可逆神经网络的隐私泄露风险评估

何毅凡; 张杰; 张卫明; 俞能海

doi:10.11959/j.issn.2096-109x.2023051

您当前的位置：

首页 >

文章列表页 >

可逆神经网络的隐私泄露风险评估

学术论文 | 更新时间：2024-06-03

- 可逆神经网络的隐私泄露风险评估
- Privacy leakage risk assessment for reversible neural network
- 网络与信息安全学报 2023年9卷第4期页码：29-39
- 作者机构：
  
  1. 中国科学技术大学信息科学技术学院，安徽合肥 230027
  2. 中国科学院电磁空间信息重点实验室，安徽合肥 230027
  3. 中国科学技术大学网络空间安全学院，安徽合肥 230027
- 作者简介：
  
  [ "何毅凡（1998- ），男，湖北武汉人，中国科学技术大学硕士生，主要研究方向为人工智能安全与隐私保护" ]
  [ "张杰（1995- ），男，河南驻马店人，中国科学技术大学博士生，主要研究方向为人工智能安全、隐私及其版权保护" ]
  [ "张卫明（1976- ），男，河北定州人，中国科学技术大学教授、博士生导师，主要研究方向为信息隐藏、多媒体内容安全、人工智能安全" ]
  [ "俞能海（1964- ），男，安徽无为人，中国科学技术大学教授、博士生导师，主要研究方向为多媒体信息检索、图像处理与视频通信、数字媒体内容安全" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(U20B2047);国家自然科学基金;The National Natural Science Foundation of China(62072421);国家自然科学基金;The National Natural Science Foundation of China(62002334);国家自然科学基金;The National Natural Science Foundation of China(62102386);国家自然科学基金;The National Natural Science Foundation of China(62121002);中国科技大学探索基金项目;Exploration Fund Project of University of Science and Technology of China(YD3480002001);中央高校基础研究基金;Fundamental Research Funds for the Central Universities(WK2100000011)
- DOI：10.11959/j.issn.2096-109x.2023051
  中图分类号： TP309.7
- 网络首发：2023-08，
  
  纸质出版：2023-08-25
- 稿件说明：
移动端阅览
何毅凡, 张杰, 张卫明, 等. 可逆神经网络的隐私泄露风险评估[J]. 网络与信息安全学报, 2023,9(4):29-39.

Yifan HE, Jie ZHANG, Weiming ZHANG, et al. Privacy leakage risk assessment for reversible neural network[J]. Chinese Journal of Network and Information Security, 2023, 9(4): 29-39.
何毅凡, 张杰, 张卫明, 等. 可逆神经网络的隐私泄露风险评估[J]. 网络与信息安全学报, 2023,9(4):29-39. DOI： 10.11959/j.issn.2096-109x.2023051.

Yifan HE, Jie ZHANG, Weiming ZHANG, et al. Privacy leakage risk assessment for reversible neural network[J]. Chinese Journal of Network and Information Security, 2023, 9(4): 29-39. DOI： 10.11959/j.issn.2096-109x.2023051.

摘要

近年来，深度学习已经成为多方领域的核心技术，而深度学习模型的训练过程中往往需要大量的数据，这些数据中可能含有隐私信息，包括个人身份信息（如电话号码、身份证号等）和敏感信息（如金融财务、医疗健康等）。因此，人工智能模型的隐私风险问题成为学术界的研究热点。深度学习模型的隐私研究仅局限于传统神经网络，而很少针对特殊网络结构的新兴网络（如可逆神经网络）。可逆神经网络的上层信息输入可以由下层输出直接得到，直观上讲，该结构保留了更多有关训练数据的信息，相比传统网络具有更大的隐私泄露风险。为此，提出从数据隐私泄露和模型功能隐私泄露两个层面来探讨深度网络的隐私问题，并将该风险评估策略应用到可逆神经网络。具体来说，选取了两种经典的可逆神经网络（RevNet 和i-RevNet），并使用了成员推理攻击、模型逆向攻击、属性推理攻击和模型窃取攻击 4 种攻击手段进行隐私泄露分析。实验结果表明，可逆神经网络在面对数据层面的隐私攻击时存在相比传统神经网络更严重的隐私泄露风险，而在面对模型层面的隐私攻击时存在相似的隐私泄露风险。由于可逆神经网络研究越来越多，目前被广泛被应用于各种任务，这些任务也涉及敏感数据，在实验结果分析基础上提出了一些潜在的解决方法，希望能够应用于未来可逆神经网络的发展。

Abstract

In recent years

deep learning has emerged as a crucial technology in various fields.However

the training process of deep learning models often requires a substantial amount of data

which may contain private and sensitive information such as personal identities and financial or medical details.Consequently

research on the privacy risk associated with artificial intelligence models has garnered significant attention in academia.However

privacy research in deep learning models has mainly focused on traditional neural networks

with limited exploration of emerging networks like reversible networks.Reversible neural networks have a distinct structure where the upper information input can be directly obtained from the lower output.Intuitively

this structure retains more information about the training data

potentially resulting in a higher risk of privacy leakage compared to traditional networks.Therefore

the privacy of reversible networks was discussed from two aspects: data privacy leakage and model function privacy leakage.The risk assessment strategy was applied to reversible networks.Two classical reversible networks were selected

namely RevNet and i-RevNet.And four attack methods were used accordingly

namely membership inference attack

model inversion attack

attribute inference attack

and model extraction attack

to analyze privacy leakage.The experimental results demonstrate that reversible networks exhibit more serious privacy risks than traditional neural networks when subjected to membership inference attacks

model inversion attacks

and attribute inference attacks.And reversible networks have similar privacy risks to traditional neural networks when subjected to model extraction attack.Considering the increasing popularity of reversible neural networks in various tasks

including those involving sensitive data

it becomes imperative to address these privacy risks.Based on the analysis of the experimental results

potential solutions were proposed which can be applied to the development of reversible networks in the future.

关键词

Keywords

references

SHOKRI R , STRONATI M , SONG C , et al . Membership inference attacks against machine learning models [C ] // IEEE Symposium on Security and Privacy . 2017

KHOSRAVY M , NAKAMURA K , HIROSE Y , et al . Model inversion attack:analysis under gray-box scenario on deep learning based face recognition system [J ] . KSII Transactions on Internet and Information Systems , 2021 , 15 ( 3 ): 1100 - 1119 .

TRUONG J B , MAINI P , WALLS R , et al . Data-free model extraction [C ] // IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2021

谭作文 , 张连福 . 机器学习隐私保护研究综述 [J ] . 软件学报 , 2020 , 31 ( 7 ): 30 .

TAN Z W , ZHANG L F . Survey on privacy preserving techniques for machine learning [J ] . Journal of Software . 2020 , 31 ( 7 ): 30 .

DINH L , KRUEGER D , BENGIO Y . NICE:non-linear independent components estimation [J ] . Computer Science , 2014 .

GOMEZ A N , REN M , URTASUN R , et al . The reversible residual network:backpropagation without storing activations [C ] // International Conference on Neural Information Processing Systems(NIPS) . 2017 : 2211 - 2221 .

JACOBSEN J H , SMEULDERS A , OYALLON E . i-RevNet:deep invertible networks [C ] // International Conference on Learning Representations . 2018 .

MELIS L , SONG C Z , DE-CRISTOFARO E , et al . Exploiting unintended feature leakage in collaborative learning [C ] // Proc of the IEEE Symp on Security and Privacy . 2019

TRAMÈR F , ZHANG F , JUELS A , et al . Stealing machine learning models via prediction APIs [C ] // Proc of the USENIX Security Symposium . 2016 : 601 - 618 .

SALEM A , ZHANG Y , HUMBERT M , et al . ML-Leaks:model and data independent membership inference attacks and defenses on machine learning models [C ] // Network and Distributed Systems Security (NDSS) Symposium . 2019 .

CHEN S I , KAHLA M , JIA R X , et al . Knowledge-enriched distributional model inversion attacks [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) . 2021 : 16178 - 16187 .

SZEGEDY C , VANHOUCKE V , IOFFE S , et al . Rethinking the inception architecture for computer vision [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . 2016 : 2818 - 2826 .

LIU Y , WEN R , HE X , et al . ML-doctor:holistic risk assess ment of inference attacks against machine learning models [C ] // USENIX Security Symposium . 2022 .

MEJIA F A , GAMBLE P , HAMPEL-ARIAS Z , et al . Robust or private? adversarial training makes models more vulnerable to privacy attacks [R ] . 2019 .

AL-RUBAIE M , CHANG J M . Privacy-preserving machine learning:threats and solutions [J ] . IEEE Security ＆ Privacy , 2019 , 17 ( 2 ): 49 - 58 .

ABADI M , CHU A , GOODFELLOW I , et al . Deep learning with differential privacy [C ] // ACM SIGSAC Conference on Computer and Communications Security (CCS) . 2016 : 308 - 318 .

CHOO C A C , TRAMER F , CARLINI N , et al . Label-only membership inference attacks [J ] . arXiv Preprint arXiv:2007.14321 , 2020 .

CHENG Z , LI Z , ZHANG J , et al . Differentially private machine learning model against model extraction attack [C ] // 2020 International Conferences on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber,Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) and IEEE Congress on Cybermatics (Cybermatics) . 2020 .

JIA J Y , SALEM A , BACKES M , et al . MemGuard:defending againstblack-box membership inference attacks via adversarial examples [C ] // Proceedings of 2019 ACM SIGSAC Conference on Computer and Communications Security . 2019 : 259 - 274 .

NASR M , SHOKRI R , HOUMANSADR A . Comprehensive privacy analysis of deep learning:passive and active white-box inference attacks against centralized and federated learning [C ] // Proceedings of 2019 IEEE Symposium on Security and Privacy . 2019 : 739 - 753 .

ZHANG G , LIU B , TIAN H , et al . How does a deep learning model architecture impact its privacy [J ] . arXiv Preprint arXiv:2210.11049 , 2022 .

浏览量

470

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于隐私集合求交的大模型双向隐私授权

基于PIR增强的可搜索加密方案研究

面向LBS的ADS-B报文定位数据本地化差分隐私保护方法

FL-IoV：基于联邦学习的综合车联网入侵检测方法

面向异构数据的半分布式联邦学习安全聚合