US-UK PETs Prize Challenge

U.S.-U.K. Privacy-Enhancing Technologies (PETs) Prize Challenge: Advancing Privacy-Preserving Federated Learning

Privacy-enhancing technologies (PETs) have the potential to help us devise data-driven, innovative solutions to tackle the most pressing global societal challenges we're facing, while preserving citizens’ fundamental right to privacy, which constitutes a foundation for democratic societies. By enabling organizations to share and collaboratively analyze sensitive data in a privacy-preserving manner, PETs open up unprecedented opportunities to harness the power of data through innovative and trustworthy applications. 

Summit for Democracy - PETs Winners Announced

The U.S.-U.K. PETs prize challenges are now closed. The U.S. PETs prize challenge was co-sponsored by NIST and the National Science Foundation, in coordination with the White House Office of Science and Technology Policy. The PETs prize challenge ran in parallel with the U.K.’s PETs prize challenge, which was sponsored by the U.K. government's Responsible Technology Adoption Unit (RTA), previously known as the Centre for Data Ethics and Innovation.  The U.S.-U.K. collaboration on the PETs prize challenges was first announced at the Summit for Democracy in December 2021. In addition to competing for a combined U.S.-U.K. prize pool of $1.6 million (£1.3 million), winning solutions were featured at the 2^nd Summit for Democracy in the spring of 2023, which you can watch on the left.

 

Challenge Summary Challenge Structure Challenge Winners In the News

Challenge Summary

The goal of the U.S.-U.K. PETs Prize Challenges was to advance privacy-preserving federated learning solutions that provide end-to-end privacy and security protections while harnessing the potential of Artificial Intelligence (AI) for overcoming significant global challenges. The challenge utilized a red team/blue team approach with two types of participants: blue teams, which developed privacy-preserving solutions, and red teams, which acted as adversaries to test those solutions. The challenge was broken into three parts:

• In Phase 1: Concept Paper, blue teams wrote technical concept papers proposing their privacy-preserving solutions. 
• In Phase 2: Solution Development, blue teams developed working prototypes of their solutions. These were submitted to a remote execution environment which ran federated training and evaluation.
• In Phase 3: Red Teaming, independent red teams of privacy researchers scrutinized and tested the blue team prototypes for privacy vulnerabilities.

Teams competing in the challenge participated in two separate data tracks: Track A dealt with the identification of financial crime, and Track B was about bolstering pandemic forecasting and response. A total of $675,000 in prizes are being awarded to teams over the course of the entire competition.

Structure of the Prize Challenges

The challenges took the form of a multi-stage competition involving a white paper submission, prototype development, and a red-teaming phase.

Participants could select one track or both tracks, or for extra points, develop a solution that works for both.

Challenge Winners

U.S. Winner Profiles

Scarlet Pets

Summary of Approach:

Developed a novel privacy-preserving (PP) two-step federated learning approach to identify anomalous financial transactions. In the first step, we performed PP feature mining for account-level banks’ data, followed by their augmentation to the messaging network’s data using a PP encoding scheme. In the second step, a classifier is learned by the messaging network from the augmented data. A key benefit of our approach is that the performance in the federated setting is comparable to the performance in the centralized setting, and there is no significant drop in accuracy. Furthermore, our approach is extremely flexible since it allows the messaging network to adapt its model and features to build a better classifier without imposing any additional computational or privacy burden on the banks.

Open Source Solution

PPMLHuskies

Place: 2nd in Track A: Financial Crime Prevention

Prize: $50,000

Team members: Martine De Cock, Anderson Nascimento, Sikha Pentyala, Steven Golob, Dean Kelley, Zekeriya Erkin, Jelle Vos, Célio Porsius Martins, Ricardo Maia

Hometown: Bellevue, University Place, Seattle, Tacoma, and Port Orchard, WA; Delft, The Netherlands; Brasília, Brazil

Affiliations: University of Washington Tacoma, Delft University of Technology, and University of Brasília

Summary of Approach:

In our solution, the financial transaction messaging system and its network of banks jointly extract feature values to improve the utility of a machine learning model for anomalous payment detection. To do so in a privacy-preserving manner, they engage in a cryptographic protocol to perform computations over their joint data, without the need to disclose their data in an unencrypted manner, i.e. our solution provides input privacy through encryption. To prevent the machine-learning model from memorizing instances from the training data, i.e., to provide output privacy, the model is trained with an algorithm that ensures differential privacy.

Open Source Solution

ILLIDAN Lab

Place: 3rd in Track A: Financial Crime Prevention

Prize: $25,000

Team members: Jiayu Zhou, Haobo Zhang, Junyuan Hong, Steve Drew, Fan Dong

Hometown: East Lansing, MI

Affiliations: Michigan State University, University of Calgary

Summary of Approach:

Our novel approach for detecting financial crime utilizes a hybrid of vertical and horizontal federated learning. We train an encoder to extract features from private data horizontally, while vertically fusing the features from different nodes. To protect data privacy, we incorporate encryption and noise injection during feature transfer and classifier training. Our privacy-preserving framework allows us to collaboratively learn a classifier for financial crime detection while maintaining privacy.

Open Source Solution

Visa Research 

Place: Special Recognition Prize in Track A: Financial Crime Prevention

Prize: $10,000

Team members: Sebastian Meiser, Andrew Beams, Hao Yang, Yuhang Wu, Panagiotis Chatzigiannis, Srinivasan Raghuraman, Sunpreet Singh Arora, Harshal Shah, Yizhen Wang, Karan Patel, Peter Rindal, Mahdi Zamani

Hometown: Blacksburg and Fairfax, VA; San Jose, CA; Walla Walla, WA; Lübeck, Germany; Beijing and Anhui, China; Bangalore, Gurgaon, Ahmedabad, and Vadodara, India; Tehran, Iran

Representing: Visa Research

Summary of Approach:

In our solution, we leverage the observation that the only additional data field the banks hold is an account "flag" attribute, which can be simplified into "normal" and "abnormal" states. The messaging network computes model updates for both assumed flags for each transaction in batches. Then, the messaging network, bank, and an "aggregator" participate in a multi-party computation (MPC) protocol. The messaging network provides the two possible updates, bank provides the flag, and aggregator adds noise (for differential privacy) to prevent inference attacks. The MPC ensures parties obliviously select the correct update, achieving privacy. For transaction classification, the messaging network derives two possible model outputs, then performs two-party computation (2PC) with the bank, ensuring it obliviously selects the correct output.

Open Source Solution

puffle

Place: 1st in Track B: Pandemic Forecasting and Response

Prize: $100,000

Team members: Ken Ziyu Liu, Shengyuan Hu, Tian Li, Steven Wu, Virginia Smith

Hometown: Pittsburgh, PA

Affiliation: Carnegie Mellon University

Summary of Approach:

We build on our prior research to propose a simple, general, and easy-to-use multi-task learning (MTL) framework to address the privacy-utility-heterogeneity trilemma in federated learning. Our framework involves three key components: (1) model personalization for capturing data heterogeneity across data silos, (2) local noisy gradient descent for silo-specific, node-level differential privacy in contact graphs, and (3) model mean-regularization to balance privacy-heterogeneity trade-offs and minimize the loss of accuracy. Combined together, our framework offers strong, provable privacy protection with flexible data granularity and improved privacy-utility tradeoffs; has high adaptability to gradient-based parametric methods; and is simple to implement and tune.

Open Source Solution

MusCAT

Place: 2nd in Track B: Pandemic Forecasting and Response

Prize: $50,000

Team members: Hyunghoon Cho, David Froelicher, Denis Loginov, Seth Neel, David Wu, Yun William Yu

Hometown: Cambridge and Boston, MA; Austin, TX; Toronto, Canada

Affiliations: Broad Institute of MIT and Harvard, MIT, Harvard Business School, University of Texas Austin, University of Toronto

Summary of Approach:

Our solution introduces MusCAT, a multi-scale federated system for privacy-preserving pandemic risk prediction. For accurate predictions, such a system needs to leverage a large amount of personal information, including one’s infection status, activities, and social interactions. MusCAT jointly analyzes these private data held by multiple federation units with formal privacy guarantees. We leverage the key insight that predictive information can be divided into components operating at different scales of the problem, such as individual contacts, shared locations, and population-level risks. These components are individually learned using a combination of privacy-enhancing technologies to best optimize the tradeoff between privacy and model accuracy.

Open Source Solution

ZS_RDE_AI

Place: 3rd in Track B: Pandemic Forecasting and Response

Prize: $25,000

Team members: Qin Ye, Sagar Madgi, Mayank Shah, Shaishav Jain

Hometown: Washington, DC; Bangalore, New Delhi, and Gujarat, India

Representing: ZS Associates

Summary of Approach:

We present our solution for covid forecasting in a privacy/security preserving manner while optimizing for accuracy using different PETs – FedProx, Differential Private-SGD, Learning with Errors (LWE) Homomorphic Encryption. Our solution provides privacy and security at different layers of data gathering, training, and sharing of model as well as inference from models. Our current solution is currently limited to Logistic Regression since its ease of implementation in Pytorch as compared to Random Forest and XGBoost but these models can be used in a centralized model with ease. A noise vector is additionally added to the data, model, loss function & optimizer by using DP-SGD, which defends against privacy inference attacks while maintaining computational resourcing. Next stage includes sharing gradients/hyperparameters from the various local servers to the central server, where we use LWE to ensure that the weight updates are encrypted with local server key and only the encrypted gradients are shared with the central server to counterfeit model poisoning attacks. The updated central-server global model is shared with local servers (in case of FL) to improve the global model to provide defense against different attacks like model inversion & model extraction which we aim to reduce by controlling overfitting.

ETH SRI

Place: 1st

Prize: $60,000

Team members: Petar Tsankov, Dimitar Iliev Dimitrov, Nikola Jovanović, Martin Vechev, Mark Vero, Jasper Dekoninck, Mislav Balunović

Hometown: Marietta, GA; Zürich, Switzerland

Affiliation: ETH Zurich

Summary of Approach:

The highly custom solutions to both tracks presented in the Challenge required us to work out a good approach for each track separately. In the financial crime track we considered the safety of the flag value at the banks as an essential part of any good solution. We therefore focused on attacks exposing this as a boolean value and found highly generalizable attacks with near-perfect accuracy. For the pandemic track however, we focused more on the privacy-utility trade-off. We showed successfully that the blue teams' solutions had little utility, and that they did not outperform more private locally trained models.

Entmoot 

Place: 2nd

Prize: $40,000

Team members: Anthony Cardillo

Hometown: New York, NY

Summary of Approach:

In the preparatory phase, I read every paper and made sure I understood the theoretical concepts behind homomorphic encryption, differential privacy, and secure multiparty computation. These are rock-solid technologies, but there is a huge difference between a solution saying they use these privacy techniques versus implementing them correctly. My goal during the preparatory and attack periods was to look for the incredibly subtle ways these powerful techniques could be incorrectly implemented. This involved tracing the logic of all the source code, looking for small holes in otherwise impenetrable armor.

Blackbird Labs

Place: 3rd

Prize: $20,000

Team members: Kenneth Ambler, Kevin Liston, Mike Gemmer

Hometown: Akron, OH

Summary of Approach:

Our approach involves simulating the attacks that we've seen in the wild, using profit over prestige as the motivation of the attacker. We start with the information that they provided the endpoints and leverage the weaknesses in their implementations to identify signals and oracles in the data to work our way back to the plaintext. To assist in our approach, we would read through their plan and try to come up with an approach they hadn't considered, then examined their implementation for any errors, and used that to develop the exploit paths.

Additional Profiles 

Find additional information on the winners from the U.S. Challenge here. 

Find profiles of the winners from the U.K. Challenge here. 

In the News

Visit the Challenge.gov page for further information on rules and prizes | Challenge.gov

Meet the Final Winners of the U.S. PETs Prize Challenge, DrivenData (March 2023) | Blog Post

Privacy Enhancing Technologies (PETs) Prize Challenges winners, UK Research and Innovation (March 2023) | Blog Post

At Summit for Democracy, the United States and the United Kingdom Announce Winners of Challenge to Drive Innovation in Privacy-enhancing Technologies That Reinforce Democratic Values (March 2023) | Press Release

Winners Announced in First Phase of UK-U.S. Privacy-Enhancing Technologies Prize Challenges (November 2022) | Press Release 

U.S. and U.K. Launch Innovation Prize Challenges in Privacy-Enhancing Technologies to Tackle Financial Crime and Public Health Emergencies (July 2022) | Press Release 

U.S. and U.K. Governments Collaborate on Prize Challenges to Accelerate Development and Adoption of Privacy-Enhancing Technologies (June 2022) | Press Release

US and UK to Partner on Prize Challenges to Advance Privacy-Enhancing Technologies (December 2021) | Press Release