Visible to the public Membership Inference Attacks Against Adversarially Robust Deep Learning Models

TitleMembership Inference Attacks Against Adversarially Robust Deep Learning Models
Publication TypeConference Paper
Year of Publication2019
AuthorsSong, Liwei, Shokri, Reza, Mittal, Prateek
Conference Name2019 IEEE Security and Privacy Workshops (SPW)
Keywordsadversarial defense, adversarial defense methods, adversarial defenses, adversarial training method, adversarially robust deep learning models, compositionality, Data models, data privacy, Deep Learning, empirical membership inference attacks, evasion attacks, learning (artificial intelligence), membership inference attack, Metrics, neural nets, Predictive models, privacy, privacy challenges, provable defense, provable security, pubcrawl, resilience, Resiliency, security, Security and Privacy, security challenges, security of data, target model, Training, Training data
AbstractIn recent years, the research community has increasingly focused on understanding the security and privacy challenges posed by deep learning models. However, the security domain and the privacy domain have typically been considered separately. It is thus unclear whether the defense methods in one domain will have any unexpected impact on the other domain. In this paper, we take a step towards enhancing our understanding of deep learning models when the two domains are combined together. We do this by measuring the success of membership inference attacks against two state-of-the-art adversarial defense methods that mitigate evasion attacks: adversarial training and provable defense. On the one hand, membership inference attacks aim to infer an individual's participation in the target model's training dataset and are known to be correlated with target model's overfitting. On the other hand, adversarial defense methods aim to enhance the robustness of target models by ensuring that model predictions are unchanged for a small area around each sample in the training dataset. Intuitively, adversarial defenses may rely more on the training dataset and be more vulnerable to membership inference attacks. By performing empirical membership inference attacks on both adversarially robust models and corresponding undefended models, we find that the adversarial training method is indeed more susceptible to membership inference attacks, and the privacy leakage is directly correlated with model robustness. We also find that the provable defense approach does not lead to enhanced success of membership inference attacks. However, this is achieved by significantly sacrificing the accuracy of the model on benign data points, indicating that privacy, security, and prediction accuracy are not jointly achieved in these two approaches.
Citation Keysong_membership_2019