Is Private Learning Possible with Instance Encoding?
arXiv:2011.05315
Abstract
A private machine learning algorithm hides as much as possible about its training data while still preserving accuracy. In this work, we study whether a non-private learning algorithm can be made private by relying on an instance-encoding mechanism that modifies the training inputs before feeding them to a normal learner. We formalize both the notion of instance encoding and its privacy by providing two attack models. We first prove impossibility results for achieving a (stronger) model. Next, we demonstrate practical attacks in the second (weaker) attack model on InstaHide, a recent proposal by Huang, Song, Li and Arora [ICML'20] that aims to use instance encoding for privacy.
References in corpus (8)
- Deep Learning with Differential Privacy
- mixup: Beyond Empirical Risk Minimization
- CryptoDL: Deep Neural Networks over Encrypted Data
- Practical Secure Aggregation for Federated Learning on User-Held Data
- Understanding Membership Inferences on Well-Generalized Learning Models
- Local Privacy, Data Processing Inequalities, and Statistical Minimax Rates
- Towards Measuring Membership Privacy
- Image Obfuscation for Privacy-Preserving Machine Learning
Cited by in corpus (8)
- DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentations
- A Fusion-Denoising Attack on InstaHide with Data Augmentation
- Practical and Secure Federated Recommendation with Personalized Masks
- InstaHide's Sample Complexity When Mixing Two Private Images
- Defending Medical Image Diagnostics against Privacy Attacks using Generative Methods
- Disrupting Model Training with Adversarial Shortcuts
- NeuraCrypt: Hiding Private Health Data via Random Neural Networks for Public Training
- Privacy and Integrity Preserving Training Using Trusted Hardware