Rethinking Privacy Preserving Deep Learning: How to Evaluate and Thwart Privacy Attacks
This addresses privacy vulnerabilities in deep learning systems, offering both evaluation methods and defensive mechanisms, though it builds incrementally on existing privacy-preserving approaches.
This paper tackles the problem of evaluating and defending against privacy attacks in privacy-preserving deep learning, proposing a quantitative measurement framework for accuracy-privacy trade-offs and a novel Secret Polarization Network that improves model accuracy by 5-20% while maintaining satisfactory privacy protection.
This paper investigates capabilities of Privacy-Preserving Deep Learning (PPDL) mechanisms against various forms of privacy attacks. First, we propose to quantitatively measure the trade-off between model accuracy and privacy losses incurred by reconstruction, tracing and membership attacks. Second, we formulate reconstruction attacks as solving a noisy system of linear equations, and prove that attacks are guaranteed to be defeated if condition (2) is unfulfilled. Third, based on theoretical analysis, a novel Secret Polarization Network (SPN) is proposed to thwart privacy attacks, which pose serious challenges to existing PPDL methods. Extensive experiments showed that model accuracies are improved on average by 5-20% compared with baseline mechanisms, in regimes where data privacy are satisfactorily protected.