Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture

Abstract

Membership inference attacks are a key measure to evaluate privacy leakage in machine learning (ML) models. These attacks aim to distinguish training members from non-members by exploiting differential behavior of the models on member and non-member inputs. The goal of this work is to train ML models that have high membership privacy while largely preserving their utility; we therefore aim for an empirical membership privacy guarantee as opposed to the provable privacy guarantees provided by techniques like differential privacy, as such techniques are shown to deteriorate model utility. Specifically, we propose a new framework to train privacypreserving models that induces similar behavior on member and non-member inputs to mitigate membership inference attacks. Our framework, called SELENA, has two major components. The first component and the core of our defense is a novel ensemble architecture for training. This architecture, which we call Split-AI, splits the training data into random subsets, and trains a model on each subset of the data. We use an adaptive inference strategy at test time: our ensemble architecture aggregates the outputs of only those models that did not contain the input sample in their training data. We prove that our Split-AI architecture defends against a large family of membership inference attacks, however, it is susceptible to new adaptive attacks. Therefore, we use a second component in our framework called Self-Distillation to protect against such stronger attacks. The Self-Distillation component (self-)distills the training dataset through our Split-AI ensemble, without using any external public datasets. Through extensive experiments on major benchmark datasets we show that SELENA presents a superior trade-off between membership privacy and utility compared to the state of the art. In particular, SELENA incurs no more than 3.9% drop in classification accuracy compared to the undefended model. Compared to two state-of-the-art empirical defenses to membership privacy, MemGuard and adversarial regularization, SELENA reduces the membership inference attack advantage over a random guess by a factor of up to 3.7 compared to MemGuard and a factor of up to 2.1 compared to adversarial regularization.

Knowledge Cross-Distillation for Membership Privacy

“…After we submitted our work to PETS 2022 Issue 2, Tang et al[39] published a concurrent and independent work similar to ours in arXiv.…”

Knowledge Cross-Distillation for Membership Privacy

“…Note added. Although this paper was submitted to a certain conference and currently under review, we recently became aware of a concurrent independent work related to KCD by Tang et al [72].…”

Membership Privacy Protection for Image Translation Models via Adversarial Knowledge Distillation

“…It restricts the private classifier's direct access to the private training dataset, thus significantly reduces the membership information leakage. Following DMP, there are two studies SELENA [12] and CKD/PCKD [13] which both split the original dataset into subsets, and leverage the subset models to distill the final public model. The advantage of these two DMP followers is to avoid the need for extra public data that may be hard to obtain in some applications.…”

“…However, it is not trivial to apply them directly on image translation tasks. As the sample sizes of datasets in image translation are generally smaller than those in classification, splitting the data and using subsets in training as in [12], [13] brings more risks of overfitting. Moreover, the major task of the private teacher model in [11] is to select the data by the entropy of the prediction, but the output of an image translation task does not have such entropy information, which indicates [11] cannot be fully utilized on image translation.…”