Membership Privacy in MicroRNA-based Studies

Backes, Michael; Berrang, Pascal; Humbert, Mathias; Manoharan, Praveen

doi:10.1145/2976749.2978355

Cited by 116 publications

(96 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Major Internet companies now offer machine learning as a service on their cloud platforms. Examples include Google Prediction API, 1 Amazon Machine Learning (Amazon ML), 2 Microsoft Azure Machine Learning (Azure ML), 3 and BigML. 4 These platforms provide simple APIs for uploading the data and for training and querying models, thus making machine learning technologies available to any customer.…”

Section: Machine Learning Backgroundmentioning

confidence: 99%

“…As explained in [27] and Section IX, model inversion does not produce an actual member of the model's training dataset, nor, given a record, does it infer whether this record was in the training dataset. By contrast, the membership inference problem we study in this paper is essentially the same as the well-known problem of identifying the presence of an individual's data in a mixed pool given some statistics about the pool [3], [15], [21], [29]. In our case, however, the goal is to infer membership given a black-box API to a model of unknown structure, as opposed to explicit statistics.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Membership Inference Attacks Against Machine Learning Models

Shokri

Stronati

Song

et al. 2017

2017 IEEE Symposium on Security and Privacy (SP)

2,767

2,817

View full text Add to dashboard Cite

Abstract-We quantitatively investigate how machine learning models leak information about the individual data records on which they were trained. We focus on the basic membership inference attack: given a data record and black-box access to a model, determine if the record was in the model's training dataset. To perform membership inference against a target model, we make adversarial use of machine learning and train our own inference model to recognize differences in the target model's predictions on the inputs that it trained on versus the inputs that it did not train on.We empirically evaluate our inference techniques on classification models trained by commercial "machine learning as a service" providers such as Google and Amazon. Using realistic datasets and classification tasks, including a hospital discharge dataset whose membership is sensitive from the privacy perspective, we show that these models can be vulnerable to membership inference attacks. We then investigate the factors that influence this leakage and evaluate mitigation strategies.

show abstract

Section: Machine Learning Backgroundmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Membership Inference Attacks Against Machine Learning Models

Shokri

Stronati

Song

et al. 2017

2017 IEEE Symposium on Security and Privacy (SP)

2,767

2,817

View full text Add to dashboard Cite

show abstract

“…The comparison can be done by using statistical testing methods such as log-likelihood ratio test. Later, several works performed similar membership inference attacks against other types of biomedical data such as MicroRNA [4] and DNA methylation [20]. Recently, Pyrgelis et al [52,53] further showed that membership inference can also be performed effectively against location databases.…”

Section: Related Work 21 Membership Inferencementioning

confidence: 99%

MemGuard

Jia

Salem

Backes

et al. 2019

Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

Self Cite

213

View full text Add to dashboard Cite

In a membership inference attack, an attacker aims to infer whether a data sample is in a target classifier's training dataset or not. Specifically, given a black-box access to the target classifier, the attacker trains a binary classifier, which takes a data sample's confidence score vector predicted by the target classifier as an input and predicts the data sample to be a member or non-member of the target classifier's training dataset. Membership inference attacks pose severe privacy and security threats to the training dataset. Most existing defenses leverage differential privacy when training the target classifier or regularize the training process of the target classifier. These defenses suffer from two key limitations: 1) they do not have formal utility-loss guarantees of the confidence score vectors, and 2) they achieve suboptimal privacy-utility tradeoffs.In this work, we propose MemGuard, the first defense with formal utility-loss guarantees against black-box membership inference attacks. Instead of tampering the training process of the target classifier, MemGuard adds noise to each confidence score vector predicted by the target classifier. Our key observation is that attacker uses a classifier to predict member or non-member and classifier is vulnerable to adversarial examples. Based on the observation, we propose to add a carefully crafted noise vector to a confidence score vector to turn it into an adversarial example that misleads the attacker's classifier. Specifically, MemGuard works in two phases. In Phase I, MemGuard finds a carefully crafted noise vector that can turn a confidence score vector into an adversarial example, which is likely to mislead the attacker's classifier to make a random guessing at member or non-member. We find such carefully crafted noise vector via a new method that we design to incorporate the unique utility-loss constraints on the noise vector. In Phase II, Mem-Guard adds the noise vector to the confidence score vector with a certain probability, which is selected to satisfy a given utility-loss budget on the confidence score vector. Our experimental results on Permission to make digital three datasets show that MemGuard can effectively defend against membership inference attacks and achieve better privacy-utility tradeoffs than existing defenses. Our work is the first one to show that adversarial examples can be used as defensive mechanisms to defend against membership inference attacks.

show abstract

“…Several attacks against genomic privacy have been described in the literature. Using genomic information, such as single nucleotide polymorphisms (SNPs), short tandem repeats, disease related genes, and possibly different kinds of publicly available personal details, these attacks fit into one of several categories: re-identification attacks [4], [5], [6], [7], [8], recovery attacks [9], and membership attacks [10], [11], [12]. These genomic privacy attacks alerted the research community for the need to replace the conventional procedures by privacy-preserving frameworks.…”

Section: Introductionmentioning

confidence: 99%

“…More recent attacks studied the sensitivity of other types of biological data. For example, it has been shown that miRNA data can be used in membership attacks [12].…”

Section: Introductionmentioning

confidence: 99%

Accurate Filtering of Privacy-Sensitive Information in Raw Genomic Data

Decouchant

Fernandes

Voelp

et al. 2018

Preprint

View full text Add to dashboard Cite

Sequencing thousands of human genomes has enabled breakthroughs in many areas, among them precision medicine, the study of rare diseases, and forensics. However, mass collection of such sensitive data entails enormous risks if not protected to the highest standards. In this article, we follow the position and argue that post-alignment privacy is not enough and that data should be automatically protected as early as possible in the genomics workflow, ideally immediately after the data is produced. We show that a previous approach for filtering short reads cannot extend to long reads and present a novel filtering approach that classifies raw genomic data (i.e., whose location and content is not yet determined) into privacy-sensitive (i.e., more affected by a successful privacy attack) and non-privacy-sensitive information. Such a classification allows the fine-grained and automated adjustment of protective measures to mitigate the possible consequences of exposure, in particular when relying on public clouds. We present the first filter that can be indistinctly applied to reads of any length, i.e., making it usable with any recent or future sequencing technologies. The filter is accurate, in the sense that it detects all known sensitive nucleotides except those located in highly variable regions (less than 10 nucleotides remain undetected per genome instead of 100,000 in previous works). It has far less false positives than previously known methods (10% instead of 60%) and can detect sensitive nucleotides despite sequencing errors (86% detected instead of 56% with 2% of mutations). Finally, practical experiments demonstrate high performance, both in terms of throughput and memory consumption.

show abstract

Membership Privacy in MicroRNA-based Studies

Cited by 116 publications

References 26 publications

Membership Inference Attacks Against Machine Learning Models

Membership Inference Attacks Against Machine Learning Models

MemGuard

Accurate Filtering of Privacy-Sensitive Information in Raw Genomic Data

Contact Info

Product

Resources

About