{x,K}$_ do

7 Data matrix $A_{x}$ of size ($n\times m$) $\leftarrow D_{x,k}$

8 $\bar{x}\leftarrow$ mean($A_{x}$)

9 $\sigma\leftarrow$ std($A_{x,i}$)

$A_{x,c}\leftarrow(A_{x}-\bar{x})/\sigma$

// Normalize the data

10

/* Compute the covariance matrix of $A_{x,c}$ */

11 $\Sigma\leftarrow\frac{1}{n-1}A_{x,c}^{T}A_{x,c}$

/* Compute eigenvalues and eigenvectors */

12 $\lambda,\vec{V}\leftarrow$ eig($\Sigma$)

13 $\lambda_{sort},\vec{V}_{sort}\leftarrow$ sort_eig($\lambda$, $\vec{V}$)

14 $\vec{V}_{k}\leftarrow$ first $k$ columns of $\vec{V}_{sort}$

15 $A_{e}\leftarrow A_{x,c}\vec{V}_{k}$

16 $D_{e,i}\leftarrow\text{rename}(D_{x,i},A_{e},r)$

17

Function: sort_eig($\lambda$, $\vec{V}$)

18 $S\leftarrow$ indices that sort $\lambda$ in a descending order

19 $\lambda_{sort}\leftarrow\lambda(S)$

20 $\vec{V}_{sort}\leftarrow\vec{V}(:,S)$

21 return $\lambda_{sort}$, $\vec{V}_{sort}$

Algorithm 1 Privacy mechanism design for large image splitting ☑

At the trusted zone, we first apply a graph to abstract the positions of
patches $D$ created by the code create_patches($\mathcal{D},b$), as described
in Algorithm. 1. Then, we transform the original coordinates with a 2D (x, y)
axis into a new coordinate system (See pseudo code step 1$\to$2).

Let $G=(V,E)$ be a graph extracted from $D$, in which each sliced patch is
expressed as a vertex $\upsilon\in V$. Two vertices $\upsilon$ and $\mu$ of
$V$ such that $(\upsilon,\mu)\in E$ are called to be adjacent. The RS strategy
is a randomized method, in which the vertices of the graph are randomly
ordered for coloring assignment. The problem seeks to find the smallest number
of possible colors, where $C$ is a set of colors, such that:

  1. 1.

$V^{r}$ := a random sequence of vertices of graph $G$;

  2. 2.

For every vertex $\upsilon\in V^{r}$, let $f(\upsilon)$ be the function that
gives $\upsilon$ the smallest possible color;

  3. 3.

For every edge $(\mu,\upsilon)\in E$, $f(\mu)$ and $f(\upsilon)$ are distinct
colors.

We can earn the minimum number of data fragments at this stage with graph
coloring-based data splitting algorithm (step 3). However, the private
attributes $(x,y)_{\text{coord}}$ of split data $D_{x,k}$, i.e., coordinates
are plaintext; attackers may reconstruct the original data once these
attributes are leaked. Hence, we inducted a random data perturbation-based
method to hide such attributes.

To do so, we extract $(x,y)_{\text{coord}}$ as a data matrix $A_{x}$ of size
($n\times m$). After normalization, we compute the covariance matrix of the
normalized matrix $A_{x,c}$, and then computed the eigenvalues $\lambda$ and
eigenvectors $\vec{V}$ so that we can get the top-k eigenvectors $\vec{V}_{k}$
to calculate $A_{e}$. Moreover, we transform the data into a new coordinate
system and encoded into data sets $\\{D_{e,1},D_{e,2},...,D_{e,K}\\}$. The
pseudo code is illustrated from step 6 to step 15 of Algorithm. 1. The
proposed noise addition is efficient for numerical attributes in usability
since noise is added to individual records independently.

###  V-B Phase II: Greedy Pareto Front based Service Allocation

Phase II seeks Pareto optimal solutions to the MOO problem (See section IV-B)
since there are de facto trade-offs among the total number $f_{1}$, the
monetary cost $f_{2}$, and the time cost $f_{3}$ of processing nodes. For
example, when diminishing the total number of processing nodes, in return, the
time cost gains; these two factors together either decrease or increase the
total monetary cost. The reverse is also true: once the processing node number
is increased, the time cost will be reduced because of distributed parallel
computing. Then we have to consider the change of cost, due to unit price.
Such trade-offs are often illustrated graphically by a Pareto front. However,
traditional methods could not be applied to the problem with large amounts of
configurable items because of the significant search space. Thus, we propose a
greedy Pareto front-based algorithm that allows for a more reasonable search
space for performance improvement, as presented in Algorithm 2.

Input: The set of workloads $\Theta$ and cloud instances $\mathcal{I}$

1

Output: Pareto frontier $F_{p}=(F^{S}_{p},F_{p}^{N},F_{p}^{T},F_{p}^{C})$.

2

3Initialize a feasible set $X$

4Initialize an empty Pareto frontier of solutions $F_{p}$

5$S$, $T$, $C\leftarrow$ PF_2D($\Theta,\mathcal{I},\chi(\mathcal{D})$)

6$X\leftarrow\textbf{combos}(S,T,C)$

7$F_{p}\leftarrow\textbf{Paretoset\\_3D}(X,\text{sMax=False)}$

Function: PF_2D($\Theta,\mathcal{I},\chi(\mathcal{D})$)

8

9 Initialize $S$, $T$, $C$

10 for  _$i=0,1,2,...,|\mathcal{D}|-1$_ do

11

12 index = $i\times\chi(\mathcal{D})$

13 $p^{T},p^{C},p^{S}\leftarrow$Pareto_2d(index)

14 add $p^{T},p^{C},p^{S}$ to $S,C,T$

15

16 return $S$, $T$, $C$

Function: comos($S$, $T$, $C$)

17

Nodes $\leftarrow S_{0}^{1}S_{1}^{1}...S_{|\mathcal{D}|-1}^{1}$

// total nodes

18

Times $\leftarrow T_{0}^{1}T_{1}^{1}...T_{|\mathcal{D}|-1}^{1}$

// time combinations

19

Costs $\leftarrow C_{0}^{1}C_{1}^{1}...C_{|\mathcal{D}|-1}^{1}$

// cost combinations

20

21 calculate $f_{1},f_{2},f_{3}$ with equations (17), (18), (19)

22 if  _constraints_ then

// e.g., $f_{1}\leq\text{No},f_{2}\leq budget,f_{3}\leq threshold$

23

24 $x\leftarrow f_{1},f_{2},f_{3}$

25 add feasible solution $x$ into $X$

26

return $X$

Algorithm 2 Greedy Pareto Front based Service Allocation ☑

We first obtain the 2D Pareto front (See step 3) where we set the number of
processing nodes equal $\chi(\mathcal{D})$ for each large image. Then, we
calculate the combinatorial set with the obtained 2D Pareto optimal solutions
(See step 4), which are the feasible (or candidate) solutions as input for
seeking the 3D Pareto front (Step 5). We also set constraints regarding the
maximum distributed processing nodes, time threshold, and cost budget to
filter out unavailable solutions (See steps 16$\to$17$\to$18). And finally, we
figure out the Pareto front based assignment for distributed service
allocation.

##  VI Experiments

###  VI-A Experimental Setup

####  VI-A1 Baseline

To compare different approaches, we simulate each algorithm in a simple yet
realistic way to ensure an accurate representation of their functionality. Our
solution involves two phases, and the output of the first phase affects that
of the second phase. Splitting the image equally to processing nodes is the
simplest way; hence, we set it as the baseline, in which the patch-level
dataset from each WSI is evenly split into sub-datasets. In the second phase,
even though there are many efficient optimization algorithms such as non-
dominated sorting genetic algorithms (NSGAII and NSGAIII), multi-objective
particle swarm optimization (MOPSO), and multi-agent reinforcement learning
(MARL) [57] for MOO problem-solving, none of them has been applied to the same
research question. Thus, comparing with different optimization algorithms in
the second phase is out of the scope of this work, and we focus on data
splitting and its influence on the final results.

####  VI-A2 Use Case

We adopted a WSI preprocessing application using a DL-based method [58] as our
case study to test our methodology. Their method uses an ensemble of five
MobileNet_v3_Large [59] architectures trained for different tasks with a
central unit.

Real data. Table. I presents the data characteristics, incl., digital slide
size, the total number of patches, and data set size, from a public WSI data
materials called TCGA444 https://www.cancer.gov/ccg/research/genome-
sequencing/tcga for experiments. Besides, the complexity of the DL inference
model has been measured by parameters, MFLOPs, patch size, and memory. We have
five such inference models. The total number of parameters and FLOPs account
for approximately 17.65 million and 1.13 GFLOPs, respectively.

TABLE I: The dataset selected for testing. We randomly retrieved ten WSIs from NIH GDC Data Portal – The Cancer Genome Atlas Program (TCGA) data repository (https://portal.gdc.cancer.gov/repository/).  No | Name
---|---
I | TCGA-A7-A0D9-01Z
II | TCGA-A7-A3IZ-01Z
III | TCGA-E9-A1N3-01Z
IV | TCGA-AC-A2FB-01Z
V | TCGA-AC-A2FE-01Z
VI | TCGA-B6-A0IJ-01Z
VII | TCGA-E9-A1NE-01Z
VIII | TCGA-E9-A1QZ-01Z
IX | TCGA-E9-A1R3-01Z
X | TCGA-E9-A1R4-01Z

Figure 3: An overview of the visual results obtained by privacy-preserving data splitting. The three mini-pages of the figure, which are originally from the testing data No.II A7-A3IZ, are: thumbnail (top left), binary mask (bottom left) and data splitting results (right) on the basis of graph coloring. TABLE II: Comparisons of our approach with the baseline method in terms of the privacy-preserving data splitting. Method | No. Of sub-datasets | Output utility ($\uparrow$) | Lower bound on individual privacy ($\downarrow$) | Average information gain ($\uparrow$)
---|---|---|---|---
$x\\_coord$ | $y\\_coord$ | $x\\_coord$ | $y\\_coord$ | $x\\_coord$ | $y\\_coord$
Baseline | 5 | 1.0$\pm$0.0 | 1.0$\pm$0.0 | 0.1714$\pm$0.0386 | 0.2876$\pm$0.0332 | 3.3099 | 3.7033
Our approach | 5 | 1.0$\pm$0.0 | 1.0$\pm$0.0 |  0.1520$\pm$0.1089 |  0.1147$\pm$0.0744 | 3.7941 | 4.1970

Simulated data. We also evaluated our approach with simulated data. The
benefits of simulated data are two-fold: (i) we have ground truth values for
all parameters to estimate how preferable the deployment and execution
strategies are in HCs, and (ii) we can control compute capacity, locations,
and bandwidth for example to study their impact on the performance of privacy-
preserving distribution data processing. To do so, we selected a set of
geographically distributed GPU nodes from participating universities and CSP’s
on-demanding cloud resources555Example of commercial Cloud Infrastructure
offering GPU servers. https://console2.fluidstack.io/virtual-machines
Retrieved 14 July 2023.. We investigated the relative performance among 29 GPU
servers based on TPU review data666GPU Database–TechPowerUp.
https://www.techpowerup.com/gpu-specs/ Retrieved 14 July 2023. and tested over
a remote virtual machine equipped with a Tesla T4 16GB GPU device to get the
performance data. This model of GPU is sufficiently representative of the
others used in HC.

We evaluated the workload’s performance on a remote server equipped with a
Tesla T4 16GB GPU device. The latency was measured by the processing time
(seconds), and the throughput was given by No. Of patches/latency (patches per
second). The observed maximum throughput $txt=200$ was set as our performance
parameter for simulation experiments. We set various bandwidths with different
geo-locations; for example, the network throughput from different cities was
referred to as the fixed upload Internet speeds provided by SpeedTest by
Ookla777Example of Amsterdam Fixed Speeds.
https://www.speedtest.net/performance/netherlands/north-holland/amsterdam
Retrieved 7 September 2023.

###  VI-B Experiments

We conducted two experiments. (i) Our first experiment addresses the privacy-
preserving data splitting problem by comparing the baseline, i.e., average
data splitting, with graph-based randomized data splitting extensions. We use
one real data set containing 10 WSIs and key metrics (See in section III) to
evaluate the robustness of the data splitting approaches. (ii) Our second
experiment addresses the service deployment optimization problem formulated as
the MOO by comparing the Pareto frontier or Pareto optimal solutions of our
approach and that from evenly data splitting. We use the simulated dataset to
evaluate the performance of the algorithms. We report the results of the
proposed approach considering privacy, budget, and time constraints and Pareto
dominance.

###  VI-C Implementation

The algorithms and experiments were implemented and evaluated based on the DP
case study with a virtual environment, in which we used Python 3.9.16, Pandas
1.5.3, Numpy 1.22.3, Numba 0.57.1, pareto_2d, pareto_3d, complemented with
Pytorch 1.13.1 and NetworkX 3.0 libraries. To validate the average information
gain, output utility, and individual privacy on lower bound, we ran real data
experiments and used the SciPy and sklearn python libraries to calculate the
Shannon entropy and estimate the normalized mutual information (NMI) with the
measurements entropy888Entropy.
https://docs.scipy.org/doc/scipy/reference/generated/scipy.stats.entropy.html
Retrieved 7 September 2023. and normalized_mutual_info_score999Normalized
mutual information. https://scikit-
learn.org/stable/modules/generated/sklearn.metrics.normalized_mutual_info_score.html
Retrieved 7 September 2023., respectively. During the experiment, we use a
trusted machine with Apple M1/Intel mode, 16GB of RAM, and 2TB Solid State USB
Drive Storage to run the use case and simulation experiments.

##  VII Results and Evaluations

###  VII-A Performance of Privacy Preservation

Fig 3 provides visual results of a WSI obtained by our proposed privacy-
preserving data splitting. We first removed the background of the original
data to generate a binary mask and then created some patches of size (224,
224, 3) from the WSI. Based on the coordinates of patches, we built a graph to
split the patches into different patch-level sub-datasets and marked them
using the ‘Viridis’ color scale. Each color (e.g., yellow, green, dark green,
blue, and dark blue) in the graph (the right picture) indicates a single data
set that will be stored at an individual processing node, respectively.

Table II lists the measurement about the output utility, individual privacy
(lower bound), and the average information gain on the real dataset in
comparisons of the baseline and our approach. The average data splitting can
still reach a perfect output utility combined with our data perturbation
procedure. However, our approach can achieve lower mean individual privacy by
increasing the uncertainty of split data sizes. That is, even though
$\mathcal{N}-1$ nodes in the untrusted zone were corrupted, revealing private
data to the adversaries, the amount of information about the private data
learned by the adversaries over the remaining node of our approach is still
less than the baseline method. Besides, our average information gain is bigger
than that of the baseline. Hence, our privacy-preserving algorithm is more
robust than the baseline method.

###  VII-B Quality of the Pareto Fronts

Fig. 4 shows an example of the Pareto front obtained by our approach, in which
it contains six Pareto optimal solutions $\text{Pfdata}[0-5]$ under user
predefined constraints, i.e., the maximum number of untrusted processing nodes
(No), budget, and time cost over untrusted nodes. The Pareto optimal solutions
form a shell of a polygon covering all non-Pareto optimal values. Each
solution is equivalent in the Pareto set. Table III lists the comparisons of
several Pareto optimal solutions collected from various user preference
settings, such as “Normal”, “Very Small Number (VSN)”, “Very Tight Budget
(VTB)”, “Very Short Time (VST)”. For instance, Fig. 4 is a mapping of VTB user
preference.

TABLE III: Comparisons of our approach with the baseline method in terms of the Pareto optimal-based service allocation. User Preferences | Nodes | Budget | Time Threshold | Baseline | Our Approach
---|---|---|---|---|---
$f_{1}(\downarrow)$ | $f_{2}(\downarrow)$ | $f_{3}(\downarrow)$ | $f_{1}(\downarrow)$ | $f_{2}(\downarrow)$ | $f_{3}(\downarrow)$
Normal | 8 | 0.1 | 800 | 7 | 0.084264 | 797.981 | 6 | 0.033261 | 743.688
Very Small No. Of nodes (VSN) | 5 | 0.2 | 1200 | 5 | 0.049659 | 1060.841 | 5 | 0.007348 | 1029.702
Very Tight Budget (VTB) | 8 | 0.01 | 1200 | N/A | N/A | N/A | 6 | 0.008859 | 1004.384
Very Short Time (VST) | 8 | 0.2 | 560 | 7 | 0.118831 | 535.345 | N/A | N/A | N/A
Figure 4: A Pareto front obtained by our approach with constraints, i.e.,
Nodes=8, Budget=0.01, Time Threshold=1200.

As listed in Table III, our solution can entirely dominate the baseline’s
solution for usual user preference since it has fewer untrusted nodes, less
total monetary cost, and fewer time costs. Besides, for the VSN preference,
our approach performs better than the baseline regarding the monetary and time
costs. Specifically, our approach has been ahead of baseline by 60.53% and
6.8% (See “Normal”), 85.2% and 2.94% (See “VSN”) in terms of the total
financial cost ($f_{2}$) and time cost ($f_{3}$), respectively. Furthermore,
our approach can also support a very tight budget in the inapplicable cases of
the baseline (See “VTB”). However, assuming the application is very time-
critical (See “VST”), our approach may not be available.

###  VII-C Limitations and Scope

Even though we have successfully obtained the Pareto optimal based service
allocation results for our research problem, we encountered certain
limitations and setbacks. First, the communication overhead has been simply
predicted by network throughput and request size. This setting limits the
network uncertainties and complexities. There do exist communication
complexities, such as uncertainty of worldwide network latency, diverse
bandwidth under SLA constraints, and firewall configurations. Besides, for big
data processing, there will be several performance bottlenecks regarding the
network throughput between the trusted zone and untrusted zone. Further
studies should consider such complexities to obtain a more accurate
representation of realistic applications. Second, the performance benchmark is
still missing, even though we estimated the time using the inference
processing time, throughput, and relative performance data. However, since our
focus is mainly on the MOO decision-making based on input data, the quality of
performance benchmark data will determine that of decision-making. The results
would be more reliable for users if we could obtain a powerful benchmarking
data set. Third, our solution is not applicable for the cases of very time-
critical in the simulation experiments. The main reason could be the
unbalanced data size increases the heterogeneity of the workloads compared to
homogeneous workloads of the baseline.

##  VIII Conclusion

In this paper, we focus on customizing a virtual infrastructure and scheduling
the large image processing workflow in a distributed and privacy-preserving
way. We formulated the problem statement as a privacy-, cost-, and time-aware
service allocation optimization problem in HCs for large medical image
processing. To address it, we proposed a two-phase approach: (1) a novel
privacy mechanism design was implemented to preserve sensitive attributes from
the architecture structure and perturbative masking perspectives, and (2) a
greedy Pareto front-based algorithm to solve the MOO service allocation under
privacy, budget, and time requirements. Our study bridges the gap in this
field and demonstrates the problem-solving and evaluation process. At the key
aspects of privacy evaluation, our approach outperforms the baseline method
regarding the average individual privacy at the lower bound and average
information gain. Moreover, our Pareto optimal solutions are superior to the
baseline on very tight budget cases. In the majority of cases, they can
entirely dominate the baseline solutions. In the future, we will improve the
quality of solutions and integrate our approach as a component of a Jupyter-
based virtual research environment.

## Author Contributions

Yuandou Wang: Conceptualization of this study, Methodology, Investigation,
Writing - Original draft preparation, Writing - Review & Editing. Neel Kanwal:
Provide the preprocessing pipeline for detecting artifacts in whole slide
images that can be ran over a single GPU server, Investigate the related work
on privacy-preserving techniques and image processing, WSI Data collection,
Writing - Review & Editing. Engan Kjersti: Writing - Review & Editing,
Supervision. Chunming Rong: Conceptualization, Writing - Review. Paola Grosso:
Conceptualization, Writing - Review & Editing, Supervision. Zhiming Zhao:
Conceptualization, Writing - Review & Editing, Supervision, Project
administration, Funding acquisition.

## References

  * [1] N. Kanwal, F. Pérez-Bueno, A. Schmidt, R. Molina, and K. Engan, “The devil is in the details: Whole slide image acquisition and processing for artifacts detection, color variation, and data augmentation. a review.” _IEEE Access_ , 2022.
  * [2] N. Kanwal, T. Eftestøl, F. Khoraminia, T. C. Zuiverloon, and K. Engan, “Vision transformers for small histological datasets learned through knowledge distillation,” in _Pacific-Asia Conference on Knowledge Discovery and Data Mining_. Springer, 2023, pp. 167–179.
  * [3] T. Kurc, X. Qi, D. Wang, F. Wang, G. Teodoro, L. Cooper, M. Nalisnik, L. Yang, J. Saltz, and D. J. Foran, “Scalable analysis of big pathology image data cohorts using efficient methods and high-performance computing strategies,” _BMC bioinformatics_ , vol. 16, no. 1, pp. 1–21, 2015.
  * [4] J. Domingo-Ferrer, O. Farras, J. Ribes-González, and D. Sánchez, “Privacy-preserving cloud computing on sensitive data: A survey of methods, products and challenges,” _Computer Communications_ , vol. 140, pp. 38–60, 2019.
  * [5] N. Truong, K. Sun, S. Wang, F. Guitton, and Y. Guo, “Privacy preservation in federated learning: An insightful survey from the gdpr perspective,” _Computers & Security_, vol. 110, p. 102402, 2021.
  * [6] Y. Wang, N. Kanwal, K. Engan, C. Rong, and Z. Zhao, “Towards a privacy-preserving distributed cloud service for preprocessing very large medical images,” in _2023 IEEE International Conference on Digital Health (ICDH)_. IEEE, 2023, pp. 325–327.
  * [7] O. Mazhelis and P. Tyrväinen, “Economic aspects of hybrid cloud infrastructure: User organization perspective,” _Information Systems Frontiers_ , vol. 14, pp. 845–869, 2012.
  * [8] J. Weinman, “Hybrid cloud economics,” _IEEE Cloud Computing_ , vol. 3, no. 1, pp. 18–22, 2016.
  * [9] G. Aryotejo, D. Y. Kristiyanto _et al._ , “Hybrid cloud: bridging of private and public cloud computing,” in _Journal of Physics: Conference Series_ , vol. 1025, no. 1. IOP Publishing, 2018, p. 012091.
  * [10] Y. Wen, J. Liu, W. Dou, X. Xu, B. Cao, and J. Chen, “Scheduling workflows with privacy protection constraints for big data applications on cloud,” _Future Generation Computer Systems_ , vol. 108, pp. 1084–1091, 2020.
  * [11] S. Sharif, P. Watson, J. Taheri, S. Nepal, and A. Y. Zomaya, “Privacy-aware scheduling saas in high performance computing environments,” _IEEE Transactions on Parallel and Distributed Systems_ , vol. 28, no. 4, pp. 1176–1188, 2016.
  * [12] A. C. Zhou, Y. Xiao, Y. Gong, B. He, J. Zhai, and R. Mao, “Privacy regulation aware process mapping in geo-distributed cloud data centers,” _IEEE Transactions on Parallel and Distributed Systems_ , vol. 30, no. 8, pp. 1872–1888, 2019.
  * [13] J. Lei, Q. Wu, and J. Xu, “Privacy and security-aware workflow scheduling in a hybrid cloud,” _Future Generation Computer Systems_ , vol. 131, pp. 269–278, 2022.
  * [14] B. Singh, A. Singh, and D. Singh, “A Survey of Cryptographic and Non-cryptographic Techniques for Privacy Preservation,” _International Journal of Computer Applications_ , vol. 130, no. 13, pp. 7–10, 2015.
  * [15] C. Dwork, A. Roth _et al._ , “The algorithmic foundations of differential privacy,” _Foundations and Trends® in Theoretical Computer Science_ , vol. 9, no. 3–4, pp. 211–407, 2014.
  * [16] R. Cramer, I. B. Damgård _et al._ , _Secure multiparty computation_. Cambridge University Press, 2015.
  * [17] R. L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining digital signatures and public-key cryptosystems,” _Communications of the ACM_ , vol. 21, no. 2, pp. 120–126, 1978.
  * [18] C. Gentry, “Fully homomorphic encryption using ideal lattices,” in _Proceedings of the forty-first annual ACM symposium on Theory of computing_ , 2009, pp. 169–178.
  * [19] V. Goyal, O. Pandey, A. Sahai, and B. Waters, “Attribute-based encryption for fine-grained access control of encrypted data,” in _Proceedings of the 13th ACM conference on Computer and communications security_ , 2006, pp. 89–98.
  * [20] R. Zhang, R. Xue, and L. Liu, “Searchable encryption for healthcare clouds: A survey,” _IEEE Transactions on Services Computing_ , vol. 11, no. 6, pp. 978–996, 2017.
  * [21] J. Zhou, Z. Cao, X. Dong, and A. V. Vasilakos, “Security and privacy for cloud-based iot: Challenges,” _IEEE Communications Magazine_ , vol. 55, no. 1, pp. 26–33, 2017.
  * [22] M. A. P. Chamikara, P. Bertok, I. Khalil, D. Liu, and S. Camtepe, “Privacy preserving distributed machine learning with federated learning,” _Computer Communications_ , vol. 171, pp. 112–125, 2021.
  * [23] Q. Li, J. S. Gundersen, R. Heusdens, and M. G. Christensen, “Privacy-preserving distributed processing: metrics, bounds and algorithms,” _IEEE Transactions on Information Forensics and Security_ , vol. 16, pp. 2090–2103, 2021.
  * [24] S. Vadhan, “The complexity of differential privacy,” _Tutorials on the Foundations of Cryptography: Dedicated to Oded Goldreich_ , pp. 347–450, 2017.
  * [25] E. Boyle, A. Jain, M. Prabhakaran, and C.-H. Yu, “The bottleneck complexity of secure multiparty computation,” in _45th International Colloquium on Automata, Languages, and Programming (ICALP 2018)_. Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik, 2018.
  * [26] D. Chakarov and Y. Papazov, “Evaluation of the complexity of fully homomorphic encryption schemes in implementations of programs,” in _Proceedings of the 20th International Conference on Computer Systems and Technologies_ , 2019, pp. 62–67.
  * [27] W. Jung, E. Lee, S. Kim, N. Kim, K. Lee, C. Min, J. H. Cheon, and J. H. Ahn, “Accelerating fully homomorphic encryption through microarchitecture-aware analysis and optimization,” in _2021 IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS)_. IEEE, 2021, pp. 237–239.
  * [28] R. S. Sandhu and P. Samarati, “Access control: principle and practice,” _IEEE communications magazine_ , vol. 32, no. 9, pp. 40–48, 1994.
  * [29] T. Neubauer and J. Heurix, “A methodology for the pseudonymization of medical data,” _International journal of medical informatics_ , vol. 80, no. 3, pp. 190–204, 2011.
  * [30] R. J. Bayardo and R. Agrawal, “Data privacy through optimal k-anonymization,” in _21st International conference on data engineering (ICDE’05)_. IEEE, 2005, pp. 217–228.
  * [31] O. Farràs, J. Ribes-González, and S. Ricci, “Privacy-preserving data splitting: a combinatorial approach,” _Designs, Codes and Cryptography_ , vol. 89, no. 7, pp. 1735–1756, 2021.
  * [32] G. A. Kaissis, M. R. Makowski, D. Rückert, and R. F. Braren, “Secure, privacy-preserving and federated machine learning in medical imaging,” _Nature Machine Intelligence_ , vol. 2, no. 6, pp. 305–311, 2020.
  * [33] S. Vijayarani and A. Tamilarasi, “An efficient masking technique for sensitive data protection,” in _2011 International Conference on Recent Trends in Information Technology (ICRTIT)_. IEEE, 2011, pp. 1245–1249.
  * [34] R. Brand, “Microdata protection through noise addition,” _Inference Control in Statistical Databases: From Theory to Practice_ , pp. 97–116, 2002.
  * [35] H. Kargupta, S. Datta, Q. Wang, and K. Sivakumar, “Random-data perturbation techniques and privacy-preserving data mining,” _Knowledge and Information Systems_ , vol. 7, pp. 387–414, 2005.
  * [36] M. Rodriguez-Garcia, M. Batet, and D. Sánchez, “Utility-preserving privacy protection of nominal data sets via semantic rank swapping,” _Information Fusion_ , vol. 45, pp. 282–295, 2019.
  * [37] K. Muralidhar and R. Sarathy, “Data shuffling—a new masking approach for numerical data,” _Management Science_ , vol. 52, no. 5, pp. 658–670, 2006.
  * [38] J. Domingo-Ferrer and V. Torra, “Ordinal, continuous and heterogeneous k-anonymity through microaggregation,” _Data Mining and Knowledge Discovery_ , vol. 11, pp. 195–212, 2005.
  * [39] P. Samarati and L. Sweeney, “Protecting privacy when disclosing information: k-anonymity and its enforcement through generalization and suppression,” 1998.
  * [40] A. Machanavajjhala, D. Kifer, J. Gehrke, and M. Venkitasubramaniam, “l-diversity: Privacy beyond k-anonymity,” _ACM Transactions on Knowledge Discovery from Data (TKDD)_ , vol. 1, no. 1, pp. 3–es, 2007.
  * [41] N. Li, T. Li, and S. Venkatasubramanian, “t-closeness: Privacy beyond k-anonymity and l-diversity,” in _2007 IEEE 23rd international conference on data engineering_. IEEE, 2006, pp. 106–115.
  * [42] S. R. Ganta, S. P. Kasiviswanathan, and A. Smith, “Composition attacks and auxiliary information in data privacy,” in _Proceedings of the 14th ACM SIGKDD international conference on Knowledge discovery and data mining_ , 2008, pp. 265–273.
  * [43] R. C.-W. Wong, A. W.-C. Fu, K. Wang, P. S. Yu, and J. Pei, “Can the utility of anonymized data be used for privacy breaches?” _ACM Transactions on Knowledge Discovery from Data (TKDD)_ , vol. 5, no. 3, pp. 1–24, 2011.
  * [44] L. Zhang, S. Jajodia, and A. Brodsky, “Information disclosure under realistic assumptions: Privacy versus optimality,” in _Proceedings of the 14th ACM conference on Computer and communications security_ , 2007, pp. 573–583.
  * [45] D. Sánchez and M. Batet, “Privacy-preserving data outsourcing in the cloud via semantic data splitting,” _Computer Communications_ , vol. 110, pp. 187–201, 2017.
  * [46] O. Goldreich, _Foundations of cryptography: volume 2, basic applications_. Cambridge university press, 2009.
  * [47] S. Pawar, S. El Rouayheb, and K. Ramchandran, “Securing dynamic distributed storage systems against eavesdropping and adversarial attacks,” _IEEE Transactions on Information Theory_ , vol. 57, no. 10, pp. 6734–6753, 2011.
  * [48] L. Sankar, S. R. Rajagopalan, and H. V. Poor, “Utility-privacy tradeoffs in databases: An information-theoretic approach,” _IEEE Transactions on Information Forensics and Security_ , vol. 8, no. 6, pp. 838–852, 2013.
  * [49] Y. Lindell and B. Pinkas, “Privacy preserving data mining,” in _Annual International Cryptology Conference_. Springer, 2000, pp. 36–54.
  * [50] C. E. Shannon, “A mathematical theory of communication,” _The Bell system technical journal_ , vol. 27, no. 3, pp. 379–423, 1948.
  * [51] J. Lin, “Divergence measures based on the shannon entropy,” _IEEE Transactions on Information theory_ , vol. 37, no. 1, pp. 145–151, 1991.
  * [52] A. Kraskov, H. Stögbauer, and P. Grassberger, “Estimating mutual information,” _Physical review E_ , vol. 69, no. 6, p. 066138, 2004.
  * [53] R. T. Marler and J. S. Arora, “Survey of multi-objective optimization methods for engineering,” _Structural and multidisciplinary optimization_ , vol. 26, pp. 369–395, 2004.
  * [54] S. Brisset and F. Gillon, “Approaches for multi-objective optimization in the ecodesign of electric systems,” _Eco-friendly innovation in electricity transmission and distribution networks_ , pp. 83–97, 2015.
  * [55] Y. Hu, J. Wang, H. Zhou, P. Martin, A. Taal, C. De Laat, and Z. Zhao, “Deadline-aware deployment for time critical applications in clouds,” in _Euro-Par 2017: Parallel Processing: 23rd International Conference on Parallel and Distributed Computing, Santiago de Compostela, Spain, August 28–September 1, 2017, Proceedings 23_. Springer, 2017, pp. 345–357.
  * [56] A. Kosowski and K. Manuszewski, “Classical coloring of graphs,” _Contemporary Mathematics_ , vol. 352, pp. 1–20, 2004.
  * [57] Y. Wang, H. Liu, W. Zheng, Y. Xia, Y. Li, P. Chen, K. Guo, and H. Xie, “Multi-objective workflow scheduling with deep-q-network-based multi-agent reinforcement learning,” _IEEE access_ , vol. 7, pp. 39 974–39 982, 2019.
  * [58] N. Kanwal, S. Fuster, F. Khoraminia, T. C. Zuiverloon, C. Rong, and K. Engan, “Quantifying the effect of color processing on blood and damaged tissue detection in whole slide images,” in _2022 IEEE 14th Image, Video, and Multidimensional Signal Processing Workshop (IVMSP)_. IEEE, 2022, pp. 1–5.
  * [59] A. Howard, M. Sandler, G. Chu, L.-C. Chen, B. Chen, M. Tan, W. Wang, Y. Zhu, R. Pang, V. Vasudevan _et al._ , “Searching for mobilenetv3,” in _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , 2019, pp. 1314–1324.


# Efficient passive membership inference attack in federated learning

Oualid Zari
Inria, Univ. Côte d’Azur,
Sophia Antipolis, France
Chuan Xu
Univ. Côte d’Azur, Inria, CNRS, I3S
Sophia Antipolis, France
Giovanni Neglia
Inria, Univ. Côte d’Azur
Sophia Antipolis, France
<EMAIL_ADDRESS>

###### Abstract

In cross-device federated learning (FL) setting, clients such as mobiles
cooperate with the server to train a global machine learning model, while
maintaining their data locally. However, recent work shows that client’s
private information can still be disclosed to an adversary who just eavesdrops
the messages exchanged between the client and the server. For example, the
adversary can infer whether the client owns a specific data instance, which is
called a passive membership inference attack [9]. In this paper, we propose a
new passive inference attack that requires much less computation power and
memory than existing methods. Our empirical results show that our attack
achieves a higher accuracy on CIFAR100 dataset (more than $4$ percentage
points) with three orders of magnitude less memory space and five orders of
magnitude less calculations.

##  1 Introduction

In recent years, it has been demonstrated that a machine learning model is
vulnerable to different attacks, e.g., membership inference attacks [10, 12],
model inversion attacks [3], attribute inference attacks [5], and property
inference attacks [2], which leak sensitive information present in the
training dataset. The performance of these attacks depend on various factors,
such as the complexity of the trained model (and then its propensity to
overfit the data) [12] and the adversary’s capabilities [10], including the
adversary’s access to auxiliary information, like a dataset statistically
similar to the client’s training one [11].

Federated learning (FL) [7] allows clients to participate to training without
sharing their local data, but the iterative exchange of models between clients
and the orchestrator can disclose additional private information. For
instance, an adversary who has access to the mini-batch gradients computed on
the client’s local dataset may recover some data instances at the client [13,
18, 17, 4, 15], e.g., it can reconstruct up to $97.3\%$ of a client’s images
to a recognizable level [15]. The adversary can also detect when new samples
with a certain property (even unrelated to the learning task) are added during
training to the the client’s local dataset [8].111Leaking this information is
dangerous, for example the adversary may infer when a person starts visiting a
special type of doctor. Finally, the adversary can exploit the FL model
exchanges to perform advanced _client-level membership inference attacks_ [9,
16]. As a consequence, when hospitals participate to the FL process (an
increasingly popular FL use case), the adversary may infer whether a patient
has visited a particular hospital.

In this paper, we a consider a _passive_ attacker who does not interfere with
the FL training process and only eavesdrops the exchanged messages. This
attacker is also called _honest-but-curious_ and _passive global attacker_ in
[9]. We show how the adversary may perform the membership inference attack
with much less computational load (five orders of magnitude) and memory space
(two/three orders of magnitude) than the state-of-the-art procedure proposed
in [9]. Moreover, the proposed attack can be easily adapted to the case when
the auxiliary dataset only contains incomplete records (e.g., labels are
missing).

##  2 Background: Passive membership inference attack for FL

#### Federated learning

In a cross-device federated learning setting, the clients (e.g., mobiles or
IoT devices) cooperate with the server to train a global ML model
$\theta\in\mathbb{R}^{d}$, which minimizes the following (weighted) empirical
risk over all the data owned by clients:

$\min_{\theta\in\mathbb{R}^{d}}{\mathcal{L}}(\theta)=\sum_{c\in{\mathcal{C}}}p_{c}{\mathcal{L}_{c}}(\theta)=\sum_{c\in{\mathcal{C}}}p_{c}\left(\frac{1}{|{\mathcal{D}}_{c}|}\sum_{(x,y)\in{\mathcal{D}}_{c}}\ell(\theta,x,y)\right),$

where ${\mathcal{C}}$ denotes the set of clients and ${\mathcal{D}}_{c}$ the
local dataset of client $c\in{\mathcal{C}}$ with size $|{\mathcal{D}}_{c}|$,
$(x,y)\in{\mathcal{D}}_{c}$ is a sample consisting of an input object $x$ and
its associated label $y$, $\ell(\theta,x,y)$ measures the loss of the model on
the sample and $p_{c}$ is the positive weight of client $c$, s.t.
$\sum_{c\in{\mathcal{C}}}p_{c}=1$. To accomplish the above learning task, many
distributed learning algorithms were proposed [7, 6] with FedAvg [7, Algo. 1]
being the earliest and the most popular one, which we also consider in this
paper. Shortly, at each communication round $t$, the selected client $c$
receives the global model $\theta^{t}$ from the server, updates the model
following some local stochastic gradient descent updates on its dataset
${\mathcal{D}}_{c}$ and sends this updated model $\theta_{c}^{t}$ back to the
server, who averages all the received models.

#### Adversary capabilities

The adversary targets a specific client $c$ and trains an _attack model_
(often a neural network) to infer whether a data point belongs to the _target
dataset_ ${\mathcal{D}}_{c}$ [3, 12, 9]. To this purpose, the adversary needs
an auxiliary dataset ${\mathcal{D}}_{a}$. As in [9], the auxiliary dataset
contains both points which do and do not belong to the target dataset (called
respectively _member_ and _non-member_ points), i.e.,
${\mathcal{D}}_{a}\cap{\mathcal{D}}_{c}\not=\emptyset$ and
${\mathcal{D}}_{a}\backslash{\mathcal{D}}_{c}\not=\emptyset$. The samples in
${\mathcal{D}}_{a}\backslash{\mathcal{D}}_{c}$ are generated from the same
distribution of ${\mathcal{D}}_{c}$. In the FL setting, it is natural to
assume that the adversary knows the architecture of the model under training,
and this information is indeed needed by the attack proposed in [9]. Our
attack could instead work under a black-box model [3], where the adversary can
query the targeted models with any input and receive the corresponding output
(e.g., the score vector for classification problems).

#### Attack strategy for classification [9]

In [9], the authors consider $m$-ary classification problems. During training
the adversary collects the models updated by $c$ at specific time instances in
the set $\mathcal{T}$. The collected models
$\Theta_{c}=\\{\theta_{c}^{t},t\in\mathcal{T}\\}$ are called the _target
models_.

Since the adversary knows the architecture of target models $\Theta_{c}$, for
every data sample $(x,y)\in{\mathcal{D}}_{a}$, it can compute the
corresponding gradients by back-propagation, i.e.,
$\\{\partial\ell(\theta,x,y),\forall\theta\in\Theta_{c}\\}$. Besides, it can
access the loss values $\\{\ell(\theta,x,y),\forall\theta\in\Theta_{c}\\}$ and
per-layer output values (including the last-layer output which is the
prediction vector), i.e., $\\{\theta^{[l]}(x)\in\mathbb{R}^{s(l)},\forall
l\in\\{1,...,L\\},\forall\theta\in\Theta_{c}\\}$ where $L$ is the number of
layers in $\theta$ and $s(l)$ denotes the output size of layer $l$. These
values together with a one hot encoding $\mathbf{e}_{y}\in\\{0,1\\}^{m}$ of
the label $y$ constitute the input $\mathcal{I}(x,y)$ to a convolutional
neural network $\omega$ used for membership inference prediction. The network
is trained on $\\{\mathcal{I}(x,y),\forall(x,y)\in{\mathcal{D}}_{a}\\}$ by
minimizing the mean square loss.

Note that the size of $\mathcal{I}(x,y)$ is
$(d+1+\sum_{l=1}^{L}s(l))\times|\mathcal{T}|+m$, which is extremely large for
deep neural networks. For instance, when training the ResNet-110 in [9], even
when the authors consider only the last four layers’ gradients and last three
layers’ outputs in $\mathcal{I}(x,y)$, there are still more than 1.6 million
parameters for each target model. Correspondingly, the neural network $\omega$
needs to be large as well, e.g., the original implementation requires 256
MB.222The open source code is available at https://github.com/SPIN-
UMass/MembershipWhiteboxAttacks/blob/master/ATTACK-ALEXNET-grad_fed_local.py.
In addition, the adversary incurs a high computational load to compute the
$|\mathcal{T}|\times|{\mathcal{D}}_{a}|$ gradients in
$\\{\mathcal{I}(x,y),\forall(x,y)\in{\mathcal{D}}_{a}\\}$, as gradients’ back-
propagation computation is much slower than the forward pass for deep neural
networks. For instance, to achieve the attack on FL training of AlexNet on
CIFAR100, the adversary computes $5\times 20000$ gradients [9, Table XI and
XII], which takes at least 1.5 hours on a NVIDIA GeForce GTX 1050 Ti. 333We
used the optimized per-sample gradient calculation package offered by Opacus
[1].

##  3 Efficient passive membership inference attack

In this section, we propose an efficient passive inference attack for FL which
releases the adversary from the high computational burden and large memory
space requirement. Our attack is depicted in Figure 1.

Figure 1: The procedure of our membership inference attack on federated
learning. $\Theta_{c}$ are the set of target models, ${\mathcal{D}}_{c}$ is
the target dataset, ${\mathcal{D}}_{a}$ is the auxiliary dataset and
$\theta^{L}(x)[y]$ denotes the score of instance $x$ for label $y$.

If the adversary attacks client $c$, it starts by collecting the target models
$\Theta_{c}=\\{\theta_{c}^{t},t\in\mathcal{T}\\}$ exchanged between client $c$
and the server. Then, for every data sample $(x,y)\in{\mathcal{D}}_{a}$, it
computes the score assigned by target models to the correct label $y$ for the
input $x$. The input of the attack model only includes
$\\{\theta^{[L]}(x)[y],\forall\theta\in\Theta_{c}\\}$, where $\alpha[i]$
indicates the $i^{\textrm{th}}$ element in the vector $\alpha$. This choice is
motivated by the empirical observation that the temporal evolutions of true
label scores for members and non-members data points (i.e., those in ) are
easily distinguishable (see Fig. 4 in Appendix). Since target models
corresponds to different time instants in the training process, the input can
be a time series. We choose then as attack model a fully convolutional
network, which is a suited network architecture for classifying time series
[14]. The attack model’s architecture is shown in Fig. 5 in Appendix and it is
trained minimizing the usual cross-entropy loss.

In comparison to the state-of-the-art attack in [9], our approach requires a
much smaller input of size $|\mathcal{T}|$, independently of the size of the
target model. As a result, while experiments in [9] are limited to consider
$5$ target models, because of memory constraints, our attack has not such
limit and can take into account a finer-grained temporal evolution. Also the
attack model architecture in [9] considers the input as a flat vector, while
our architecture is designed to explicitly capture the FL training dynamics,
which may expose more information about data point’s membership.

As most of the related work, we have assumed that samples in the auxiliary
dataset ${\mathcal{D}}_{a}$ consist of input-label pairs, but labels may
contain particularly sensitive information and then be better protected. Our
attack can be easily adapted to deal with the case when the adversary has no
access to labels. Indeed, it is sufficient to replace the attack input
$\theta^{[L]}(x)[y]$ with the entropy of the score vector $\theta^{[L]}(x)$ or
with its maximum value. The size of the attack model’s input does not change,
but one can expect the attack accuracy to decrease as less information is
available to the adversary. This is confirmed by our experiments in Table 2 in
the appendix.

##  4 Experiments

We evaluate our attacks on two datasets: one is CIFAR100 which contains 60,000
images for 100 different classes; the other one is Purchase100 which contains
197,324 shopping records for 600 products with customers clustered into 100
classes on the basis of the similarity of their purchases.

For a fair comparison with the baseline in [9], we consider the same FL
scenario with 4 clients and data distributed uniformly at random among the
clients. The observed epochs are $\mathcal{T}=\\{100,150,200,250,300\\}$ for
the CIFAR100 dataset, and $\mathcal{T}=\\{40,60,80,90,100\\}$ for the
Purchase100 dataset.444 The number of communication rounds and training epochs
coincide, as each client processes one local epoch at each communication
round.  More details on our experimental setup are provided in the appendix.

The attack performance is evaluated in terms of accuracy of membership
inference on a test auxiliary dataset. Table 1 shows that our attack requires
2 to 3 orders of magnitued less memory space (the attack model’s size) and at
least 5 orders of magnitude less computation (Multiply–Accumulate Operations,
MACs). For CIFAR100, the accuracy of our attack is at least $5\%$ higher than
the baseline. Although our attack is less accurate on Purchase100, we can take
advantage of the smaller memory footprint to increase the number of epochs
considered $|\mathcal{T}|$. For example, for $|\mathcal{T}|=30$, the accuracy
of our attack increases to $62.3\%$ with the same memory requirement ($1.06$
MB) and $31$ KMACs, still more than 20,000 times less operations than the
baseline.

Figure 3 shows the the membership inference attack accuracy decreases when
labels are not available, but it is still larger than $75\%$ when the
adversary trains the model over the latest $10$ epochs. The figure also
illustrates client model’s train and test accuracy over time and suggests
that, in the setting considered in [9], the model is overfitting the dataset
and the FL orchestrator may have stopped the training earlier. Intuitively,
overfitting can help the adversary as the model memorizes the training
samples. Table 3 confirms this intuition as the accuracy of both attacks
decreases when training stops earlier. When overfitting is prevented, our
attack is even better than the baseline with up to $11.3\%$ accuracy increase
($6.6$ percentage points) (see Table 3).

Dataset | Model type |  $\theta^{T}$ accuracy | Attack accuracy | Memory (MB) | MACs
---|---|---|---|---|---
Train |  Test |  Ours |  Baseline |  Ours |  Baseline |  Ours |  Baseline
CIFAR100 | AlexNet |  99% |  36% |  89.5% |  85.1% |  1.06 |  1053 |  6.66K |  1.44G
DenseNet |  100% |  55% |  84.2% |  79.2% |  1.06 |  1405 |  6.66K |  1.93G
Purchase100 | Fully connected |  93% |  82% |  60.1% |  72.4% |  1.06 |  527 |  6.66K |  0.72G
Table 1: Performance comparison of our passive membership inference attack
with the baseline [9]. FL training with 4 clients spanning $300$ epochs for
different datasets and model architectures. Attack accuracy is averaged over
all the clients.

Observed Epochs | Attack Accuracy
---|---
Ours | Baseline
5, 10, 15, 20, 25 | 64.0% | 57.4%
10, 20, 30, 40, 50 | 82.2% | 76.5%
50, 100, 150, 200, 250 | 86.4% | 79.5%
100, 150, 200, 250, 300 | 89.5% | 85.1%
Figure 2: Effect of the adversary’s observed epochs on attack accuracy. Four
clients trains AlexNet to classify CIFAR100 dataset.

Figure 3: Attack accuracy and train/test client’s model accuracy over time
$t$. Four clients train AlexNet to classify CIFAR100 dataset. The attack model
is trained with $\mathcal{T}=\\{t-9,t-8,\ldots,t\\}$.

## References

  * [1] Opacus, https://github.com/pytorch/opacus.
  * [2] Giuseppe Ateniese, Luigi V. Mancini, Angelo Spognardi, Antonio Villani, Domenico Vitali, and Giovanni Felici.  Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers.  Int. J. Secur. Netw., 10(3):137–150, September 2015.
  * [3] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart.  Model inversion attacks that exploit confidence information and basic countermeasures.  In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pages 1322–1333, 2015.
  * [4] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller.  Inverting gradients–how easy is it to break privacy in federated learning?  NIPS, 2020.
  * [5] Shiva Prasad Kasiviswanathan, Mark Rudelson, and Adam Smith.  The power of linear reconstruction attacks.  In Proceedings of the twenty-fourth annual ACM-SIAM symposium on Discrete algorithms, pages 1415–1433. SIAM, 2013.
  * [6] Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith.  Federated optimization in heterogeneous networks.  MLSys, 2020.
  * [7] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas.  Communication-efficient learning of deep networks from decentralized data.  In Artificial Intelligence and Statistics, pages 1273–1282. PMLR, 2017.
  * [8] Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov.  Exploiting unintended feature leakage in collaborative learning.  In 2019 IEEE Symposium on Security and Privacy (SP), pages 691–706. IEEE, 2019.
  * [9] Milad Nasr, Reza Shokri, and Amir Houmansadr.  Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning.  In 2019 IEEE Symposium on Security and Privacy (SP), pages 739–753, 2019.
  * [10] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov.  Membership inference attacks against machine learning models.  In 2017 IEEE Symposium on Security and Privacy (SP), pages 3–18. IEEE, 2017.
  * [11] Shakila Mahjabin Tonni, Dinusha Vatsalan, Farhad Farokhi, Dali Kaafar, Zhigang Lu, and Gioacchino Tangari.  Data and model dependencies of membership inference attack.  arXiv preprint arXiv:2002.06856, 2020.
  * [12] Stacey Truex, Ling Liu, Mehmet Emre Gursoy, Lei Yu, and Wenqi Wei.  Demystifying membership inference attacks in machine learning as a service.  IEEE Transactions on Services Computing, 2019.
  * [13] Zhibo Wang, Mengkai Song, Zhifei Zhang, Yang Song, Qian Wang, and Hairong Qi.  Beyond inferring class representatives: User-level privacy leakage from federated learning.  In IEEE INFOCOM 2019-IEEE Conference on Computer Communications, pages 2512–2520. IEEE, 2019.
  * [14] Zhiguang Wang, Weizhong Yan, and T. Oates.  Time series classification from scratch with deep neural networks: A strong baseline.  2017 International Joint Conference on Neural Networks (IJCNN), pages 1578–1585, 2017.
  * [15] Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov.  See through gradients: Image batch recovery via gradinversion.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16337–16346, 2021.
  * [16] Jingwen Zhang, Jiale Zhang, Junjun Chen, and Shui Yu.  Gan enhanced membership inference: A passive local attack in federated learning.  In ICC 2020 - 2020 IEEE International Conference on Communications (ICC), pages 1–6, 2020.
  * [17] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen.  idlg: Improved deep leakage from gradients.  CoRR, abs/2001.02610, 2020.
  * [18] Ligeng Zhu, Zhijian Liu, and Song Han.  Deep leakage from gradients.  In Advances in Neural Information Processing Systems, pages 14774–14784, 2019.

## Appendix

### Figures for Section 3

Figure 4: Average prediction value of the true label of Purchase100 dataset
for members and non-members.

(a) model’s architecture

(b) Conv block

Figure 5: The architecture of the attack model consisting of three convolution
blocks, one-dimensional batch normalization and a final linear layer with
binary membership prediction.

### Table for Section 3

The knowledge of $y$ | Attack method | Attack accuracy
---|---|---
✓ | True label | 87.9%
✗ | Entropy | 78.6%
✗ | Maximum prediction value | 77.4%
Table 2: The performance of passive membership inference attacks in FL with 4
participants after T=300 epochs for classifying CIFAR100 datset using AlexNet
under different assumptions on the adversary capability to access the label
$y$ in ${\mathcal{D}}_{a}$. The observed epochs are the last 10 epochs.

### Experiment details

#### Federated learning setup

The federated learning setup is set to the same as the open-source code
provided for [9]. 555https://github.com/SPIN-
UMass/MembershipWhiteboxAttacks/blob/master/ATTACK-ALEXNET-grad_fed_local.py.
For CIFAR100 dataset, at each communication round, each client performs one
local epoch update using SGD optimizer with batch size 100. The learning rate
is set to 0.05 for the first 20 epochs, 0.005 for epochs from 21 to 40 and
0.0005 for the epochs from 41 to 300. For Purchase100 dataset, at each
communication round, each client performs one local epoch update using Adam
optimizer with batch size 100 and learning rate $0.001$.

#### Our attack setup

To train the attack model, we use the Adam optimizer with batch size 100 and
learning rate of 0.001. The model is trained for 100 epochs. For both CIFAR100
and Purchase100 dataset, the model is trained on 2000 members and 2000 non-
members data samples and tested on 5000 members and 5000 non-members data
samples. Notice that, compared with the baseline [9], we train on less samples
but test on the same numbers of data samples.