Differentially Private and Adversarially Robust Machine Learning: An Empirical Evaluation
This work addresses the need for robust and private machine learning models against combined attacks, but it is incremental as it builds on existing methods like DP-Adv.
This study tackled the problem of defending machine learning models against simultaneous privacy and security attacks by combining adversarial training with differentially private training. The result showed that the differentially-private adversarial training approach performed as privately as non-robust private models, as validated empirically with a membership inference attack.
Malicious adversaries can attack machine learning models to infer sensitive information or damage the system by launching a series of evasion attacks. Although various work addresses privacy and security concerns, they focus on individual defenses, but in practice, models may undergo simultaneous attacks. This study explores the combination of adversarial training and differentially private training to defend against simultaneous attacks. While differentially-private adversarial training, as presented in DP-Adv, outperforms the other state-of-the-art methods in performance, it lacks formal privacy guarantees and empirical validation. Thus, in this work, we benchmark the performance of this technique using a membership inference attack and empirically show that the resulting approach is as private as non-robust private models. This work also highlights the need to explore privacy guarantees in dynamic training paradigms.