2018/07/16 by Milad Nasr, Reza Shokri, Nasr, Milad +4 · 8 citations
Computer Science · #Adversarial Robustness in Machine Learning #Cryptography and Security (cs.CR) #Explainable Artificial Intelligence (XAI) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #Privacy-Preserving Technologies in Data #Stochastic Gradient Optimization Techniques
paper · pdf · doi:10.48550/arxiv.1807.05852
openalex publication_date 2018/07/16 · openalex created_date 2021/05/24 · openalex updated_date 2026/07/28
Machine learning models leak information about the datasets on which they are\ntrained. An adversary can build an algorithm to trace the individual members of\na model's training dataset. As a fundamental inference attack, he aims to\ndistinguish between data points that were part of the model's training set and\nany other data points from the same distribution. This is known as the tracing\n(and also membership inference) attack. In this paper, we focus on such attacks\nagainst black-box models, where the adversary can only observe the output of\nthe model, but not its parameters. This is the current setting of machine\nlearning as a service in the Internet.\n We introduce a privacy mechanism to train machine learning models that\nprovably achieve membership privacy: the model's predictions on its training\ndata are indistinguishable from its predictions on other data points from the\nsame distribution. We design a strategic mechanism where the privacy mechanism\nanticipates the membership inference attacks. The objective is to train a model\nsuch that not only does it have the minimum prediction error (high utility),\nbut also it is the most robust model against its corresponding strongest\ninference attack (high privacy). We formalize this as a min-max game\noptimization problem, and design an adversarial training algorithm that\nminimizes the classification loss of the model as well as the maximum gain of\nthe membership inference attack against it. This strategy, which guarantees\nmembership privacy (as prediction indistinguishability), acts also as a strong\nregularizer and significantly generalizes the model.\n We evaluate our privacy mechanism on deep neural networks using different\nbenchmark datasets. We show that our min-max strategy can mitigate the risk of\nmembership inference attacks (close to the random guess) with a negligible cost\nin terms of the classification error.\n