This study examines how model architecture affects deep learning model privacy.
problem Privacy concerns in deep learning models due to potential leakage of sensitive information.
method Investigation of CNNs and Transformers, focusing on activation layers, stem layers, LN layers, and attention modules.
result Transformers generally exhibit higher vulnerability to privacy attacks than CNNs.
New method compares DP mechanisms beyond (ε,δ) pairs.
problem Current DP mechanism comparisons overlook substantial differences.
method Introduces Δ-divergence for robust comparison. result Demonstrates gaps in current DP-SGD practices.
Generative text classifiers are most vulnerable to membership inference attacks.
problem Privacy threat from Membership Inference Attacks on generative text classifiers.
method Comprehensive empirical evaluation of generative, discriminative, and pseudo-generative classifiers across various datasets.
result Generative classifiers explicitly modeling P(X,Y) are most vulnerable to membership leakage. A membership inference attack (MIA) against a machine-learning model enables an attacker to determine whether a given data record was part of the model's training data or not. In this paper, we provide an in-depth study of the phenomenon of disparate vulnerability against MIAs: unequal success rate of MIAs against diff…
New method assesses individual training points' privacy risk without retraining.
problem Privacy vulnerability of individual training points in membership inference attacks.
method Derives a closed-form decomposition of individual black-box MIA vulnerability, extending to deep networks.
result Proposes a surrogate score operating on last-layer representations that requires only a single trained model.
New mechanism protects neural network weights from privacy attacks during self-supervised learning.
problem Privacy risks during fine-tuning stage of self-supervised learning.
method Proposes a novel differential privacy mechanism using additive logistic noise.
result Reduces membership inference attack accuracy to 50% while maintaining below 5% performance loss.
Overparameterized models are more vulnerable to membership inference attacks.
problem Vulnerability of overparameterized models to membership inference attacks.
method Theoretical and empirical analysis of overparameterized linear and ridge-regularized linear regression models in the Gaussian data setting.
result Increased number of parameters and model complexity increase vulnerability to membership inference attacks.
Regularization can improve both privacy and performance in machine learning models.
problem Privacy vs. Utility trade-off in machine learning models.
method The study uses logistic regression with ridge regularization and a leave-one-out analysis tool.
result Increasing the number of parameters can improve both privacy and performance when coupled with proper regularization.
Membership inference attacks seek to infer the membership of individual training instances of a privately trained model. This paper presents a membership privacy analysis and evaluation system, called MPLens, with three unique contributions. First, through MPLens, we demonstrate how membership inference attack methods …
In this paper, we propose FedGP, a framework for privacy-preserving data release in the federated learning setting. We use generative adversarial networks, generator components of which are trained by FedAvg algorithm, to draw privacy-preserving artificial data samples and empirically assess the risk of information dis…
Adversarial training was introduced as a way to improve the robustness of deep learning models to adversarial attacks. This training method improves robustness against adversarial attacks, but increases the models vulnerability to privacy attacks. In this work we demonstrate how model inversion attacks, extracting trai…
New approach connects robust learning to privacy issues.
problem Vulnerability of deep neural networks to adversarial examples.
method Privacy-utility tradeoff and rate-distortion theory.
result Found saddle point via maximum conditional entropy problem.
Face recognition systems are vulnerable to composite face reconstruction attacks.
problem Vulnerability of face recognition systems to composite face reconstruction attacks.
method Assumed attacker uses composite face parts to reconstruct faces faster and more efficiently.
result Current face recognition systems are extremely vulnerable to random search attacks.
The paper analyzes privacy leakage in federated learning using linear algebra and optimization theory.
problem Privacy leakage in federated learning despite its promise for data privacy.
method Theoretical analysis from linear algebra and optimization theory perspectives.
result Derives sufficient conditions to prevent data reconstruction attacks and establishes an upper bound on privacy leakage.
New privacy method for eye tracking data reduces correlations and maintains accuracy.
problem Privacy concerns in eye tracking data from VR/AR glasses.
method Transform-coding based differential privacy mechanism for eye movement data.
result Significant reductions in sample correlations and query sensitivities, providing high privacy without loss in accuracy.
Paper presents privacy-preserving techniques for HD computing.
problem Privacy loss in HD computing due to reversible computation.
method Quantization and pruning of hypervectors for differential privacy.
result Differentially private HD model for cloud inference.
Log-Loss scores expose membership privacy breaches.
problem Privacy leakage from statistical aggregates like Log-Loss scores.
method Proved that Log-Loss scores enable full accuracy membership inference in a single query.
result Complete membership privacy breach is possible with Log-Loss scores.
Survey on privacy issues in deep learning and proposed solutions.
problem Privacy concerns in deep learning models due to sensitive data.
method Review of existing privacy techniques and gaps in research.
result Identification of test-time inference privacy as a research gap.
This paper introduces a novel approach to measuring privacy risks in deep computer vision models based on intermediate outputs.
problem The exposure of intermediate results in hidden layers of deep computer vision models poses significant privacy concerns.
method The approach leverages Degrees of Freedom (DoF) to evaluate the amount of information retained in each layer and combines this with the rank of the Jacobian matrix to assess sensitivity to input variations.
result The proposed framework provides deeper insights into privacy risks associated with intermediate representations without requiring adversarial attack simulations.
A new federated learning method protects privacy in mobile crowdsensing.
problem Data and model privacy protection in federated extreme gradient boosting for mobile crowdsensing.
method Secret sharing based federated learning architecture FedXGB.
result FedXGB achieves less than 1% accuracy loss while preserving model privacy.
Federated learning is a recent advance in privacy protection. In this context, a trusted curator aggregates parameters optimized in decentralized fashion by multiple clients. The resulting model is then distributed back to all clients, ultimately converging to a joint representative model without explicitly having to s…
LoRA and privacy: Random projections help but not always.
problem Ensuring differential privacy in LoRA fine-tuning.
method Wishart projection mechanism and noisy variants.
result LoRA is not inherently private, but low-rank fine-tuning can be more private.
edPLS adds Gaussian noise to PLS regression to protect data privacy.
problem Protecting sensitive data in PLS regression models.
method Integrates Gaussian noise into PLS algorithm based on global sensitivity.
result Effective at preserving privacy while maintaining competitive prediction accuracy.
Survey on threats to federated learning models.
problem Vulnerabilities in federated learning protocols.
method Taxonomy of threat models and attacks.
result Important future research directions.
This paper improves privacy and fairness in federated learning by protecting sensitive data and ensuring group fairness.
problem Privacy and fairness issues in federated learning.
method Introduces group privacy through d-privacy, a localized form of differential privacy. result The method provides better group fairness than a global model in federated learning.
This paper analyzes FL privacy risks and defensive strategies.
problem Privacy leakage in federated learning.
method Literature review of attack methods and defensive strategies.
result No single defensive strategy is sufficient for all attacks.
PRIME algorithm estimates mean while ensuring privacy and robustness.
problem Privacy and robustness in shared data analysis.
method Introduces PRIME, the first efficient algorithm for both privacy and robustness.
result Achieves both privacy and robustness for a wide range of distributions.
New method improves privacy risk evaluation of machine learning models.
problem Machine learning models can be vulnerable to membership inference attacks.
method Proposed new inference attack method based on prediction entropy, and introduced privacy risk score metric.
result Existing defense approaches are not as effective as previously reported.
Federated learning facilitates the collaborative training of models without the sharing of raw data. However, recent attacks demonstrate that simply maintaining data locality during training processes does not provide sufficient privacy guarantees. Rather, we need a federated learning system capable of preventing infer…
Challenge hides and seeks privacy in clinical time-series data.
problem De-identifying clinical time-series data while preserving utility and privacy.
method Synthetic data generation to preserve temporal dynamics and limit re-identification risk.
result A novel competition tracks synthetic data generation and patient re-identification.
Backdoor attacks can poison federated meta-learning models, even with few examples.
problem Backdoor attacks on federated meta-learning models.
method Proposed a defense mechanism inspired by matching networks.
result Backdoor attacks can be very successful and persist after additional training in federated meta-learning.
Study quantized models' privacy against membership inference attacks.
problem Privacy risk in quantized machine learning models.
method Proposed a new MIS indicator for post-training quantization procedures, minimizing empirical loss.
result Demonstrated effectiveness of new MIS indicator in assessing and ranking privacy risk.
A privacy-preserving method for transmitting data over a wiretap channel using generative networks.
problem Privacy protection in communication over a wiretap channel.
method Data-driven approach using variational autoencoder (VAE)-based joint source channel coding (JSCC).
result The approach provides high reconstruction quality at the receiver while confusing the eavesdropper about the latent sensitive attribute.
Machine learning has been widely applied to various applications, some of which involve training with privacy-sensitive data. A modest number of data breaches have been studied, including credit card information in natural language data and identities from face dataset. However, most of these studies focus on supervise…
Recent years have witnessed widespread adoption of machine learning (ML)/deep learning (DL) techniques due to their superior performance for a variety of healthcare applications ranging from the prediction of cardiac arrest from one-dimensional heart signals to computer-aided diagnosis (CADx) using multi-dimensional me…
Deep learning model developers often use cloud GPU resources to experiment with large data and models that need expensive setups. However, this practice raises privacy concerns. Adversaries may be interested in: 1) personally identifiable information or objects encoded in the training images, and 2) the models trained …
Unified framework for analyzing model stealing attacks and defenses.
problem Vulnerability of ML applications to model stealing attacks.
method Developed a rigorous threat model and evaluation criteria, proposed methods to quantify attack and defense strategies.
result Demonstrated the importance of attack-specific perturbations for effective defenses.
Diffusion models can memorize training data, limiting their creativity and privacy.
problem Memorization in diffusion models that reproduces training data instead of generating novel outputs.
method Dual-separation approach via statistical estimation and network approximation.
result Pruning-based method reduces memorization while maintaining generation quality.
Kernel two-sample testing is a useful statistical tool in determining whether data samples arise from different distributions without imposing any parametric assumptions on those distributions. However, raw data samples can expose sensitive information about individuals who participate in scientific studies, which make…
New framework UIFV reconstructs private features in VFL without model details.
problem Privacy risks in VFL where adversaries can reconstruct sensitive features.
method Unified InverNet Framework (UIFV) that uses intermediate feature data.
result Significantly outperforms state-of-the-art techniques in attack precision.
Mobility datasets are fundamental for evaluating algorithms pertaining to geographic information systems and facilitating experimental reproducibility. But privacy implications restrict sharing such datasets, as even aggregated location-data is vulnerable to membership inference attacks. Current synthetic mobility data…
Most industrial recommender systems rely on the popular collaborative filtering (CF) technique for providing personalized recommendations to its users. However, the very nature of CF is adversarial to the idea of user privacy, because users need to share their preferences with others in order to be grouped with like-mi…
Adversarial examples that fool machine learning models, particularly deep neural networks, have been a topic of intense research interest, with attacks and defenses being developed in a tight back-and-forth. Most past defenses are best effort and have been shown to be vulnerable to sophisticated attacks. Recently a set…
Pruning improves DNNs against MIA while reducing model size and computation.
problem Vulnerability of DNNs to membership inference attacks (MIA).
method Proposes a pruning algorithm to reduce model size and computational operations.
result Pruned subnetwork prevents privacy leakage from MIA with competitive accuracy.
Few-shot DP image classification models need more data as privacy increases.
problem Few-shot DP image classification challenges in personalization and federated learning.
method Exhaustive experiments on various parameters affecting few-shot DP accuracy and vulnerability.
result Increasing shots per class is necessary for DP accuracy as privacy increases.
With the increasing adoption of AI, inherent security and privacy vulnerabilities formachine learning systems are being discovered. One such vulnerability makes itpossible for an adversary to obtain private information about the types of instancesused to train the targeted machine learning model. This so-called model i…
Secure sum outperforms homomorphic encryption in collaborative deep learning.
problem Training deep learning models on private data from multiple parties without revealing the data.
method Used a secure sum protocol in conjunction with default secure channels.
result Secure sum protocol provides superior properties in terms of collusion-resistance and runtime.
New method bounds membership inference attack success using mutual information.
problem Vulnerability of deep neural networks to membership inference attacks.
method Extended Fano's inequality to measure mutual information between inputs and activations.
result Empirical evaluation shows strong correlation between mutual information and model susceptibility.