Measuring Data Leakage in Machine-Learning Models with Fisher Information

Abstract

Machine-learning models contain information about the data they were trained on. This information leaks either through the model itself or through predictions made by the model. Consequently, when the training data contains sensitive attributes, assessing the amount of information leakage is paramount. We propose a method to quantify this leakage using the Fisher information of the model about the data. Unlike the worst-case a priori guarantees of differential privacy, Fisher information loss measures leakage with respect to specific examples, attributes, or sub-populations within the dataset. We motivate Fisher information loss through the Cramér-Rao bound and delineate the implied threat model. We provide efficient methods to compute Fisher information loss for output-perturbed generalized linear models. Finally, we empirically validate Fisher information loss as a useful measure of information leakage.

References in corpus (7)

• Renyi Differential Privacy
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• Understanding Membership Inferences on Well-Generalized Learning Models
• Gaussian Differential Privacy
• Towards Measuring Membership Privacy
• Modelling and Quantifying Membership Information Leakage in Machine Learning
• Black-box Model Inversion Attribute Inference Attacks on Classification Models

Cited by in corpus (2)

• Seismic Facies Analysis: A Deep Domain Adaptation Approach
• Fundamental Limits of Membership Inference Attacks on Machine Learning Models