Reconstruction Attack through Classifier Analysis

Abstract

In this paper, we introduce a novel inference attack that we coin as the reconstruction attack whose objective is to reconstruct a probabilistic version of the original dataset on which a classifier was learnt from the description of this classifier and possibly some auxiliary information. In a nutshell, the reconstruction attack exploits the structure of the classifier in order to derive a probabilistic version of dataset on which this model has been trained. Moreover, we propose a general framework that can be used to assess the success of a reconstruction attack in terms of a novel distance between the reconstructed and original datasets. In case of multiple releases of classifiers, we also give a strategy that can be used to merge the different reconstructed datasets into a single coherent one that is closer to the original dataset than any of the simple reconstructed datasets. Finally, we give an instantiation of this reconstruction attack on a decision tree classifier that was learnt using the algorithm C4.5 and evaluate experimentally its efficiency. The results of this experimentation demonstrate that the proposed attack is able to reconstruct a significant part of the original dataset, thus highlighting the need to develop new learning algorithms whose output is specifically tailored to mitigate the success of this type of attack.

Stealing Neural Networks via Timing Side Channels

“…This is done iteratively by sampling data points and using membership inference attacks to reconstruct the training data used by the target Neural Network. In data reconstruction attack, an adversary uses a generative adversarial network to reconstruct training data samples from target model by finding the approximate training data distribution [30] [10]. Either of the two approaches can be used to reconstruct the dataset and it is a one time operation done during the setup phase of the attack as described in Section VI.…”

From the Editors and Nguyen Tat Thanh University

“…Interpretable models enhance transparency but can inadvertently disclose information about their training data. Gambs et al [56] uses such data leakage to probabilistically reconstruct a decision tree's training set. The uncertainty within this reconstruction can be measured to determine how much information the model leaks.…”

“…If a value D 𝑖,𝑘 within 𝑉 𝑘 has all the probability mass (i.e., 𝑃 (D 𝑖,𝑘 = 𝑣 𝑖,𝑘 ) = 1), it's deterministic. Conversely, a probabilistic dataset encompasses some uncertainty about attribute values.• Probabilistic Reconstruction Attacks: Earlier research[56] proposes a method for constructing a probabilistic dataset D 𝐷𝑇 from the structure of a trained decision tree 𝐷𝑇 . This probabilistic dataset reflects the decision tree's implicit knowledge about its training dataset D 𝑂𝑟𝑖𝑔 .…”

Bypassing system calls–based intrusion detection systems

“…As shown in the work of Hamlen et al, 18 an IDS decision tree can be recovered this way by exploiting public interfaces of an IDS and building the decision tree by feeding it with many samples and examining their classifications. Reconstruction attacks such as the one described in the previous work 28 for a C4.5 decision tree could also be used for this purpose.…”

“…As shown in the work of Hamlen et al, an IDS decision tree can be recovered this way by exploiting public interfaces of an IDS and building the decision tree by feeding it with many samples and examining their classifications. Reconstruction attacks such as the one described in the previous work for a C4.5 decision tree could also be used for this purpose. This assumption that the IDS classifier can be reconstructed is common in several papers on this subject (eg, in the literature), as well as in cryptography (Kerckhoffs's principle).…”