Privacy leakage risk assessment for reversible neural network

Yifan HE; Jie ZHANG; Weiming ZHANG; Nenghai YU

doi:10.11959/j.issn.2096-109x.2023051

您当前的位置：

首页 >

文章列表页 >

Privacy leakage risk assessment for reversible neural network

Papers | 更新时间：2024-06-03

- Privacy leakage risk assessment for reversible neural network
- Chinese Journal of Network and Information Security Vol. 9, Issue 4, Pages: 29-39(2023)
- 作者机构：
  
  1. 中国科学技术大学信息科学技术学院，安徽合肥 230027
  2. 中国科学院电磁空间信息重点实验室，安徽合肥 230027
  3. 中国科学技术大学网络空间安全学院，安徽合肥 230027
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2023051
  CLC： TP309.7
- Online First：2023-08，
  
  Published：25 August 2023
- 稿件说明：
移动端阅览
Yifan HE, Jie ZHANG, Weiming ZHANG, et al. Privacy leakage risk assessment for reversible neural network[J]. Chinese Journal of Network and Information Security, 2023, 9(4): 29-39.
DOI：

Yifan HE, Jie ZHANG, Weiming ZHANG, et al. Privacy leakage risk assessment for reversible neural network[J]. Chinese Journal of Network and Information Security, 2023, 9(4): 29-39. DOI： 10.11959/j.issn.2096-109x.2023051.

摘要

近年来，深度学习已经成为多方领域的核心技术，而深度学习模型的训练过程中往往需要大量的数据，这些数据中可能含有隐私信息，包括个人身份信息（如电话号码、身份证号等）和敏感信息（如金融财务、医疗健康等）。因此，人工智能模型的隐私风险问题成为学术界的研究热点。深度学习模型的隐私研究仅局限于传统神经网络，而很少针对特殊网络结构的新兴网络（如可逆神经网络）。可逆神经网络的上层信息输入可以由下层输出直接得到，直观上讲，该结构保留了更多有关训练数据的信息，相比传统网络具有更大的隐私泄露风险。为此，提出从数据隐私泄露和模型功能隐私泄露两个层面来探讨深度网络的隐私问题，并将该风险评估策略应用到可逆神经网络。具体来说，选取了两种经典的可逆神经网络（RevNet 和i-RevNet），并使用了成员推理攻击、模型逆向攻击、属性推理攻击和模型窃取攻击 4 种攻击手段进行隐私泄露分析。实验结果表明，可逆神经网络在面对数据层面的隐私攻击时存在相比传统神经网络更严重的隐私泄露风险，而在面对模型层面的隐私攻击时存在相似的隐私泄露风险。由于可逆神经网络研究越来越多，目前被广泛被应用于各种任务，这些任务也涉及敏感数据，在实验结果分析基础上提出了一些潜在的解决方法，希望能够应用于未来可逆神经网络的发展。

Abstract

In recent years

deep learning has emerged as a crucial technology in various fields.However

the training process of deep learning models often requires a substantial amount of data

which may contain private and sensitive information such as personal identities and financial or medical details.Consequently

research on the privacy risk associated with artificial intelligence models has garnered significant attention in academia.However

privacy research in deep learning models has mainly focused on traditional neural networks

with limited exploration of emerging networks like reversible networks.Reversible neural networks have a distinct structure where the upper information input can be directly obtained from the lower output.Intuitively

this structure retains more information about the training data

potentially resulting in a higher risk of privacy leakage compared to traditional networks.Therefore

the privacy of reversible networks was discussed from two aspects: data privacy leakage and model function privacy leakage.The risk assessment strategy was applied to reversible networks.Two classical reversible networks were selected

namely RevNet and i-RevNet.And four attack methods were used accordingly

namely membership inference attack

model inversion attack

attribute inference attack

and model extraction attack

to analyze privacy leakage.The experimental results demonstrate that reversible networks exhibit more serious privacy risks than traditional neural networks when subjected to membership inference attacks

model inversion attacks

and attribute inference attacks.And reversible networks have similar privacy risks to traditional neural networks when subjected to model extraction attack.Considering the increasing popularity of reversible neural networks in various tasks

including those involving sensitive data

it becomes imperative to address these privacy risks.Based on the analysis of the experimental results

potential solutions were proposed which can be applied to the development of reversible networks in the future.

关键词

Keywords

references

SHOKRI R , STRONATI M , SONG C , et al . Membership inference attacks against machine learning models [C ] // IEEE Symposium on Security and Privacy . 2017

KHOSRAVY M , NAKAMURA K , HIROSE Y , et al . Model inversion attack:analysis under gray-box scenario on deep learning based face recognition system [J ] . KSII Transactions on Internet and Information Systems , 2021 , 15 ( 3 ): 1100 - 1119 .

TRUONG J B , MAINI P , WALLS R , et al . Data-free model extraction [C ] // IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2021

谭作文 , 张连福 . 机器学习隐私保护研究综述 [J ] . 软件学报 , 2020 , 31 ( 7 ): 30 .

TAN Z W , ZHANG L F . Survey on privacy preserving techniques for machine learning [J ] . Journal of Software . 2020 , 31 ( 7 ): 30 .

DINH L , KRUEGER D , BENGIO Y . NICE:non-linear independent components estimation [J ] . Computer Science , 2014 .

GOMEZ A N , REN M , URTASUN R , et al . The reversible residual network:backpropagation without storing activations [C ] // International Conference on Neural Information Processing Systems(NIPS) . 2017 : 2211 - 2221 .

JACOBSEN J H , SMEULDERS A , OYALLON E . i-RevNet:deep invertible networks [C ] // International Conference on Learning Representations . 2018 .

MELIS L , SONG C Z , DE-CRISTOFARO E , et al . Exploiting unintended feature leakage in collaborative learning [C ] // Proc of the IEEE Symp on Security and Privacy . 2019

TRAMÈR F , ZHANG F , JUELS A , et al . Stealing machine learning models via prediction APIs [C ] // Proc of the USENIX Security Symposium . 2016 : 601 - 618 .

SALEM A , ZHANG Y , HUMBERT M , et al . ML-Leaks:model and data independent membership inference attacks and defenses on machine learning models [C ] // Network and Distributed Systems Security (NDSS) Symposium . 2019 .

CHEN S I , KAHLA M , JIA R X , et al . Knowledge-enriched distributional model inversion attacks [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) . 2021 : 16178 - 16187 .

SZEGEDY C , VANHOUCKE V , IOFFE S , et al . Rethinking the inception architecture for computer vision [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . 2016 : 2818 - 2826 .

LIU Y , WEN R , HE X , et al . ML-doctor:holistic risk assess ment of inference attacks against machine learning models [C ] // USENIX Security Symposium . 2022 .

MEJIA F A , GAMBLE P , HAMPEL-ARIAS Z , et al . Robust or private? adversarial training makes models more vulnerable to privacy attacks [R ] . 2019 .

AL-RUBAIE M , CHANG J M . Privacy-preserving machine learning:threats and solutions [J ] . IEEE Security ＆ Privacy , 2019 , 17 ( 2 ): 49 - 58 .

ABADI M , CHU A , GOODFELLOW I , et al . Deep learning with differential privacy [C ] // ACM SIGSAC Conference on Computer and Communications Security (CCS) . 2016 : 308 - 318 .

CHOO C A C , TRAMER F , CARLINI N , et al . Label-only membership inference attacks [J ] . arXiv Preprint arXiv:2007.14321 , 2020 .

CHENG Z , LI Z , ZHANG J , et al . Differentially private machine learning model against model extraction attack [C ] // 2020 International Conferences on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber,Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) and IEEE Congress on Cybermatics (Cybermatics) . 2020 .

JIA J Y , SALEM A , BACKES M , et al . MemGuard:defending againstblack-box membership inference attacks via adversarial examples [C ] // Proceedings of 2019 ACM SIGSAC Conference on Computer and Communications Security . 2019 : 259 - 274 .

NASR M , SHOKRI R , HOUMANSADR A . Comprehensive privacy analysis of deep learning:passive and active white-box inference attacks against centralized and federated learning [C ] // Proceedings of 2019 IEEE Symposium on Security and Privacy . 2019 : 739 - 753 .

ZHANG G , LIU B , TIAN H , et al . How does a deep learning model architecture impact its privacy [J ] . arXiv Preprint arXiv:2210.11049 , 2022 .

Views

470

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Bidirectional privacy authorization for large models based on private set intersection

Research on searchable encryption scheme based on enhanced PIR

Differential privacy protection method for localization of ADS-B message positioning data oriented to LBS

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Secure aggregation for semi-decentralized federated learning under heterogeneous data

Related Author

YANG Shuai

HAN Yiliang

WU Xuguang

FENG Haokang

WANG Yuanyuan

TANG Liang

MA Limin

YANG Hongyu

Related Institution

Key Laboratory of Counter-Terrorism Command Information Engineering of the Ministry of Education, Engineering University of PAP

College of Cryptography Engineering, Engineering University of PAP

College of Computer Science，Beijing Information Science and Technology University

Beijing Academy of Educational Science

School of Computer Science and Technology, Jilin University

⁰