Private Counterfactual Retrieval With Immutable Features

TL;DR

This paper introduces methods for privately retrieving the closest counterfactual sample from a database while keeping certain features immutable and maintaining privacy, addressing a practical need in sensitive classification tasks.

Contribution

It proposes two novel I-PCR schemes leveraging PIR techniques and analyzes their communication costs and privacy guarantees.

Findings

Two I-PCR schemes are developed using PIR techniques.

The schemes' communication costs are characterized.

The information leakage about the database is quantified.

Abstract

In a classification task, counterfactual explanations provide the minimum change needed for an input to be classified into a favorable class. We consider the problem of privately retrieving the exact closest counterfactual from a database of accepted samples while enforcing that certain features of the input sample cannot be changed, i.e., they are \emph{immutable}. An applicant (user) whose feature vector is rejected by a machine learning model wants to retrieve the sample closest to them in the database without altering a private subset of their features, which constitutes the immutable set. While doing this, the user should keep their feature vector, immutable set and the resulting counterfactual index information-theoretically private from the institution. We refer to this as immutable private counterfactual retrieval (I-PCR) problem which generalizes PCR to a more practical setting. In this paper, we propose two I-PCR schemes by leveraging techniques from private information retrieval (PIR) and characterize their communication costs. Further, we quantify the information that the user learns about the database and compare it for the proposed schemes.