Defending Model Inversion and Membership Inference Attacks via Prediction Purification

Abstract

Neural networks are susceptible to data inference attacks such as the model inversion attack and the membership inference attack, where the attacker could infer the reconstruction and the membership of a data sample from the confidence scores predicted by the target classifier. In this paper, we propose a unified approach, namely purification framework, to defend data inference attacks. It purifies the confidence score vectors predicted by the target classifier by reducing their dispersion. The purifier can be further specialized in defending a particular attack via adversarial learning. We evaluate our approach on benchmark datasets and classifiers. We show that when the purifier is dedicated to one attack, it naturally defends the other one, which empirically demonstrates the connection between the two attacks. The purifier can effectively defend both attacks. For example, it can reduce the membership inference accuracy by up to 15% and increase the model inversion error by a factor of up to 4. Besides, it incurs less than 0.4% classification accuracy drop and less than 5.5% distortion to the confidence scores.

updated experiments and results

References in corpus (13)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Deep Learning with Differential Privacy
• Popular Ensemble Methods: An Empirical Study
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Adversarially Learned Inference
• Understanding Membership Inferences on Well-Generalized Learning Models
• Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference
• Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
• Towards Measuring Membership Privacy
• Towards Reverse-Engineering Black-Box Neural Networks
• The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks
• Machine Learning with Membership Privacy using Adversarial Regularization

Cited by in corpus (8)

• Label-Only Membership Inference Attacks
• Bilateral Dependency Optimization: Defending Against Model-inversion Attacks
• Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture
• Membership Leakage in Label-Only Exposures
• TransMIA: Membership Inference Attacks Using Transfer Shadow Training
• Introducing Model Inversion Attacks on Automatic Speaker Recognition
• Black-box Model Inversion Attribute Inference Attacks on Classification Models
• Improving Robustness to Model Inversion Attacks via Mutual Information Regularization