Private Multi-Winner Voting for Machine Learning

Dziedzic, Adam; Choquette-Choo, Christopher A.; Dullerud, Natalie; Suriyakumar, Vinith; Shamsabadi, Ali Shahin; Kaleem, Muhammad Ahmad; Jha, Somesh; Papernot, Nicolas; Wang, Xiao

doi:10.56553/popets-2023-0031

Cited by 2 publications

(3 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The Thirty-Eighth AAAI Conference on Artificial Intelligence defense Kariyappa, Prakash, and Qureshi 2020;Dziedzic et al 2021), which performs detection on each sample. Existing solutions can be mainly divided into the following two types: Outlier Exposure (OE).…”

Section: Model Extraction Attack Detectionmentioning

confidence: 99%

See 1 more Smart Citation

SAME: Sample Reconstruction against Model Extraction Attacks

Xie,

Zhang,

Zhao

et al. 2024

AAAI

View full text Add to dashboard Cite

While deep learning models have shown significant performance across various domains, their deployment needs extensive resources and advanced computing infrastructure. As a solution, Machine Learning as a Service (MLaaS) has emerged, lowering the barriers for users to release or productize their deep learning models. However, previous studies have highlighted potential privacy and security concerns associated with MLaaS, and one primary threat is model extraction attacks. To address this, there are many defense solutions but they suffer from unrealistic assumptions and generalization issues, making them less practical for reliable protection. Driven by these limitations, we introduce a novel defense mechanism, SAME, based on the concept of sample reconstruction. This strategy imposes minimal prerequisites on the defender's capabilities, eliminating the need for auxiliary Out-of-Distribution (OOD) datasets, user query history, white-box model access, and additional intervention during model training. It is compatible with existing active defense methods. Our extensive experiments corroborate the superior efficacy of SAME over state-of-the-art solutions. Our code is available at https://github.com/xythink/SAME.

show abstract

Section: Model Extraction Attack Detectionmentioning

confidence: 99%

“…Since this method has no explicit anomaly score, we compute the score based on the consensus among these diverse models, and it is smaller when models agree. This idea is also used in previous work (Dziedzic et al 2021).…”

Section: Model Extraction Attack Detectionmentioning

confidence: 99%

SAME: Sample Reconstruction against Model Extraction Attacks

Xie,

Zhang,

Zhao

et al. 2024

AAAI

View full text Add to dashboard Cite

show abstract

“…Model extraction defences try to either detect (Juuti et al 2019;Atli et al 2020;Quiring, Arp, and Rieck 2018) or slow down (Orekondy, Schiele, and Fritz 2020;Dziedzic et al 2022;Lee et al 2018) the attack but cannot prevent it. Adversarial watermarking (Szyller et al 2021) can deter extraction attacks by forcing a watermark into F A , or by ensuring that a watermark transfers from F V to F A (Jia et al 2021).…”

Section: Ownership Verificationmentioning

confidence: 99%

Conflicting Interactions among Protection Mechanisms for Machine Learning Models

Szyller

Asokan

2023

AAAI

View full text Add to dashboard Cite

Nowadays, systems based on machine learning (ML) are widely used in different domains. Given their popularity, ML models have become targets for various attacks. As a result, research at the intersection of security/privacy and ML has flourished. Typically such work has focused on individual types of security/privacy concerns and mitigations thereof. However, in real-life deployments, an ML model will need to be protected against several concerns simultaneously. A protection mechanism optimal for a specific security or privacy concern may interact negatively with mechanisms intended to address other concerns. Despite its practical relevance, the potential for such conflicts has not been studied adequately. In this work, we first provide a framework for analyzing such conflicting interactions. We then focus on systematically analyzing pairwise interactions between protection mechanisms for one concern, model and data ownership verification, with two other classes of ML protection mechanisms: differentially private training, and robustness against model evasion. We find that several pairwise interactions result in conflicts. We also explore potential approaches for avoiding such conflicts. First, we study the effect of hyperparameter relaxations, finding that there is no sweet spot balancing the performance of both protection mechanisms. Second, we explore whether modifying one type of protection mechanism (ownership verification) so as to decouple it from factors that may be impacted by a conflicting mechanism (differentially private training or robustness to model evasion) can avoid conflict. We show that this approach can indeed avoid the conflict between ownership verification mechanisms when combined with differentially private training, but has no effect on robustness to model evasion. We conclude by identifying the gaps in the landscape of studying interactions between other types of ML protection mechanisms.

show abstract

Private Multi-Winner Voting for Machine Learning

Cited by 2 publications

References 25 publications

SAME: Sample Reconstruction against Model Extraction Attacks

SAME: Sample Reconstruction against Model Extraction Attacks

Conflicting Interactions among Protection Mechanisms for Machine Learning Models

Contact Info

Product

Resources

About