[Paper Review] Membership Privacy for Machine Learning Models Through Knowledge Transfer

Virat Shejwalkar, Amir Houmansadr|arXiv (Cornell University)|Jun 15, 2019

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes Distillation for Membership Privacy (DMP), a knowledge distillation-based defense that enhances membership privacy in machine learning models without sacrificing classification accuracy. By selecting reference data with low prediction entropy from an unprotected teacher model, DMP transfers soft labels to a student model, achieving state-of-the-art privacy-utility tradeoffs—e.g., 65.3% accuracy on CIFAR100 with 53.7% MIA risk, outperforming adversarial regularization by 100% in accuracy under similar privacy levels.

ABSTRACT

Large capacity machine learning (ML) models are prone to membership inference attacks (MIAs), which aim to infer whether the target sample is a member of the target model's training dataset. The serious privacy concerns due to the membership inference have motivated multiple defenses against MIAs, e.g., differential privacy and adversarial regularization. Unfortunately, these defenses produce ML models with unacceptably low classification performances. Our work proposes a new defense, called distillation for membership privacy (DMP), against MIAs that preserves the utility of the resulting models significantly better than prior defenses. DMP leverages knowledge distillation to train ML models with membership privacy. We provide a novel criterion to tune the data used for knowledge transfer in order to amplify the membership privacy of DMP. Our extensive evaluation shows that DMP provides significantly better tradeoffs between membership privacy and classification accuracies compared to state-of-the-art MIA defenses. For instance, DMP achieves ~100% accuracy improvement over adversarial regularization for DenseNet trained on CIFAR100, for similar membership privacy (measured using MIA risk): when the MIA risk is 53.7%, adversarially regularized DenseNet is 33.6% accurate, while DMP-trained DenseNet is 65.3% accurate.

Motivation & Objective

• To address the poor privacy-utility tradeoffs in existing defenses against membership inference attacks (MIAs).
• To develop a defense that preserves model utility while significantly reducing membership leakage.
• To leverage knowledge distillation as a standalone technique for membership privacy, rather than combining it with differential privacy.
• To provide a criterion for selecting or generating reference data that amplifies membership privacy.
• To evaluate the robustness of DMP against adaptive attacks and privacy leakage from reference data.

Proposed method

• Train an unprotected teacher model on the private training data to capture memorized patterns.
• Select or generate reference data such that the teacher model's predictions on it have low entropy, minimizing membership information leakage.
• Use knowledge distillation to transfer soft labels from the teacher to a protected student model trained on the reference data.
• Use the same architecture for both teacher and student models to preserve performance and enable effective distillation.
• Apply a temperature scaling in the softmax layer of the teacher model to further reduce prediction confidence and leakage.
• Relax the need for real reference data by synthesizing it via GANs, preserving privacy and performance.

Experimental results

Research questions

• RQ1 Can knowledge distillation be used as a standalone defense to improve membership privacy-utility tradeoffs?
• RQ2 How does the entropy of model predictions on reference data affect membership inference risk?
• RQ3 Can synthetic reference data generated from training data maintain strong privacy and utility?
• RQ4 How does DMP compare to state-of-the-art defenses like adversarial regularization and PATE in terms of accuracy and MIA resistance?
• RQ5 Can adaptive membership inference attacks exploit the reference data selection mechanism in DMP?

Key findings

• DMP achieves 65.3% test accuracy on DenseNet with 53.7% MIA risk on CIFAR100, representing a 100% accuracy improvement over adversarially regularized models (33.6%) at similar privacy levels.
• With synthetic reference data, DMP maintains strong performance: 57.5% test accuracy and 52.1% whitebox MIA accuracy on CIFAR10 with 37.5k synthetic samples.
• The use of low-entropy predictions on reference data significantly reduces membership inference risk, with MIA risk dropping to 5.0% when using 37.5k synthetic samples.
• DMP outperforms PATE in both accuracy and privacy: DMP achieves 76.79% test accuracy and 50.8% whitebox MIA accuracy, while PATE’s performance remains low even at high privacy budgets.
• Adaptive attacks based on feature-space proximity to reference data show no significant advantage, as proximity does not correlate with prediction entropy, indicating robustness to such strategies.
• Reference data itself does not leak membership information, as the soft labels used for distillation obscure ground-truth labels, preventing successful MIAs on $X_{\mathsf{ref}}$.