Machine Learning Apparatus for Membership Inference Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning systems face a trade-off between accuracy and resistance to Membership Inference (MI) attacks, where confidential information in training data can leak from learned parameters, and attackers can predict training data from inferred parameters, making it difficult to enhance both accuracy and attack resistance simultaneously.
Innovation Solution
A machine learning apparatus comprising multiple inference units and a classifier that differentiates between training and inference data, where each inference unit is trained on distinct subsets of data based on the classifier's output, ensuring that the data used for training is not used for inference and vice versa, thereby improving resistance to MI attacks without compromising accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning models are trained using all available training data to improve accuracy, then inference accuracy improves, but resistance to Membership Inference attacks deteriorates because attackers can predict training data from learned parameters
Solution Approach 1:
The training data is segmented into multiple disjoint subsets, where each inference unit is trained on a specific subset. This segmentation ensures that no single inference unit has access to all training data, thereby preventing attackers from effectively performing MI attacks while maintaining inference accuracy through the collective capability of multiple units.
Solution Approach 2:
Each inference unit is assigned a specific local quality characteristic by being trained on a distinct subset of training data. This local specialization allows each unit to maintain high accuracy on its designated subset while the diversity of subsets across units provides collective resistance to MI attacks.
2Reliability
If parameters are adjusted to improve resistance to MI attacks, then attack resistance improves, but inference accuracy deteriorates due to the trade-off relationship
Solution Approach 1:
Multiple inference units, each trained on different subsets of training data, are merged into a collective system. The combination of these specialized units achieves both high inference accuracy (through diverse expertise) and strong MI attack resistance (through data separation), eliminating the need to compromise between the two objectives.
3Device complexity
If a single inference unit is used to simplify the system, then device complexity is reduced, but resistance to MI attacks deteriorates because all training data is concentrated in one model
Solution Approach 1:
The single inference unit is segmented into multiple inference units, each handling a portion of the training data. This segmentation increases system complexity slightly but provides significant benefits in MI attack resistance by distributing and isolating training data across multiple units.
Data Source
AI summary
A machine learning apparatus according to the embodiment including: n (n is an integer greater than or equal to 2) inference units which are machine learning models trained using training data; and a classifier configured to classify an input data and to output an output data. A first inference unit from among the n inference units performs inference based on the input data when the output data of the classifier is a first value. At least one inference unit other than the first inference unit is trained using the input data when the output data of the classifier is the first value as the training data.