MAS-Encryption and its Applications in Privacy-Preserving Classifiers

Over the past few years, a variety of membership inference attacks against deep learning models have emerged, raising significant privacy concerns.These attacks can easily infer whether a sample exists in the training set of the target model with little adversary knowledge, and the inference accuracy is often much higher than random guessing, which causes serious privacy leakage. To this end, defenses against membership inference attacks have attracted great interest. However, the current available defense methods such as regularization, differential privacy, and knowledge distillation are unable to balance the trade-off between privacy and utility well. In this paper, we combine knowledge distillation and generative adversarial networks to propose a novel training framework that can effectively defend against membership inference attacks, called KD-GAN. Extensive experiments show that our method implements an attack success rate of nearly 0.5 (random guesses) which can successfully defend against membership inference attacks without causing significant damage to model utility, and consistently outperforming other defense methods in the balance of privacy and utility.

Section: Defenses Against Miasmentioning

confidence: 99%

“…DP 38,39 is another classical method used to protect the privacy of ML. Most defense methods based on DP are achieved by adding noise to the objective function for training.…”

Section: Related Workmentioning

confidence: 99%

KD‐GAN: An effective membership inference attacks defence framework

Zhang

Lin

et al. 2022

“…However, since existing subjective quality evaluation systems constrain quality evaluation to a specific range, such as [0, 1], 17 the current IQA database scale is still small compared with the vast UGC data. There is a lack of a labeled IQA data set that reflects all distortion types as well as distortion levels, and building such a data set is an expensive and labor‐intensive process, as the NR‐IQA scoring of distorted images is uncertain 18 . In general, learning‐based NR‐IQA methods assume that the types of distortion in distorted images follow some known type distributions that are generally not applicable to UGC image data 19 .…”

Section: Introductionmentioning

confidence: 99%

Contrastive distortion‐level learning‐based no‐reference image‐quality assessment

Wei

Zhou

et al. 2022

Self Cite

A contrastive distortion-level learning-based no-reference image-quality assessment (NR-IQA) framework is proposed in this study to further effectively model various distortion types with the same or different distortion levels.The proposed method aims to improve the prediction accuracy of NR-IQA. The proposed method consists of three parts: multiscale distortion-level representation learning, single-image NR-IQA, and a representation affinity module, which can reduce NR-IQA computational complexity while maintaining a low-distortion representation of high-distortion inputs. The proposed NR-IQA method aims to extract distributional features of samples in real distorted images and predict ambiguity based on distortion-level learning. Experimental results show that by comparing on many NR-IQA data sets the proposed method can outperform state-of-the-art methods.

“…Under such a situation, ML services are also under threat of data security and privacy, as the data used for model training may contain sensitive information 12–16 . This raises public awareness of ensuring data security and privacy while enjoying ML services 17–22 . As an essential aspect, for example, users hope the ML service providers no longer keep their data if their authorize‐to‐use expires 23–26 …”

Section: Introductionmentioning

confidence: 99%

Label‐only membership inference attacks on machine unlearning without dependence of posteriors

Liang

Zhao

et al. 2022

Machine unlearning is the process through which a deployed machine learning model is enforced to forget about some of its training data items. It normally generates two machine learning models, the original model and the unlearned model, indicating training results before and after data items are deleted. However, recent studies find that machine unlearning is vulnerable to membership inference attacks-as the directivity of training and nontraining data (i.e., data items in the training set have high posterior probabilities), the attackers can utilize this property to infer whether an item has been used for original model training. Nevertheless, such attacks are incapable in label-only settings, in which the attackers are infeasible to get the posteriors. In this paper, we propose a new label-only membership inference attack scheme targeted at machine unlearning to eliminate the dependence on posteriors. Our heuristic is that injected turbulence on candidate samples will present different behaviors for training and nontraining data. Thus, in our scheme, the attacker iteratively query on the original/unlearned models and inject turbulence to change their predicting labels; it determines whether an item is having-been-delated by observing the disturbance amplitude. Extensive experiments (i.e., on MNIST, CIFAR10, CIFAR100, and STL10 data sets) show that