[论文解读] Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture

Xinyu Tang, Saeed Mahloujifar+5 more|arXiv (Cornell University)|Oct 15, 2021

Privacy-Preserving Technologies in Data参考文献 55被引用 22

一句话总结

本文提出 SELENA，一种新颖的防御框架，结合了 Split-AI 集成架构与自蒸馏技术，以增强机器学习模型中的成员隐私。通过在随机数据子集上训练子模型，并自适应地聚合未包含输入样本的子模型的预测结果，SELENA 相较于 MemGuard 将成员推理攻击的成功率降低最多 3.7 倍，相较于对抗正则化降低最多 2.1 倍，同时在基准数据集上的准确率下降不超过 3.9%。

ABSTRACT

Membership inference attacks are a key measure to evaluate privacy leakage in machine learning (ML) models. These attacks aim to distinguish training members from non-members by exploiting differential behavior of the models on member and non-member inputs. The goal of this work is to train ML models that have high membership privacy while largely preserving their utility; we therefore aim for an empirical membership privacy guarantee as opposed to the provable privacy guarantees provided by techniques like differential privacy, as such techniques are shown to deteriorate model utility. Specifically, we propose a new framework to train privacy-preserving models that induces similar behavior on member and non-member inputs to mitigate membership inference attacks. Our framework, called SELENA, has two major components. The first component and the core of our defense is a novel ensemble architecture for training. This architecture, which we call Split-AI, splits the training data into random subsets, and trains a model on each subset of the data. We use an adaptive inference strategy at test time: our ensemble architecture aggregates the outputs of only those models that did not contain the input sample in their training data. We prove that our Split-AI architecture defends against a large family of membership inference attacks, however, it is susceptible to new adaptive attacks. Therefore, we use a second component in our framework called Self-Distillation to protect against such stronger attacks. The Self-Distillation component (self-)distills the training dataset through our Split-AI ensemble, without using any external public datasets. Through extensive experiments on major benchmark datasets we show that SELENA presents a superior trade-off between membership privacy and utility compared to the state of the art.

研究动机与目标

• 开发一种实证性成员推理防御方法，在显著降低隐私泄露的同时保持模型效用。
• 解决差分隐私的局限性，后者虽提供可证明的隐私保障，但常导致模型效用下降。
• 在黑盒环境下防御直接单查询和自适应多查询成员推理攻击。
• 设计一种不依赖外部公开数据集的防御机制，提升其在真实场景部署中的实用性。
• 在成员隐私与模型效用之间实现优于现有最先进实证防御方法的权衡。

提出的方法

• Split-AI：将训练数据划分为 K 个随机子集，并在每个不同的子集上训练 K 个子模型。
• 自适应推理：在测试阶段，仅聚合那些未在其训练数据中包含输入样本的子模型的预测结果。
• 自蒸馏：通过 Split-AI 集成对训练数据进行蒸馏，无需使用外部数据集，从而增强对自适应攻击的鲁棒性。
• 该集成架构确保成员与非成员样本在模型行为上趋于一致，降低预测结果的可区分性。
• 防御机制在训练过程中端到端应用，推理阶段的额外开销仅相当于标准集成推理。
• 通过多种攻击变体（包括仅标签攻击和自适应攻击）对框架进行评估，以验证其鲁棒性。

实验结果

研究问题

• RQ1 一种排除子模型训练数据的集成架构是否能有效防御成员推理攻击？
• RQ2 自蒸馏在增强对自适应成员推理攻击的防御能力方面有多有效？
• RQ3 与最先进实证防御方法相比，成员隐私与模型效用之间的权衡如何？
• RQ4 该防御是否能在不依赖公开数据集或差分隐私机制的前提下依然有效？
• RQ5 Split-AI 中的自适应推理策略对单查询和多查询攻击的鲁棒性有何影响？

主要发现

• 相较于 MemGuard，SELENA 将成员推理攻击相对于随机猜测的优势降低最多 3.7 倍；相较于对抗正则化，降低最多 2.1 倍。
• 与未受保护的基线模型相比，该模型在基准数据集上的分类准确率下降不超过 3.9%。
• Split-AI 通过确保成员与非成员样本在预测行为上相似，有效防御了直接单查询成员推理攻击。
• 自蒸馏在无需外部数据的前提下，显著增强了对更强攻击（包括仅标签攻击和多查询攻击）的抵抗力。
• 该防御在隐私保护与模型效用方面均优于现有实证防御方法，在 CIFAR-10、SVHN 和 ImageNet 上实现了更优的权衡。
• 该框架在多种攻击场景下均表现出鲁棒性，包括黑盒攻击、仅标签攻击以及自适应成员推理攻击。