Membership Inference Attacks Against Machine Learning Models

Abstract

Abstract-We quantitatively investigate how machine learning models leak information about the individual data records on which they were trained. We focus on the basic membership inference attack: given a data record and black-box access to a model, determine if the record was in the model's training dataset. To perform membership inference against a target model, we make adversarial use of machine learning and train our own inference model to recognize differences in the target model's predictions on the inputs that it trained on versus the inputs that it did not train on.We empirically evaluate our inference techniques on classification models trained by commercial "machine learning as a service" providers such as Google and Amazon. Using realistic datasets and classification tasks, including a hospital discharge dataset whose membership is sensitive from the privacy perspective, we show that these models can be vulnerable to membership inference attacks. We then investigate the factors that influence this leakage and evaluate mitigation strategies.

DP-CGAN: Differentially Private Synthetic Data and Label Generation

“…C ) Compute per-example gradients of discriminator loss on fake data Z t and clip them 13 for i ∈ Z t do 14 Compute grad d f ake t ← − ∇ θ d d loss f ake(θ d t , Z i ) 15 grad d f ake t = grad d f ake t /max(1, ||grad d f ake ||2 C ) 16 Compute the overall gradients of discriminator and add Gaussian Noise to them 17 grad d t ← − 1 bs grad d real t + grad d f ake t + N (0, σ 2 C 2 I) 18 Take the gradient Descent step for discriminator 19 θ dt+1 ← − SGD(grads d t , θ dt , lr)) / * Update RDP Accountant * / 20 Accumulate the spent privacy budget using RDP Accountant / * Update the Generator Network * / 21 g loss ← − log(1 − D(G(Z t ))) 22 Compute gradients of generator loss 23 Compute grad g t ← − ∇ θg g loss(θ g t , Z i ) 24 Take the gradient Descent step for generator 25 θ g t+1 ← − ADAM (grad g t , θ g t ) 26 if spent epsilon > OR spent delta > δ then The dataset used used in the evaluation is MNIST handwritten dataset containing 60k training samples and 10k test samples. In the experiments, batch size is set to 600, δ = 10 −5 and learning rate is set by an adapative approach in which the initial learning rate is 0.15, it is decreased to 0.052 in iteration 10K and is fixed on 0.052 for the rest iterations.…”

“…Some previous studies have proposed approaches to addressing the problem of preserving privacy in Deep Learning. Shokri et al [22] developed a distributed approach in which multiple parties train a model on their local training set independently. Then, each party selects a set of key parameters, and shares them with the other parties.…”

Influence Function based Data Poisoning Attacks to Top-N Recommender Systems

“…Table 4 illustrates the attack results on matrix-factorization-based recommender systems when we weight normal users, where the experimental settings are the same as those in Table 1. Here, "Weighting" means that we weight each normal user and optimize the attack of (30) over the weighted normal users, and the weight of each normal user is computed based on (31). Comparing Tables 1 and 4, we can see that the performance is improved when we consider the weights of different normal users with respect to the target items.…”

HybridAlpha

“…Often, an aggregator is a central entity that also redistributes the merged model parameters to all participants but other topologies have been used as well, e.g., co-locating an aggregator with each participant. However, this approach still poses privacy risks: inference attacks in the learning phase have been proposed by [30]; deriving private information from a trained model has been demonstrated in [37]; and a model inversion attack has been presented in [19].…”