💻 computer science

Geometric Data Perturbation with Noisy-Anchor Alignment for Privacy-Preserving Collaborative Learning

This paper proposes a privacy-preserving collaborative learning framework that enhances the Geometric Data Perturbation method by adding noise to shared anchor representations rather than private data, thereby effectively mitigating analyst-participant collusion attacks while maintaining high learning utility compared to existing approaches.

Original authors: Keiyu Nosaka, Yamato Suetake, Yuichi Takano, Yukihiko Okada, Akiko Yoshise

Published 2026-08-20

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Keiyu Nosaka, Yamato Suetake, Yuichi Takano, Yukihiko Okada, Akiko Yoshise

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern digital world, organizations often hold pieces of a larger puzzle. A hospital might have patient records, a bank might have transaction histories, and a university might have student performance data. To build better artificial intelligence, these groups need to combine their information. However, laws and privacy concerns usually prevent them from simply sharing their raw data. This creates a difficult problem: how can groups work together to learn from each other without ever revealing their private secrets? One promising solution involves a technique called geometric data perturbation. Imagine taking a photograph and rotating it or shifting it slightly without changing the distance between any two points in the image. The picture looks different, but its internal structure remains intact. By applying these mathematical shifts to data, organizations can send a distorted version of their information to a central analyst. The analyst can then train powerful models on the combined, distorted data, while the original private records remain hidden.

The challenge arises when the central analyst and one of the participating organizations decide to work together to break the privacy of the others. If the organizations all used the exact same mathematical shift, the colluding pair could easily reverse the process and see everyone's private data. To stop this, researchers previously suggested that each organization should use its own unique shift. However, this creates a new problem: the data from different groups ends up in incompatible formats, making it impossible to train a single model effectively. A clever workaround called "anchor alignment" was developed to fix this. It uses a shared, synthetic set of reference points—like a common map grid—that every organization transforms along with their private data. The analyst uses these transformed reference points to align the different datasets into a single, usable format. But a new study reveals a critical flaw in this approach: if a colluding partner reveals the original reference map, the analyst can mathematically reverse the unique shifts of all other participants, exposing their private data completely.

Researchers from the University of Tsukuba have proposed a new method to solve this specific vulnerability. They realized that adding noise, or random static, directly to the private data to protect it would ruin the quality of the final model. Instead, they decided to add the noise to the reference map itself. In their new system, each organization still uses its own unique shift for its private data, but when they transform the shared reference map, they add a layer of random noise to it before sending it to the analyst. This noise makes it mathematically impossible for the analyst and a colluding partner to perfectly reverse the unique shifts of the other participants. The analyst can still align the data well enough to train a useful model, but the path to stealing the private information is blocked by the noise.

The team tested this idea using two large image datasets: one containing handwritten digits and another containing thousands of celebrity faces. They simulated a scenario where an analyst and one participant conspired to steal the data of the others. When they added noise to the private data itself, the model's accuracy dropped significantly as the privacy protection increased. However, when they added noise only to the reference map, they found a much better balance. The system maintained high accuracy for the machine learning model while making it extremely difficult for the attackers to reconstruct the original images. In their experiments, the new method allowed the system to achieve high learning accuracy even when the risk of data leakage was kept low. The researchers showed that by protecting the alignment signal rather than the data itself, they could create a system that is both useful for collaboration and robust against insider threats. This approach offers a practical way for organizations to collaborate on sensitive projects without having to choose between privacy and performance.

=== SUMMARY ===

Technical Summary: Geometric Data Perturbation with Noisy-Anchor Alignment for Privacy-Preserving Collaborative Learning

1. Problem Statement

The paper addresses the challenge of One-Shot Representation Sharing (OSRS) in Privacy-Preserving Collaborative Learning (PPCL). In this regime, multiple participants upload obfuscated data representations to a central analyst for joint model training without further interaction. The core tension lies in balancing utility (the ability to train accurate models on pooled data) with privacy (preventing the reconstruction of private data).

The specific threat model considered is Analyst-Participant Collusion, where a central analyst colludes with one or more participants who disclose their private data and transformation parameters. The paper identifies three existing approaches and their limitations under this threat:

Common-Transform GDP (C-GDP): All participants use the same geometric transformation. While this preserves cross-participant comparability, a colluding participant can disclose the shared parameters, allowing the analyst to exactly invert and recover the private data of all non-colluding participants.
Independent-Transform GDP (I-GDP): Each participant uses a unique transformation. This prevents direct inversion via shared parameters but maps data into incompatible coordinate systems, degrading downstream model utility.
Data Collaboration (DC) with Anchor Alignment: Participants share a synthetic "anchor matrix" to align their independent transformations into a common coordinate system. However, the paper demonstrates that if a colluding participant discloses the raw anchor matrix, the analyst can exactly recover the transformation parameters of non-colluding participants, leading to exact data reconstruction.

A straightforward countermeasure—adding noise directly to the private-data representations—mitigates reconstruction risk but significantly distorts the geometric structure required for learning, resulting in a poor privacy-utility trade-off. Furthermore, the paper proves that adding noise to private data in an anchor-aligned I-GDP setting yields an output distribution equivalent to C-GDP with private-data noise, failing to resolve the underlying alignment dilemma.

2. Methodology

The authors propose Anchor-Aligned Independent Geometric Data Perturbation with Anchor Noise (AA-I-GDP (anchor noise)). The core innovation is shifting the additive perturbation from the private-data representations to the anchor representations used for alignment.

Protocol Workflow

Setup: Participants share a common, centered, orthonormal anchor matrix $A$ (kept secret from the analyst during honest execution).
Obfuscation: Each participant $i$ $i$ independently samples a geometric transformation (orthogonal matrix $O_i$ $O_{i}$ and translation $\Psi_i$ $Ψ_{i}$ ).
- Private Data: Transformed without noise: $Y_i = X_i O_i + \mathbf{1}\Psi_i^\top$ .
- Anchor Data: Transformed and then perturbed with isotropic Gaussian noise: $B_i = (A O_i + \mathbf{1}\Psi_i^\top) + v W_i$ , where $v$ is the noise scale and $W_i$ is a noise matrix.
Upload: Participants upload both $Y_i$ and the noisy $B_i$ to the analyst.
Alignment (Analyst Side): The analyst uses the noisy anchor representations $\{B_i\}$ to estimate alignment maps. This is formulated as a Generalized Orthogonal Procrustes Problem (GOPP). The analyst solves for a common template and participant-specific rotations that minimize the reconstruction error of the noisy anchors.
Training: The estimated alignment maps are applied to the private data representations $Y_i$ to align them into a shared coordinate system, after which a downstream model is trained.

Theoretical Analysis

Recovery Risk: In the collusion setting, the analyst (with a colluder's help) possesses the raw anchor $A$ and the noisy $B_i$ . This transforms the exact parameter recovery problem (present in noiseless DC) into a noisy transform-estimation problem. The accuracy of recovering $O_i$ depends on the noise level $v$ , the anchor size $r$ , and the dimension $d$ .
Alignment Error: The paper characterizes the alignment error into two components:
1. Rotational Error: Controlled by the convergence of the GOPP solver (Generalized Power Method). Theoretical bounds show that for sufficiently low noise $v$ , the solver converges to a global maximizer, preserving relative geometry.
2. Residual Translation: Caused by the noise mean in the anchor representations. This component introduces a participant-specific translation error that does not vanish even with perfect rotation recovery, but its magnitude is bounded and decreases with larger anchor sizes ( $r$ ).

3. Key Contributions

Known-Anchor Vulnerability: The authors formally demonstrate that in the analyst-participant collusion setting, noiseless anchor alignment (DC) allows an attacker to exactly recover participant-specific transformations and private data if the raw anchor matrix is disclosed.
Output Equivalence of Private-Data Noise: The paper proves that adding noise to private-data representations in an anchor-aligned I-GDP setting results in a collaboration output distribution statistically equivalent to C-GDP with private-data noise. Thus, this approach does not offer a distinct privacy-utility advantage over the common-transform baseline.
Anchor Noise Framework: The proposal to perturb anchor representations instead of private data. This preserves the exact geometric structure of the private data while converting the exact transformation recovery channel into a noisy estimation problem.
Theoretical Characterization: The authors provide convergence guarantees for the GOPP solver under the proposed noise model and derive bounds for the resulting alignment and reconstruction errors.

4. Experimental Results

Experiments were conducted on MNIST and CelebA datasets under the analyst-participant collusion setting.

Privacy-Utility Trade-off:
- MNIST: The proposed method (anchor noise) achieved higher test accuracy than private-data noise methods at comparable levels of "exact-source linkage" (a metric for reconstruction leakage). Specifically, at a linkage accuracy of ~12.4%, anchor noise yielded ~59.2% balanced accuracy, whereas private-data noise methods required significantly higher noise levels to achieve similar privacy, resulting in lower utility.
- CelebA: Similar trends were observed. Anchor noise restored the natural utility ordering as the number of participants increased, whereas unaligned I-GDP controls showed non-monotone utility degradation.
Attack Resistance: Three reconstruction attacks were evaluated against AA-I-GDP (anchor noise): Moore-Penrose, Orthogonal Procrustes, and Alignment Map Calibration. The Orthogonal Procrustes attack was the strongest, but increasing the anchor noise scale $v$ effectively reduced the linkage accuracy (leakage) while maintaining usable utility.
Solver Behavior: The experiments confirmed that the Generalized Power Method (GPM) converges reliably for noise levels below an empirically observed phase transition, supporting the theoretical sufficient conditions.

5. Significance and Claims

The paper claims that anchor noise offers a more favorable privacy-utility trade-off than existing methods under the specified analyst-participant collusion model. By decoupling the perturbation from the private data, the method retains the geometric fidelity necessary for downstream learning while introducing a tunable barrier against reconstruction attacks.

The authors emphasize that this approach does not provide formal differential privacy (DP) guarantees; rather, it creates "tunable, attack-dependent operating points" between alignment accuracy and resistance to reconstruction. The significance lies in resolving the "alignment-recovery tension": it restores cross-participant comparability (solving the I-GDP utility issue) without creating an exact inversion channel (solving the C-GDP/DC privacy issue), provided the anchor noise is appropriately calibrated.

The paper concludes that while the method relies on heuristic privacy guarantees dependent on the adversary's capabilities, it empirically outperforms the standard alternatives (C-GDP with noise and AA-I-GDP with private-data noise) in the specific threat model of analyst-participant collusion.