Protecting Decision Boundary of Machine Learning Model With Differentially Private Perturbation

Zheng, Huadi; Ye, Qingqing; Hu, Haibo; Fang, Chengfang; Shi, Jie

doi:10.1109/tdsc.2020.3043382

Cited by 20 publications

(3 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Foolsgold [5], examines historical updates for each client and penalizes those with high pairwise cosine similarities by employing a low learning rate. Another avenue of research focuses on robust defense against FL backdoor attacks by applying weak Differential Privacy (DP) [32] to the global model [31]. Weak DP, involving norm clipping and the addition of Gaussian noise to each gradient update, has proven effective in mitigating FL backdoor attacks [27].…”

Section: Backdoor Attacks and Defenses In Flmentioning

confidence: 99%

Aquaculture systems in Hanoi, Vietnam.

Nguyen¹

2020

Preprint

View full text Add to dashboard Cite

Hanoi, the capital of Vietnam, is one of the most densely populated areas in the world, with about 3,000 people km-2. Traditionally, aquaculture is practiced in ponds, reservoirs and urban lakes, rice fields, wastewater and VAC [an acronym from the Vietnamese words for garden (vuon), pond (ao) and livestock quarters (chuong)] systems. With over 5,000 ha of surface area and 3,000 ha of lowland rice fields, Hanoi has potential for further aquaculture development and tourism-entertainment services. The importance of aquaculture has long been recognized as a source of income and employment. Nowadays, pond aquaculture in peri-urban areas is decreasing due to urbanization, while in areas far from the city it is increasing through the conversion of lowland rice fields to fish ponds.

show abstract

Section: Backdoor Attacks and Defenses In Flmentioning

confidence: 99%

Aquaculture systems in Hanoi, Vietnam.

Nguyen¹

2020

Preprint

View full text Add to dashboard Cite

show abstract

“…After that, the LDP technique has been widely applied in the industry to protect their users' privacy, like iOS for Apple [60] Win 10 for Microsoft [14], and Samsung [47]. Since the concept of LDP was proposed, it has been widely applied in multiple fields, including multi-attribute values estimation [18], [53] marginal release [13], [73], time series data release [69], graph data collection [59], [67], [68], key-value data collection [28], [70], [71] and private learning [74], [75].…”

Section: Related Workmentioning

confidence: 99%

Differential Aggregation against General Colluding Attackers

Du¹,

Ye²,

Fu³

et al. 2023

Preprint

View full text Add to dashboard Cite

Local Differential Privacy (LDP) is now widely adopted in large-scale systems to collect and analyze sensitive data while preserving users' privacy. However, almost all LDP protocols rely on a semi-trust model where users are curiousbut-honest, which rarely holds in real-world scenarios. Recent works [7], [12], [65] show poor estimation accuracy of many LDP protocols under malicious threat models. Although a few works have proposed some countermeasures to address these attacks, they all require prior knowledge of either the attacking pattern or the poison value distribution, which is impractical as they can be easily evaded by the attackers.In this paper, we adopt a general opportunistic-and-colluding threat model and propose a multi-group Differential Aggregation Protocol (DAP) to improve the accuracy of mean estimation under LDP. Different from all existing works that detect poison values on individual basis, DAP mitigates the overall impact of poison values on the estimated mean. It relies on a new probing mechanism EMF (i.e., Expectation-Maximization Filter) to estimate features of the attackers. In addition to EMF, DAP also consists of two EMF postprocessing procedures (EMF* and CEMF*), and a group-wise mean aggregation scheme to optimize the final estimated mean to achieve the smallest variance. Extensive experimental results on both synthetic and real-world datasets demonstrate the superior performance of DAP over state-of-the-art solutions.

show abstract

“…Several approaches suggest perturbing or adding noise to the prediction results to prevent the adversary from executing the (supervised) retraining process to reconstruct the model [6,41,64]. This can be achieved with Differential Privacy to hide the decision boundary between prediction labels regardless of how many queries are executed by the adversary [73]. Another approach is to poison the training objective of the adversary by actively perturbing the predictions without impacting the utility for benign users [53].…”

Section: E Mitigating Model Stealing Attacksmentioning

confidence: 99%

ezDPS: An Efficient and Zero-Knowledge Machine Learning Inference Pipeline

Wang

Hoang

2023

PoPETs

View full text Add to dashboard Cite

Machine Learning as a service (MLaaS) permits resource-limited clients to access powerful data analytics services ubiquitously. Despite its merits, MLaaS poses significant concerns regarding the integrity of delegated computation and the privacy of the server’s model parameters. To address this issue, Zhang et al. (CCS'20) initiated the study of zero-knowledge Machine Learning (zkML). Few zkML schemes have been proposed afterward; however, they focus on sole ML classification algorithms that may not offer satisfactory accuracy or require large-scale training data and model parameters, which may not be desirable for some applications. We propose ezDPS, a new efficient and zero-knowledge ML inference scheme. Unlike prior works, ezDPS is a zkML pipeline in which the data is processed in multiple stages for high accuracy. Each stage of ezDPS is harnessed with an established ML algorithm that is shown to be effective in various applications, including Discrete Wavelet Transformation, Principal Components Analysis, and Support Vector Machine. We design new gadgets to prove ML operations effectively. We fully implemented ezDPS and assessed its performance on real datasets. Experimental results showed that ezDPS achieves one-to-three orders of magnitude more efficient than the generic circuit-based approach in all metrics while maintaining more desirable accuracy than single ML classification approaches.

show abstract

Protecting Decision Boundary of Machine Learning Model With Differentially Private Perturbation

Cited by 20 publications

References 29 publications

Aquaculture systems in Hanoi, Vietnam.

Aquaculture systems in Hanoi, Vietnam.

Differential Aggregation against General Colluding Attackers

ezDPS: An Efficient and Zero-Knowledge Machine Learning Inference Pipeline

Contact Info

Product

Resources

About