ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models (2018-06-04T00:00:00.000000Z)

TL;DR

This most comprehensive study so far on this emerging and developing threat using eight diverse datasets which show the viability of the proposed attacks across domains and proposes the first effective defense mechanisms against such broader class of membership inference attacks that maintain a high level of utility of the ML model.

Abstract

Machine learning (ML) has become a core component of many real-world applications and training data is a key factor that drives current progress. This huge success has led Internet companies to deploy machine learning as a service (MLaaS). Recently, the first membership inference attack has shown that extraction of information on the training set is possible in such MLaaS settings, which has severe security and privacy implications. However, the early demonstrations of the feasibility of such attacks have many assumptions on the adversary, such as using multiple so-called shadow models, knowledge of the target model structure, and having a dataset from the same distribution as the target model's training data. We relax all these key assumptions, thereby showing that such attacks are very broadly applicable at low cost and thereby pose a more severe risk than previously thought. We present the most comprehensive study so far on this emerging and developing threat using eight diverse datasets which show the viability of the proposed attacks across domains. In addition, we propose the first effective defense mechanisms against such broader class of membership inference attacks that maintain a high level of utility of the ML model.

Authors

A. Salem

2 papers

M. Backes

7 papers

Yang Zhang

6 papers

TL;DR

Abstract

Authors

References59 items

Differentially Private Data Generative Models

MLCapsule: Guarded Offline Deployment of Machine Learning as a Service

Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware

AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learning

Exploiting Unintended Feature Leakage in Collaborative Learning

Inference Attacks Against Collaborative Learning

Dissecting Privacy Risks in Biomedical Data

DeepSigns : A Generic Watermarking Framework for Protecting the Ownership of Deep Learning Models

Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning

When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks

Chiron: Privacy-preserving Machine Learning as a Service

Stealing Hyperparameters in Machine Learning

Understanding Membership Inferences on Well-Generalized Learning Models

Tagvisor: A Privacy Advisor for Sharing Hashtags

Machine Learning with Membership Privacy using Adversarial Regularization

Towards Measuring Membership Privacy

CTRL+Z: Recovering Anonymized Social Graphs

Towards Reverse-Engineering Black-Box Neural Networks

Practical Secure Aggregation for Privacy-Preserving Machine Learning

Oblivious Neural Network Predictions via MiniONN Transformations

Privacy-Preserving Distributed Linear Regression on High-Dimensional Data

Machine Learning Models that Remember Too Much

Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification

Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting

The Unintended Consequences of Overfitting: Training Data Inference Attacks

walk2friends: Inferring Social Links from Mobility Profiles

Knock Knock, Who's There? Membership Inference on Aggregate Location Data

DeepSecure: Scalable Provably-Secure Deep Learning

LOGAN: Evaluating Privacy Leakage of Generative Models Using Generative Adversarial Networks

Identifying Personal DNA Methylation Profiles by Genotype Inference

SecureML: A System for Scalable Privacy-Preserving Machine Learning

Ensemble Adversarial Training: Attacks and Defenses

Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks

Adversarial Image Perturbation for Privacy Protection A Game Theory Perspective

Membership Privacy in MicroRNA-based Studies

Membership Inference Attacks Against Machine Learning Models

DeepCity: A Feature Learning Framework for Mining Location Check-Ins

Towards Evaluating the Robustness of Neural Networks

Stealing Machine Learning Models via Prediction APIs

CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy

Crafting adversarial input sequences for recurrent neural networks

Practical Black-Box Attacks against Machine Learning

Participatory Cultural Mapping Based on Collective Behavior Data in Location-Based Social Networks

The Limitations of Deep Learning in Adversarial Settings

Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures

NationTelescope: Monitoring and visualizing large-scale collective behavior in LBSNs

Explaining and Harnessing Adversarial Examples

Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing

Optimal randomized classification in adversarial settings

Privacy-Preserving ECG Classification With Branching Programs and Neural Networks

Privacy-Preserving Face Recognition

Resolving Individuals Contributing Trace Amounts of DNA to Highly Complex Mixtures Using High-Density SNP Genotyping Microarrays

NewsWeeder: Learning to Filter Netnews

Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification

Machine Learning Classification over Encrypted Data

Scalable Optimization of Randomized Operational Decisions in Adversarial Classification Settings

Dropout: a simple way to prevent neural networks from overfitting

Annual Computer Security Applications Conference, ACSAC '13, New Orleans, LA, USA, December 9-13, 2013

Efficient Privacy-Preserving Biometric Identification

Field of Study

Journal Information

Name

Volume

Venue Information

Name

Type

URL

Alternate Names