[论文解读] Reconciling Utility and Membership Privacy via Knowledge Distillation.

Virat Shejwalkar, Amir Houmansadr|arXiv (Cornell University)|Jun 15, 2019

Privacy-Preserving Technologies in Data参考文献 45被引用 7

一句话总结

本文提出了一种基于知识蒸馏的防御方法——成员隐私蒸馏（DMP），可在不显著降低分类准确率的情况下增强机器学习模型的成员隐私保护。DMP通过有选择性地从教师模型向学生模型迁移知识，实现了在对抗白盒和黑盒成员推理攻击方面，效用与隐私保护之间更优的权衡，优于以往方法。

ABSTRACT

Large capacity machine learning models are prone to membership inference attacks in which an adversary aims to infer whether a particular data sample is a member of the target model's training dataset. Such membership inferences can lead to serious privacy violations as machine learning models are often trained using privacy-sensitive data such as medical records and controversial user opinions. Recently, defenses against membership inference attacks are developed, in particular, based on differential privacy and adversarial regularization; unfortunately, such defenses highly impact the classification accuracy of the underlying machine learning models. In this work, we present a new defense against membership inference attacks that preserves the utility of the target machine learning models significantly better than prior defenses. Our defense, called distillation for membership privacy (DMP), leverages knowledge distillation to train machine learning models with membership privacy. We analyze the key requirements for membership privacy and provide a novel criterion to select data used for knowledge transfer, in order to improve membership privacy of the final models. DMP works effectively against the attackers with either a whitebox or blackbox access to the target model. We evaluate DMP's performance through extensive experiments on different deep neural networks and using various benchmark datasets. We show that DMP provides a significantly better tradeoff between inference resistance and classification performance than state-of-the-art membership inference defenses. For instance, a DMP-trained DenseNet provides a classification accuracy of 65.3% for a 54.4% blackbox membership inference attack accuracy, while an adversarially regularized DenseNet provides a classification accuracy of only 53.7% for a (much worse) 68.7% blackbox membership inference attack accuracy.

研究动机与目标

• 解决在医疗记录等敏感数据上训练的机器学习模型所面临的成员推理攻击带来的关键隐私风险。
• 开发一种防御机制，在保持高模型效用（分类准确率）的同时，有效抵抗成员推理攻击。
• 克服现有防御方法（如差分隐私和对抗正则化）严重降低模型性能的局限性。
• 设计一种专门针对成员隐私的知识蒸馏框架，通过选择最优数据进行知识迁移。

提出的方法

• 利用知识蒸馏，使用教师模型生成的软标签训练学生模型，从而转移能减少训练数据记忆化的泛化模式。
• 提出一种新颖的数据选择准则用于知识迁移，优先选择能增强成员隐私保护而不损害模型准确率的样本。
• 采用两阶段训练流程：首先在原始数据集上训练教师模型；其次，学生模型使用教师模型在精心筛选的数据子集上蒸馏的知识进行训练。
• 将该防御方法应用于多种深度神经网络（如DenseNet）和基准数据集，在白盒和黑盒成员推理攻击设置下评估其鲁棒性。
• 使用一种隐私感知损失函数，促使学生模型在非成员数据上更好地泛化，从而减少对训练样本的记忆化。
• 采用基于度量的筛选策略，识别并优先选择在蒸馏过程中最有助于提升成员隐私保护的数据样本。

实验结果

研究问题

• RQ1 知识蒸馏能否被有效重用于提升机器学习模型的成员隐私保护，同时不牺牲分类性能？
• RQ2 所提出的用于知识迁移的数据选择准则如何影响学生模型在成员推理攻击下的鲁棒性？
• RQ3 DMP在效用-隐私权衡方面是否优于现有防御方法（如对抗正则化和差分隐私）？
• RQ4 DMP在多种深度学习架构和数据集上对白盒和黑盒成员推理攻击的防御效果如何？

主要发现

• 经DMP训练的DenseNet模型在测试集上达到65.3%的准确率，同时将黑盒成员推理攻击的成功率降低至54.4%。
• 相比之下，经过对抗正则化的DenseNet模型准确率仅为53.7%，但黑盒攻击成功率显著升高至68.7%。
• 所提出的防御方法在多种架构和数据集上均表现出一致的性能提升，表明其具有广泛的适用性。
• 知识迁移中的数据选择准则被证明在不降低模型效用的前提下，最大化提升成员隐私保护效果，至关重要。
• DMP能有效抵抗白盒和黑盒成员推理攻击，在效用-隐私权衡方面优于当前最先进的防御方法。
• 与差分隐私和对抗正则化相比，该方法显著更好地保留了模型效用，后者通常导致准确率大幅下降。