[论文解读] Ultimate Power of Inference Attacks: Privacy Risks of Learning High-Dimensional Graphical Models

Sasi Kumar Murakonda, Reza Shokri+1 more|arXiv (Cornell University)|May 29, 2019

Privacy-Preserving Technologies in Data参考文献 5被引用 3

一句话总结

本文提出一个理论框架，用于在不依赖特定攻击方法或训练数据的前提下，界定高维概率图模型上成员推断攻击的最大功率。该框架推导出真阳性率的紧致上界，作为模型复杂度和训练集大小的函数，量化了固有的隐私泄露，并指导模型设计以降低风险。

ABSTRACT

Models leak information about their training data. This enables attackers to infer sensitive information about their training sets, notably determine if a data sample was part of the model's training set. The existing works empirically show the possibility of these tracing (membership inference) attacks against complex models with a large number of parameters. However, the attack results are dependent on the specific training data, can be obtained only after the tedious process of training the model and performing the attack, and are missing any measure of the confidence and unused potential power of the attack. A model designer is interested in identifying which model structures leak more information, how adding new parameters to the model increases its privacy risk, and what is the gain of adding new data points to decrease the overall information leakage. The privacy analysis should also enable designing the most powerful inference attack. In this paper, we design a theoretical framework to analyze the maximum power of tracing attacks against high-dimensional models, with the focus on probabilistic graphical models. We provide a tight upper-bound on the power (true positive rate) of these attacks, with respect to their error (false positive rate). The bound, as it should be, is independent of the knowledge and algorithm of any specific attack, as well as the values of particular samples in the training set. It provides a measure of the potential leakage of a model given its structure, as a function of the structure complexity and the size of training set.

研究动机与目标

• 解决目前对高维模型上成员推断攻击最大可能能力缺乏理论理解的问题。
• 量化模型结构固有的隐私风险，且独立于训练数据或特定攻击算法。
• 提供一个衡量模型复杂度与训练集大小如何共同影响信息泄露和攻击潜力的指标。
• 指导模型设计者在选择架构时最小化隐私泄露风险。
• 通过识别理论上可实现的极限，使设计最强大推断攻击成为可能。

提出的方法

• 利用信息论原理，推导出成员推断攻击真阳性率的理论紧致上界。
• 将该上界表述为模型结构复杂度和训练集大小的函数，且不依赖于特定数据或攻击方法。
• 将该上界应用于概率图模型，重点关注现代机器学习中常见的高维场景。
• 使用统计决策理论刻画真阳性率与假阳性率之间的最优权衡。
• 证明该上界是紧致且普遍适用的，无论攻击者掌握何种知识或使用何种算法。
• 表明该上界反映了模型架构和训练数据规模所固有的最大信息泄露量。

实验结果

研究问题

• RQ1 高维图模型上成员推断攻击的理论最大功率（真阳性率）是多少？
• RQ2 模型复杂度如何影响攻击性能的上界，且独立于训练数据？
• RQ3 训练集大小如何影响信息泄露和攻击成功率的上界？
• RQ4 能否推导出一种与数据无关、普遍适用的上界，以捕捉任何推断攻击的最大潜力？
• RQ5 模型设计者如何利用该上界在架构选择阶段最小化隐私风险？

主要发现

• 本文建立了成员推断攻击真阳性率的紧致、普遍适用的上界，且独立于具体攻击算法或训练数据。
• 该上界仅依赖于模型结构复杂度和训练集大小，提供了一种固有隐私泄露的理论度量。
• 该上界揭示了在缺乏足够数据的情况下，仅增加模型复杂度就会放大隐私风险，甚至在训练前即已存在。
• 该框架确定了攻击能力的理论极限，表明无论攻击算法多么复杂，均无法突破此上界。
• 该上界使模型设计者能够在训练前预测并比较不同架构的隐私风险。
• 结果表明，增加训练数据可降低攻击能力的上界，从而量化了数据规模带来的隐私收益。