Label‐only membership inference attacks on machine unlearning without dependence of posteriors

Lu, Zhaobo; Liang, Hai; Zhao, Minghao; Lv, Qingzhe; Liang, Tiancai; Wang, Yilei

doi:10.1002/int.23000

Cited by 8 publications

(3 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Federated Reinforcement Learning [31] has also recently emerged. Security issues [32][33][34][35][36][37][38], especially in vertical federated learning, has got arouse wide concern [39,40]. Wei et al [41] survey on the issues of security and privacy in VFL.…”

Section: Related Workmentioning

confidence: 99%

Beyond model splitting: Preventing label inference attacks in vertical federated learning with dispersed training

Wang

Zhang

et al. 2023

World Wide Web

Self Cite

View full text Add to dashboard Cite

Federated learning is an emerging paradigm that enables multiple organizations to jointly train a model without revealing their private data. As an important variant, vertical federated learning (VFL) deals with cases in which collaborating organizations own data of the same set of users but with disjoint features. It is generally regarded that VFL is more secure than horizontal federated learning. However, recent research (USENIX Security'22) reveals that it is still possible to conduct label inference attacks in VFL, in which attacker can acquire privately owned labels of other participants; even VFL constructed with model splitting (the kind of VFL architecture with higher security guarantee) cannot escape it. To solve this issue, in this paper, we propose the dispersed training framework. It utilizes secret sharing to break the correlations between the bottom model and the training data. Accordingly, even if the attacker receives the gradients in the training phase, he is incapable to deduce the feature representation of labels from the bottom model. Besides, we design a customized model aggregation method such that the shared model can be privately combined, and the linearity of secret sharing schemes ensures the training accuracy to be preserved. Theoretical and experimental analyses indicate the satisfactory performance and effectiveness of our framework.

show abstract

Section: Related Workmentioning

confidence: 99%

Beyond model splitting: Preventing label inference attacks in vertical federated learning with dispersed training

Wang

Zhang

et al. 2023

World Wide Web

Self Cite

View full text Add to dashboard Cite

show abstract

Section: Related Workmentioning

confidence: 99%

Beyond Model Splitting: Preventing Label Inference Attacks in Vertical Federated Learning with Dispersed Training

Wang

Zhao

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Federated learning is an emerging paradigm that enables multiple organizations to jointly train a model without revealing their private data. As an important variant, vertical federated learning (VFL) deals with cases in which collaborating organizations own data of the same set of users but with disjoint features. It is generally regarded that VFL is more secure than horizontal federated learning. However, recent research (USENIX Security’22) reveals that it is still possible to conduct label inference attacks in VFL, in which attacker can acquire privately owned labels of other participants; even VFL constructed with model splitting (the kind of VFL architecture with higher security guarantee) cannot escape it. To solve this issue, in this paper, we propose the dispersed training framework. It utilizes secret sharing to break the correlations between the bottom model and the training data. Accordingly, even if the attacker receives the gradients in the training phase, he is incapable to deduce the feature representation of labels from the bottom model. Besides, we design a customized model aggregation method such that the shared model can be privately combined, and the linearity of secret sharing schemes ensures the training accuracy to be preserved. Theoretical and experimental analyses indicate the satisfactory performance and effectiveness of our framework.

show abstract

“…On the other hand, these data threaten users' privacy and increase the risk of data leakage [6][7][8][9]. Furthermore, privacy regulations, such as the European General Data Protection Regulation (GDPR) [10], allow users to request the deletion of their personal data from learning models as part of the "right to be forgotten".…”

Section: Introductionmentioning

confidence: 99%

Machine Unlearning by Reversing the Continual Learning

Zhang,

Lu,

Zhang

et al. 2023

Applied Sciences

Self Cite

View full text Add to dashboard Cite

Recent legislations, such as the European General Data Protection Regulation (GDPR), require user data holders to guarantee the individual’s right to be forgotten. This means that user data holders must completely delete user data upon request. However, in the field of machine learning, it is not possible to simply remove these data from the back-end database wherein the training dataset is stored, because the machine learning model still retains this data information. Retraining the model using a dataset with these data removed can overcome this problem; however, this can lead to expensive computational overheads. In order to remedy this shortcoming, we propose two effective methods to help model owners or data holders remove private data from a trained model. The first method uses an elastic weight consolidation (EWC) constraint term and a modified loss function to neutralize the data to be removed. The second method approximates the posterior distribution of the model as a Gaussian distribution, and the model after unlearning is computed by decreasingly matching the moment (DMM) of the posterior distribution of the neural network trained on all data and the data to be removed. Finally, we conducted experiments on three standard datasets using backdoor attacks as the evaluation metric. The results show that both methods are effective in removing backdoor triggers in deep learning models. Specifically, EWC can reduce the success rate of backdoor attacks to 0. IMM can ensure that the model prediction accuracy is higher than 80% and keep the success rate of backdoor attacks below 10%.

show abstract

Label‐only membership inference attacks on machine unlearning without dependence of posteriors

Cited by 8 publications

References 41 publications

Beyond model splitting: Preventing label inference attacks in vertical federated learning with dispersed training

Beyond model splitting: Preventing label inference attacks in vertical federated learning with dispersed training

Beyond Model Splitting: Preventing Label Inference Attacks in Vertical Federated Learning with Dispersed Training

Machine Unlearning by Reversing the Continual Learning

Contact Info

Product

Resources

About