TUGraz OPEN Library

Stocker, Alexander

Kaiser, Christian

Quantified Car: Potenziale, Geschäftsmodelle und Digitale Ökosysteme

Schabauer, Martin

Hackl, Andreas

Lex, Cornelia

Shao, Liang

Freimüller, Paul

Parameterbestimmung - Limitierender Faktor für Fahrzeugregelsysteme der Zukunft?

Malle, Bernd

Schrittwieser, Sebastian

Kieseberg, Peter

Holzinger, Andreas

ERCIM NEWS 107   October 201622
Special theme: Machine Learning
Figure1:Effectsof
informationremovalon
selectedalgorithms.
Data driven economy (and related con-
cepts like Industry 4.0) and data driven
science, as well as big data are the key-
words most often heard in discussions
on the future of high-profile industries
and on the upcoming revolutions in the
economic world. With the integration of
modern information technology into
“classical” industrial environments or
services, many new opportunities can be
envisioned, e.g., in the optimisation of
supply chains or in on-demand produc-
tion of specifically tailored goods, but
even in governmental areas like health
environments, where P4-medicine (pre-
dictive, preventive, personalised, partic-
ipatory) is seen as a new paradigm that
could revolutionise health care. With all
these new opportunities, the challenges
were traditionally located in the tech-
nical area, especially regarding tech-
nologies for enabling the efficient and
correct analysis of the large amounts of
data produced by factories and large
sensor networks. In recent years, the
area of machine learning has seen a
surge in new technologies developed
and brought to the market. In combina-
tion with the ever increasing amount of
computational power and storage that is
available for a relatively reasonable
price, many of these applications can
now be applied in real life environ-
ments.
While many of the technological issues
have been apparently solved, the legal
aspects of the collection and processing
of vast amounts of data using machine
learning algorithms has been neglected
(see [1]). The “right to be forgotten” has
been recently discussed with a partic-
ular focus on removing personal data
and sensitive (personal) information
from automated analysis if requested by
an individual. This brings up technical
as well as ethical questions. Especially
in the European Union, the right to be
forgotten has remained in political dis-
cussion, especially fed by a legal base
for protection of personal information
on the Internet by the European
Commission (see [L1]), with the draft
European Data Protection Regulation
Article 17 (see [2]). While the main
focus in the current discussion is
leaning mostly towards the removal of
information from search indexes of
prominent search engines like Google,
the underlying technological challenges
run much deeper and touch fundamental
aspects of machine learning and its
application in the industry.
One of the major questions are  the
effects of removing information from
knowledge bases on machine learning
algorithms. This is especially important
for algorithms or analytical systems that
Privacy Aware Machine Learning 
and the “Right to be forgotten”
by Bernd Malle, Peter Kieseberg (SBA Research), Sebastian Schrittwieser (JRC TARGET, St.
Poelten University of Applied Sciences), and Andreas Holzinger (Graz University of Technology)
While machine learning is one of the fastest growing technologies in the area of computer
science, the goal of analysing large amounts of data for information extraction collides with
the privacy of individuals. Hence, in order to protect sensitive information, the effects of the
right to be forgotten on machine learning algorithms need to be studied more extensively.
ERCIM NEWS 107   October 2016 23
rely on a large knowledge base con-
taining previously analysed data to
learn from or which work by iteratively
enhancing the global analytical result
by continuously increasing the amount
of information. Deletion of existing
data thus tends to worsen the quality of
the existing results, putting the organi-
sations operating under such law at a
serious disadvantage compared to
organisations not subject to those
restrictions. For instance, in developing
clinical decision support software, com-
panies not bound by the right to be for-
gotten can train their algorithms on a
more comprehensive data set, giving
them a worldwide advantage in mar-
keting their product. In a project we
studied the effects of selective deletion
of valuable data items (in terms of their
contribution to a classifier accuracy) as
well as different levels of anonymiza-
tion of a whole data set on machine
learning algorithms [3]. In those experi-
ments, which were based on data from
the 1994 US-census with around 32,000
individual data records, the first phase
tested four different classifiers (gradient
boosting, linear SVC, logistic regres-
sion, random forest) with respect to pre-
cision, recall and F1-score.
Subsequently, increasing fractions of
valuable data were removed from the
data set, which resulted in significant
loss of classifier performance. 
The other major research topic con-
cerned the design of machine learning
algorithms and applications that can
cope with anonymized or otherwise
generalised information. The funda-
mental idea is that the sensitive infor-
mation is encoded by some privacy pro-
tecting means, analysed using machine
learning algorithms and then prepared
for inspection. Although several
approaches exist for this strategy, they
are currently not practical either due to
their impact on the quality of the results,
or due to the additional costs intro-
duced:
• Trusted environments. While being
the most popular strategy, the main
issue of using a trusted environment
lies in the large amount of resources
that have to be reserved for this task,
even when the analysis is only done
very infrequently; e.g., using shared
environments like the Cloud is not
possible with this methodology. Fur-
thermore, the environment needs to
be set up with high security standards
and a lot of audit and control mecha-
nisms, as mechanisms for thwarting
insider attacks must be introduced,
including fully trusted human opera-
tors.
• Anonymization. The data set is trans-
formed into a derived set that blurs
the sensitive attributes without actu-
ally removing them altogether. Popu-
lar techniques work by generalising
records until a certain minimal
amount of them form an equivalence
group (are indistinguishable).
• Pseudonymization. Related to
anonymization, Pseudonymization
works by removing sensitive attrib-
utes and replacing them with a place-
holder, while keeping the internal
logical structure of the data set, i.e.,
records with the same sensitive attrib-
utes get assigned the same pseudo-
nym. 
• Functional Encryption. Functional
encryption allows the calculation of
certain mathematical operations on
the encrypted values, e.g., let F(x) be
the encryption function of x and 
F-1 (y) the decryption routing, then it
holds true that x+y=F-1 (F(x)+F(y)).
While this works well in theory, cur-
rently available algorithms are very
slow and thus cannot be used on close
to all real life scenarios.
Our experiments to date (see [3] and
[L2]) have focused on the loss of classi-
fier performance when applied to
anonymised knowledge bases. We used
the same data set as described above
and anonymised it using the k-
anonymity criterion. The classifiers
were then re-applied on a series of
increasingly anonymised data sets (by
increasing the k-factor), again resulting
in significant losses of classifier per-
formance. A noteworthy difference
between selective deletion and
anonymisation of data is that classifier
performance on reduced data decreased
rather slowly at the beginning and
became more drastic with increased
fractions of data removed, whereas for
anonymised data sets the greatest loss
occurred instantly and subsequently
mellowed with increasing factors of k-
anonymity (see Figure 1).
In conclusion, we can see that the
effects of introducing the right to be for-
gotten to machine learning predictably
results in losses of algorithmic perform-
ance. However, our experiments so far
have only considered classification. A
next logical step in our efforts would be
the inclusion of predictors as well as
unsupervised learning methods (clus-
tering for automatic label provision,
pattern / preference recognition for
product design etc.). Even though in
reality the effects might not be as drastic
as produced by our initial experimental
setting, even a few percentage points in
ML performance could make a signifi-
cant difference in crucial areas of appli-
cation or highly competitive market
environments. To sum up, we believe a
lot of additional future research is
needed in order to: 
• fully understand the effects of the
right to be forgotten on machine
learning environments;
• be able to design algorithms more
resilient to changes in the knowledge
base;
• understand the effect of perturbing
other forms of knowledge bases, e.g.,
graph based data sets, in which dis-
tance is derived from node feature
vectors as well as associations.
Links:
[L1] http://ec.europa.eu/justice/data-
protection/document/review2012/
com_2012_11_en.pdf
[L2] http://www.hci-kdd.org/ 
References:
[1] P. Kieseberg, H. Hobel, S.
Schrittwieser et al:  “Protecting
Anonymity in Data-Driven Biomedical
Science”, pp. 301-316, 2014.
[2] P. De Hert, V. Papakonstantinou :
“The proposed data protection
Regulation replacing Directive
95/46/EC: A sound system for the
protection of individuals”, Computer
Law & Security Review 28, no. 2
(2012): 130-142, 2012.
[3] B. Malle, P. Kieseberg, E. Weippl,
A. Holzinger: “The Right to Be
Forgotten: Towards Machine Learning
on Perturbed Knowledge Bases”,
Workshop on Privacy Aware Machine
Learning (PAML), August 2016
Please contact:
Peter Kieseberg
SBA Research, Vienna, Austria
pkieseberg@sba-research.org


Privacy Aware Machine Learning and the Right to be forgotten

Trummer, Gerald

Marte, C.

Dietmaier, Peter

Sommitsch, Christof

Six, K.

Modeling surface rolling contact fatigue crack initiation taking severe plastic shear deformation into account

Legenstein, Robert

Papadimitriou, Christos H.

Vempala, Santosh

Maass, Wolfgang

Assembly pointers for variable binding in networks of spiking neurons

Berkes, István

Horváth, Lajos

Rice, Gregory

On the asymptotic normality of kernel estimators of the long run covariance of functional time series

Kilter, Jako

Vujatovic, Davor

Elphick, Sean

Renner, Herwig

van Coller, John

van Erp, Frans

Benchmarking of Power Quality Performance in Transmission Systems – CIGRE WG C4.27 Perspective

Jodin, Dirk

Landschützer, Christian

Hafner, Norbert

Innovationen in der Technischen Logistik

Krakow, Stefan

Fuchs-Hanusch, Daniela

Fernkälteversorgung zur Vermeidung von Grundwassererwärmungen und Nutzungskonflikten am Beispiel der Stadt Linz -- Bewertung auf Basis ÖWAV-Regelblatt 207 und qualitativer Nutzwertanalyse

Moser, Florian

Lienhart, Werner

Woschitz, Helmut

Schuller, Hartmut

Long-term monitoring of reinforced earth structures using distributed fiber optic sensing

Graz University of Technology

Not a member yet