2019/05/29 by Sasi Kumar Murakonda, Reza Shokri, Murakonda, Sasi Kumar +3
Computer Science · Decision Sciences · #Adversarial Robustness in Machine Learning #Data Quality and Management #Bayesian Modeling and Causal Inference
paper · pdf · doi:10.48550/arxiv.1905.12774
Models leak information about their training data. This enables attackers to\ninfer sensitive information about their training sets, notably determine if a\ndata sample was part of the model's training set. The existing works\nempirically show the possibility of these membership inference (tracing)\nattacks against complex deep learning models. However, the attack results are\ndependent on the specific training data, can be obtained only after the tedious\nprocess of training the model and performing the attack, and are missing any\nmeasure of the confidence and unused potential power of the attack.\n In this paper, we theoretically analyze the maximum power of tracing attacks\nagainst high-dimensional graphical models, with the focus on Bayesian networks.\nWe provide a tight upper bound on the power (true positive rate) of these\nattacks, with respect to their error (false positive rate), for a given model\nstructure even before learning its parameters. As it should be, the bound is\nindependent of the knowledge and algorithm of any specific attack. It can help\nin identifying which model structures leak more information, how adding new\nparameters to the model increases its privacy risk, and what can be gained by\nadding new data points to decrease the overall information leakage. It provides\na measure of the potential leakage of a model given its structure, as a\nfunction of the model complexity and the size of the training set.\n