Bounding Training Data Reconstruction in Private (Deep) Learning

By Chuan Guo, Brian Karrer, Kamalika Chaudhuri, L. V. D. van der Maaten. 2022

70 citations recorded by the source corpus.

Differential privacy is widely accepted as the de facto method for preventing data leakage in ML, and conventional wisdom suggests that it offers strong protection against privacy attacks. However, existing semantic guarantees for DP focus on membership inference, which may overestimate the adversary's capabilities and is not applicable when membership status itself is non-sensitive. In this paper, we derive the first semantic guarantees for DP mechanisms against training data reconstruction attacks under a formal threat model. We show that two distinct privacy accounting methods -- Renyi differential privacy and Fisher information leakage -- both offer strong semantic protection against data reconstruction attacks.

Subfields: Artificial Intelligence, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Privacy & Security

Citations in the corpus

Foundation Models and Fair Use (2023, background): “Machine learning researchers have theoretically and empirically shown that models trained with strong levels of DP guarantee are limited in memorizing training data, and extracting or reconstructing training data from DP-trained models can be close to infeasible (Guo et al., 2022; Carlini et al., 20”
How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy (2023, background): “Formal relationships between DP guarantees and reconstruction attacks have also been established (Bhowmick et al., 2019; Balle et al., 2022b; Guo et al., 2022a,b; Stock et al., 2022), often with the goal of directly informing the choice of ε if the primary concern is a specific notion of…”