Membership Inference Attacks and Defenses in Neural Network Pruning

Yuan, Xiaoyong; Zhang, Lan

doi:10.48550/arxiv.2202.03335

Cited by 2 publications

(1 citation statement)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this paper, we are interested in understanding both empirically and theoretically how overparameterization affects MI in classification. [25,34] show that pruning a network can improve MI robustness. [27] show empirically that MI tends to be easier on more challenging learning tasks.…”

Section: Related Workmentioning

confidence: 99%

Benign Overparameterization in Membership Inference with Early Stopping

Tan¹,

LeJeune²,

Mason³

et al. 2022

Preprint

View full text Add to dashboard Cite

Does a neural network's privacy have to be at odds with its accuracy? In this work, we study the effects the number of training epochs and parameters have on a neural network's vulnerability to membership inference (MI) attacks, which aim to extract potentially private information about the training data. We first demonstrate how the number of training epochs and parameters individually induce a privacy-utility trade-off: more of either improves generalization performance at the expense of lower privacy. However, remarkably, we also show that jointly tuning both can eliminate this privacy-utility trade-off. Specifically, with careful tuning of the number of training epochs, more overparameterization can increase model privacy for fixed generalization error. To better understand these phenomena theoretically, we develop a powerful new leave-one-out analysis tool to study the asymptotic behavior of linear classifiers and apply it to characterize the sample-specific loss threshold MI attack in high-dimensional logistic regression. For practitioners, we introduce a low-overhead procedure to estimate MI risk and tune the number of training epochs to guard against MI attacks.

show abstract

Section: Related Workmentioning

confidence: 99%

Benign Overparameterization in Membership Inference with Early Stopping

Tan¹,

LeJeune²,

Mason³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

Critical Analysis of Privacy Risks in Machine Learning and Implications for Use of Health Data: A systematic review and meta-analysis on membership inference attacks

Walker,

Bu,

Pakseresht

et al. 2023

Preprint

View full text Add to dashboard Cite

Purpose. Machine learning(ML) has revolutionized data processing and analysis, with applications in health showing great promise. However, ML poses privacy risks, as models may reveal information about their training data. Developing frameworks to assess/mitigate privacy risks is essential, particularly for health data custodians responsible for adhering to ethical and legal standards in data use. In September 2022, we conducted a systematic review/meta-analysis to estimate the relative effects of factors hypothesized to contribute to ML privacy risk, focusing on membership inference attacks (MIA). Methods. Papers were screened for relevance to MIA, and selected for the meta-analysis if they contained attack performance(AP) metrics for attacks on models trained on numeric data. Random effects regression was used to estimate the adjusted average change in AP by model type, generalization gap and the density of training data in each region of input space (partitioned density). Residual sum of squares was used to determine the importance of variables on AP. Results. The systematic review and meta-analysis included 115 and 42 papers, respectively, comprising 1,910 experiments. The average AP ranged from 61.0% (95%CI:60.0%-63.0%; AUC)-74.0% (95%CI:72.0%-76.0%; recall). Higher partitioned density was inversely associated with AP for all model architectures, with the largest effect on decision trees. Higher generalization gap was linked to increased AP, predominantly affecting neural networks. Partitioned density was a better predictor of AP than generalization gap for most architectures. Conclusions. This is the first quantitative synthesis of MIA experiments, that highlights the effect of dataset composition on AP, particularly on decision trees, which are commonly used in health.

show abstract

Membership Inference Attacks and Defenses in Neural Network Pruning

Cited by 2 publications

References 29 publications

Benign Overparameterization in Membership Inference with Early Stopping

Benign Overparameterization in Membership Inference with Early Stopping

Critical Analysis of Privacy Risks in Machine Learning and Implications for Use of Health Data: A systematic review and meta-analysis on membership inference attacks

Contact Info

Product

Resources

About