Rethinking Privacy Preserving Deep Learning: How to Evaluate and Thwart Privacy Attacks

2020/06/20 by Fan, Lixin, Ng, Kam Woh, Ju, Ce +4
#Cryptography and Security (cs.CR) #Distributed #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #Parallel #and Cluster Computing (cs.DC)

paper · doi:10.48550/arxiv.2006.11601

Abstract

This paper investigates capabilities of Privacy-Preserving Deep Learning (PPDL) mechanisms against various forms of privacy attacks. First, we propose to quantitatively measure the trade-off between model accuracy and privacy losses incurred by reconstruction, tracing and membership attacks. Second, we formulate reconstruction attacks as solving a noisy system of linear equations, and prove that attacks are guaranteed to be defeated if condition (2) is unfulfilled. Third, based on theoretical analysis, a novel Secret Polarization Network (SPN) is proposed to thwart privacy attacks, which pose serious challenges to existing PPDL methods. Extensive experiments showed that model accuracies are improved on average by 5-20% compared with baseline mechanisms, in regimes where data privacy are satisfactorily protected.

Related

• Security and Privacy Issues in Deep Learning
• A Systematic Literature Review On Privacy Of Deep Learning Systems
• Security and Privacy Preserving Deep Learning
• How Does a Deep Learning Model Architecture Impact Its Privacy? A Comprehensive Study of Privacy Attacks on CNNs and Transformers
• Privacy in Deep Learning: A Survey