Using language models as a remote service entails sending private information
to an untrusted provider. In addition, potential eavesdroppers can intercept
the messages, thereby exposing the information. In this work, we explore the
prospects of avoiding such data exposure at the level of text manipulation. We
focus on text classification models, examining various token mapping and
contextualized manipulation functions in order to see whether classifier
accuracy may be maintained while keeping the original text unrecoverable. We
find that although some token mapping functions are easy and straightforward to
implement, they heavily influence performance on the downstream task, and via a
sophisticated attacker can be reconstructed. In comparison, the contextualized
manipulation provides an improvement in performance.

通过文本操作的水平，我们研究了使用语言模型作为远程服务时可能避免数据暴露的前景。我们聚焦于文本分类模型，检查各种令牌映射和上下文操作函数，以确定在保持原始文本不可恢复的同时能否保持分类器准确性。我们发现，尽管有些令牌映射函数容易实现，但它们对下游任务的性能有很大影响，并且通过一个复杂的攻击者可以重建。相比之下，上下文操作提供了性能的改进。

通过令牌操作保护分类器中的隐私

Protecting Privacy in Classifiers by Token Manipulation

We motivate our research with a real-world problem of classifying malicious
web domains using a remote service that provides various information.
Crucially, some of the information can be further analyzed into a certain depth
and this process sequentially creates a tree of hierarchically structured
multiple-instance data. Each request sent to the remote service is associated
with a cost (e.g., time or another cost per request) and the objective is to
maximize the accuracy, constrained with a budget. We present a generic
framework able to work with a class of similar problems. Our method is based on
Classification with Costly Features (CwCF), Hierarchical Multiple-Instance
Learning (HMIL) and hierarchical decomposition of the action space. It works
with samples described as partially-observed trees of features of various types
(similar to a JSON/XML file), which allows to model data with complex
structure. The process is modeled as a Markov Decision Process (MDP), where a
state represents acquired features, and actions select yet unknown ones. The
policy is trained with deep reinforcement learning and we demonstrate our
method with both real-world and synthetic data.

通过远程服务对恶意网络域名进行分类，并基于具有层次结构的多实例数据的树进行分析，使用分类成本特征、多实例学习和分层决策空间分解的方法来训练强化学习策略以最大化准确性，同时限制成本，能够有效处理结构复杂的数据。