Data-centric defense: Shaping loss landscape with augmentations to counter model inversion

S Chen, N Abhyankar, F Kang, M Jin, R Jia - 2023 - openreview.net
2023openreview.net
Machine learning (ML) models are widely used but vulnerable to privacy attacks, such as
model inversion. Current defense techniques are mostly model-centric, involving modifying
the model training or inference process. However, these approaches require model trainers'
cooperation, are computationally expensive, and often result in a significant privacy-utility
tradeoff. To address these limitations, this paper proposes a novel data-centric approach to
mitigate model inversion attacks. Compared to traditional model-centric techniques, our …
Machine learning (ML) models are widely used but vulnerable to privacy attacks, such as model inversion. Current defense techniques are mostly model-centric, involving modifying the model training or inference process. However, these approaches require model trainers' cooperation, are computationally expensive, and often result in a significant privacy-utility tradeoff. To address these limitations, this paper proposes a novel data-centric approach to mitigate model inversion attacks. Compared to traditional model-centric techniques, our approach offers the unique advantage of decentralization, enabling individual users to control their data's privacy risk. Specifically, we introduce several privacy-focused data augmentations that modify the private data uploaded to the model trainer. These augmentations will shape the resulting model's loss landscape, making it challenging for attackers to generate private target samples. Additionally, we provide theoretical analysis to support our approach and explain how data augmentation can reduce the risk of model inversion. We evaluate our approach against state-of-the-art model inversion attacks and demonstrate its effectiveness and robustness across various model architectures and datasets. Specifically, in standard face recognition benchmarks, we reduce face reconstruction success rates to less or equal to 5%, while maintaining high utility with only a 2% classification accuracy drop, surpassing state-of-the-art model-centric defenses by 90%. This is the first study to propose a data-centric approach for mitigating model inversion attacks, showing potential for decentralized privacy protection.
openreview.net
以上显示的是最相近的搜索结果。 查看全部搜索结果