Reproduce “Defending Model Inversion and Membership Inference Attacks via Prediction Purification” on OpenResearch

About this paper

Ziqi Yang, Bin Shao, Bohan Xuan, Ee-Chien Chang, Fan Zhang

This research introduces a purification framework that uses an autoencoder and adversarial training to defend against both model inversion and membership inference attacks in black-box machine learning settings. The method effectively reduces attack accuracy for membership inference by up to 15% and increases model inversion error by a factor of up to 4, all while maintaining classification accuracy loss below 0.4%.

Key insights

• Reducing the dispersion and distinguishability of confidence score vectors is a fundamental mechanism to mitigate both model inversion and membership inference attacks.
• An empirical connection exists between MI and MIA attacks; specializing the purifier to defend against one type of attack inherently provides protection against the other, validating a unified defense approach.
• Adversarial training within the purification framework effectively hardens the defense against sophisticated inference attacks without sacrificing model utility significantly.

Summary by alphaXiv.