Robust Membership Encoding: Inference Attacks and Copyright Protection for Deep Learning
arXiv:1909.12982
Abstract
Machine learning as a service (MLaaS), and algorithm marketplaces are on a rise. Data holders can easily train complex models on their data using third party provided learning codes. Training accurate ML models requires massive labeled data and advanced learning algorithms. The resulting models are considered as intellectual property of the model owners and their copyright should be protected. Also, MLaaS needs to be trusted not to embed secret information about the training data into the model, such that it could be later retrieved when the model is deployed. In this paper, we present \emph{membership encoding} for training deep neural networks and encoding the membership information, i.e. whether a data point is used for training, for a subset of training data. Membership encoding has several applications in different scenarios, including robust watermarking for model copyright protection, and also the risk analysis of stealthy data embedding privacy attacks. Our encoding algorithm can determine the membership of significantly redacted data points, and is also robust to model compression and fine-tuning. It also enables encoding a significant fraction of the training set, with negligible drop in the model's prediction accuracy.
References in corpus (9)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
- Compressing Neural Networks with the Hashing Trick
- A Closer Look at Memorization in Deep Networks
- Understanding Membership Inferences on Well-Generalized Learning Models
- DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models
- Stealing Hyperparameters in Machine Learning
- DeepMarks: A Digital Fingerprinting Framework for Deep Neural Networks
- Machine Learning Models that Remember Too Much