REVIEW 7 cited by
On the Effectiveness of Regularization Against Membership Inference Attacks
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
Deep learning models often raise privacy concerns as they leak information about their training data. This enables an adversary to determine whether a data point was in a model's training set by conducting a membership inference attack (MIA). Prior work has conjectured that regularization techniques, which combat overfitting, may also mitigate the leakage. While many regularization mechanisms exist, their effectiveness against MIAs has not been studied systematically, and the resulting privacy properties are not well understood. We explore the lower bound for information leakage that practical attacks can achieve. First, we evaluate the effectiveness of 8 mechanisms in mitigating two recent MIAs, on three standard image classification tasks. We find that certain mechanisms, such as label smoothing, may inadvertently help MIAs. Second, we investigate the potential of improving the resilience to MIAs by combining complementary mechanisms. Finally, we quantify the opportunity of future MIAs to compromise privacy by designing a white-box `distance-to-confident' (DtC) metric, based on adversarial sample crafting. Our metric reveals that, even when existing MIAs fail, the training samples may remain distinguishable from test samples. This suggests that regularization mechanisms can provide a false sense of privacy, even when they appear effective against existing MIAs.
Forward citations
Cited by 7 Pith papers
-
Membership Inference Attacks Against Vision-Language Models
Temperature-based, set-level membership inference attacks can identify instruction-tuning data in VLMs with AUC above 0.8 for sets as small as five samples on LLaVA.
-
Modeling Neural Networks with Privacy Using Neural Stochastic Differential Equations
Neural stochastic differential equations are claimed to be differentially private learners, matching DP-SGD's membership-inference protection at better accuracy, while neural ODEs show about twice the resistance of ResNets.
-
CLMIA: Membership Inference Attacks via Unsupervised Contrastive Learning
CLMIA is a membership inference attack that pretrains an attack model on unlabeled classifier posteriors via contrastive learning and fine-tunes it with a small labeled set.
-
TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Models
TEESlice trains small private slices on top of a public backbone inside a TEE, leaving only the public backbone and encrypted features on the GPU, and reports black-box-level attack resistance at about 10x lower TEE c...
-
SoK: The Privacy Paradox of Large Language Models: Advancements, Privacy Risks, and Mitigation
A systematization-of-knowledge survey that categorizes LLM privacy risks into training data, prompts, outputs, and agents, and reviews limitations of current mitigations.
-
Effectiveness of L2 Regularization in Privacy-Preserving Machine Learning
L2 regularization lowers membership inference attack advantage on some datasets, but the effect is absent on MNIST, and the comparison with differential privacy is under-specified.
-
Trustworthy AI: Safety, Bias, and Privacy -- A Survey
A survey of LLM safety alignment, spurious correlation mitigation, and membership inference defenses, with a self-cited perspective on robust safety.
Discussion (0). Continue with ORCID to comment.