Provable Privacy Attacks on Trained Shallow Neural Networks
We study what provable privacy attacks can be shown on trained, 2-layer ReLU neural networks. We explore two types of attacks; data reconstruction attacks, and membership inference attacks. We prove that theoretical results on the implicit bias of 2-layer neural networks can be used to provably reconstruct a set of which at least a constant fraction are training points in a univariate setting, and can also be used to identify with high probability whether a given point was used in the training set in a high dimensional setting. To the best of our knowledge, our work is the first to show provable vulnerabilities in this implicit-bias-driven setting.
Code (1)
Methods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
Privacy-Preserving Debiasing using Data Augmentation and Machine Unlearning
Data augmentation is widely used to mitigate data bias in the training dataset. However, data augmentation exposes machine learning models to privacy attacks, such as membership inference attacks. In this paper, we propo…
Data AugmentationFairnessMachine UnlearningPrivacy PreservingEvaluations of Machine Learning Privacy Defenses are Misleading
Empirical defenses for machine learning privacy forgo the provable guarantees of differential privacy in the hope of achieving higher utility while resisting realistic adversaries. We identify severe pitfalls in existing…
Differentially Private Instance Encoding against Privacy Attacks
TextHide was recently proposed to protect the training data via instance encoding in natural language domain. Due to the lack of theoretic privacy guarantee, such instance encoding scheme has been shown to be vulnerable …
Reconstruction AttackEvading classifiers in discrete domains with provable optimality guarantees
Machine-learning models for security-critical applications such as bot, malware, or spam detection, operate in constrained discrete domains. These applications would benefit from having provable guarantees against advers…
Adversarial RobustnessSpam detectionTwitter Bot DetectionvalidHeterogeneous Gaussian Mechanism: Preserving Differential Privacy in Deep Learning with Provable Robustness
In this paper, we propose a novel Heterogeneous Gaussian Mechanism (HGM) to preserve differential privacy in deep neural networks, with provable robustness against adversarial examples. We first relax the constraint of t…