FusionDP: Foundation Model-Assisted Differentially Private Learning for Partially Sensitive Features

TL;DR

FusionDP introduces a two-step method combining foundation model-based imputation and a modified DP-SGD to improve privacy-preserving learning when only some features are sensitive, achieving better utility without compromising privacy.

Contribution

It proposes a novel framework that leverages foundation models for sensitive feature imputation and a tailored DP-SGD algorithm for feature-level differential privacy.

Findings

Significant utility improvement over baseline methods.

Effective privacy preservation for sensitive features.

Validated on clinical and tabular datasets.

Abstract

Ensuring the privacy of sensitive training data is crucial in privacy-preserving machine learning. However, in practical scenarios, privacy protection may be required for only a subset of features. For instance, in ICU data, demographic attributes like age and gender pose higher privacy risks due to their re-identification potential, whereas raw lab results are generally less sensitive. Traditional DP-SGD enforces privacy protection on all features in one sample, leading to excessive noise injection and significant utility degradation. We propose FusionDP, a two-step framework that enhances model utility under feature-level differential privacy. First, FusionDP leverages large foundation models to impute sensitive features given non-sensitive features, treating them as external priors that provide high-quality estimates of sensitive attributes without accessing the true values during model training. Second, we introduce a modified DP-SGD algorithm that trains models on both original and imputed features while formally preserving the privacy of the original sensitive features. We evaluate FusionDP on two modalities: a sepsis prediction task on tabular data from PhysioNet and a clinical note classification task from MIMIC-III. By comparing against privacy-preserving baselines, our results show that FusionDP significantly improves model performance while maintaining rigorous feature-level privacy, demonstrating the potential of foundation model-driven imputation to enhance the privacy-utility trade-off for various modalities.