Robust Membership Encoding: Inference Attacks and Copyright Protection for Deep Learning
This addresses copyright protection and privacy concerns for model owners and users in MLaaS, representing a novel method for a known bottleneck.
The paper tackles the problem of protecting model copyright and analyzing privacy risks in machine learning by introducing membership encoding, which embeds information about whether specific data points were used in training, achieving robustness to data redaction, model compression, and fine-tuning with negligible accuracy loss.
Machine learning as a service (MLaaS), and algorithm marketplaces are on a rise. Data holders can easily train complex models on their data using third party provided learning codes. Training accurate ML models requires massive labeled data and advanced learning algorithms. The resulting models are considered as intellectual property of the model owners and their copyright should be protected. Also, MLaaS needs to be trusted not to embed secret information about the training data into the model, such that it could be later retrieved when the model is deployed. In this paper, we present \emph{membership encoding} for training deep neural networks and encoding the membership information, i.e. whether a data point is used for training, for a subset of training data. Membership encoding has several applications in different scenarios, including robust watermarking for model copyright protection, and also the risk analysis of stealthy data embedding privacy attacks. Our encoding algorithm can determine the membership of significantly redacted data points, and is also robust to model compression and fine-tuning. It also enables encoding a significant fraction of the training set, with negligible drop in the model's prediction accuracy.