RelaxLoss: Defending Membership Inference Attacks without Losing Utility

As a long-term threat to the privacy of training data , membership inference attacks ( MIAs ) emerge ubiquitously in machine learning models . Existing works evidence strong connection between the distinguishability of the training and testing loss distributions and the model ’ s vulnerability to MIAs . Motivated by existing results , we propose a novel training framework based on a relaxed loss ( RelaxLoss ) with a more achievable learning target , which leads to narrowed generalization gap and reduced privacy leakage . RelaxLoss is applicable to any classification model with added benefits of easy implementation and negligible overhead . Through extensive evaluations on five datasets with diverse modalities ( images , medical data , transaction records ) , our approach consistently outperforms state-of-the-art defense mechanisms in terms of resilience against MIAs as well as model utility . Our defense is the first that can withstand a wide range of attacks while preserving ( or even improving ) the target model ’ s utility . 1 INTRODUCTION . While deep learning ( DL ) models have achieved tremendous success in the past few years , their deployments in many sensitive domains ( e.g. , medical , financial ) bring privacy concerns since data misuse in these domains induces severe privacy risks to individuals . In particular , modern deep neural networks ( NN ) are prone to memorize training data due to their high capacity , making them vulnerable to privacy attacks that extract detailed information about the individuals from models ( Shokri et al. , 2017 ; Song et al. , 2017 ; Yeom et al. , 2018 ) . In membership inference attack ( MIA ) , an adversary attempts to identify whether a specific data sample was used to train a target victim model . This threat is pervasive in various data domains ( e.g. , images , medical data , transaction records ) and inevitably poses serious privacy threats to individuals ( Shokri et al. , 2017 ; Nasr et al. , 2018 ; Salem et al. , 2019 ) , even given only black-box access ( query inputs in , posterior predictions out ) ( Shokri et al. , 2017 ; Salem et al. , 2019 ; Song & Mittal , 2020 ) or partially observed output predictions ( e.g. , top-k predicted labels ) ( Choo et al. , 2020 ) . Significant advances have been achieved to defend against MIAs . Conventionally , regularization methods designed for mitigating overfitting such as dropout ( Srivastava et al. , 2014 ) and weightdecay ( Geman et al. , 1992 ) are regarded as defense mechanisms ( Salem et al. , 2019 ; Jia et al. , 2019 ; Shokri et al. , 2017 ) . However , as conveyed by Kaya et al . ( 2020 ) ; Kaya & Dumitras ( 2021 ) , vanilla regularization techniques ( which are not designed for MIA ) , despite slight improvement towards reducing the generalization gap , are generally unable to eliminate MIA . In contrast , recent works design defenses tailored to MIA . A common strategy among such defenses is adversarial training ( Goodfellow et al. , 2014b ; a ) , where a surrogate attack model ( represented as a NN ) is used to approximate the real attack and subsequently the target model is modified to maximize prediction errors of the surrogate attacker via adversarial training . This strategy contributes to remarkable success in defending NN-based attacks ( Nasr et al. , 2018 ; Jia et al. , 2019 ) . However , these methods are greatly restricted by strong assumptions on attack models , thereby failing to generalize to novel attacks unanticipated by the defender ( e.g. , a simple metric-based attack ) ( Song & Mittal , 2020 ) . In order to defend attacks beyond the surrogate one , differentially private ( DP ) training techniques ( Abadi et al. , 2016 ; Papernot et al. , 2016 ; 2018 ) that provide strict guarantees against MIA are exploited . Nevertheless , as evidenced by Rahman et al . ( 2018 ) ; Jia et al . ( 2019 ) ; Hayes et al . ( 2019 ) ; Jayaraman & Evans ( 2019 ) ; Chen et al . ( 2020 ) ; Kaya & Dumitras ( 2021 ) , incorporating DP constraints inevitably compromises model utility and increases computation cost . In this paper , we present an effective defense against MIAs while avoiding negative impacts on the defender ’ s model utility . Our approach is built on two main insights : ( i ) the optimal attack only depends on the sample loss under mild assumptions of the model parameters ( Sablayrolles et al. , 2019 ) ; ( ii ) a large difference between the training loss and the testing loss provably causes high membership privacy risks ( Yeom et al. , 2018 ) . By intentionally ‘ relaxing ’ the target training loss to a level which is more achievable for the test loss , our approach narrows the loss gap and reduces the distinguishability between the training and testing loss distributions , effectively preventing various types of attacks in practice . Moreover , our approach allows for a utility-preserving ( or even improving ) defense , greatly improving upon previous results . As a practical benefit , our approach is easy to implement and can be integrated into any classification models with minimal overhead . Contributions . ( i ) We propose RelaxLoss , a simple yet effective defense mechanism to strengthen a target model ’ s resilience against MIAs without degrading its utility . To the best of our knowledge , our approach for the first time addresses a wide range of attacks while preserving ( or even improving ) the model utility . ( ii ) We derive our method from a Bayesian optimal attacker and provide both empirical and analytical evidence supporting the main principles of our approach . ( iii ) Extensive evaluations on five datasets with diverse modalities demonstrate that our method outperforms state-of-the-art approaches by a large margin in membership inference protection and privacy-utility trade-off . 2 RELATED WORK . Membership Inference Attack . Inferring membership information from deep NNs has been investigated in various application scenarios , ranging from the white-box setting where the whole target model is released ( Nasr et al. , 2019 ; Rezaei & Liu , 2020 ) to the black-box setting where the complete/partial output predictions are accessible to the adversary ( Shokri et al. , 2017 ; Salem et al. , 2019 ; Yeom et al. , 2018 ; Sablayrolles et al. , 2019 ; Song & Mittal , 2020 ; Choo et al. , 2020 ; Hui et al. , 2021 ; Truex et al. , 2019 ) . An adversary first determines the most informative features ( depending on the application scenarios ) that faithfully reflect the sample membership ( e.g. , logits/posterior predictions ( Shokri et al. , 2017 ; Salem et al. , 2019 ; Jia et al. , 2019 ) , loss values ( Yeom et al. , 2018 ; Sablayrolles et al. , 2019 ) , and gradient norms ( Nasr et al. , 2019 ; Rezaei & Liu , 2020 ) ) , and subsequently extracts common patterns in these features among the training samples for identifying membership . In this work , we work towards an effective defense by suppressing the common patterns that an optimal attack relies on . Defense . Existing defense mechanisms against MIA are mainly divided into three main categories : ( i ) regularization techniques to alleviate model overfitting , ( ii ) adversarial training to confuse surrogate attackers , and ( iii ) a differentially private mechanism offering rigorous privacy guarantees . Our proposed approach can be regarded as a regularization technique owing to its effect in reducing generalization gap . Unlike previous regularization techniques , our method is explicitly tailored towards defending MIAs by reducing the information that an attacker can exploit , leading to significantly better defense effectiveness . Algorithmically , our approach shares similarity with techniques that suppress the target model ’ s confidence score predictions ( e.g. , label-smoothing ( Guo et al. , 2017 ; Müller et al. , 2019 ) and confidence-penalty ( Pereyra et al. , 2017 ) ) , but ours is fundamentally different in the sense that we modulate the loss distribution with gradient ascent . Previous state-of-the-art defense mechanisms against MIA , such as Memguard ( Jia et al. , 2019 ) and Adversarial Regularization ( Nasr et al. , 2018 ) , are built on top of the idea of adversarial training ( Goodfellow et al. , 2014b ; a ) . Such approaches usually rely on strong assumptions about attack models , making their effectiveness highly dependent on the similarity between the surrogate and the real attacker ( Song & Mittal , 2020 ) . In contrast , our method does not rely on any assumptions about the attack model , and has shown consistent effectiveness across different attacker types . Differential privacy ( Dwork , 2008 ; Dwork et al. , 2014 ; Abadi et al. , 2016 ; Papernot et al. , 2016 ) provides strict worst-case guarantees against arbitrarily powerful attackers that exceed practical limits , but inevitably sacrifices model utility ( Rahman et al. , 2018 ; Jia et al. , 2019 ; Hayes et al. , 2019 ; Chen et al. , 2020 ; Kaya & Dumitras , 2021 ; Jayaraman & Evans , 2019 ) and meanwhile increases computation burden ( Goodfellow , 2015 ; Dangel et al. , 2019 ) . In contrast , we focus on practically realizable attacks for utility-preserving and computationally efficient defense . 3 PRELIMINARIES . Notations . We denote by zi = ( xi , yi ) one data sample , where xi and yi are the feature and the one-hot label vector , respectively . f ( · ; θ ) represents a classification model parametrized by θ , and p = f ( x ; θ ) ∈ [ 0 , 1 ] C denotes the predicted posterior scores ( after the final softmax layer ) where C denotes the number of classes . 1 denotes the indicator function , i.e. , 1 [ p ] equals 1 if the predicate p is true , else 0 . We use subscripts for sample index and superscripts for class index . Attacker ’ s Assumptions . We consider the standard setting of MIA : the attacker has access to a query set S = { ( zi , mi ) } Ni=1 containing both member ( training ) and non-member ( testing ) samples drawn from the same data distribution Pdata , where mi is the membership attribute ( mi = 1 if zi is a member ) . The task is to infer the value of the membership attribute mi associated with each query sample zi . We design defense for a general attack with full access to the target model . The attack A ( zi , f ( · ; θ ) ) is a binary classifier which predicts mi for a given query sample zi and a target model parametrized by θ . The Bayes optimal attack Aopt ( zi , f ( · ; θ ) ) will output 1 if the query sample is more likely to be contained in the training set , based on the real underlying membership probability P ( mi = 1|zi , θ ) , which is usually formulated as a non-negative log ratio : Aopt ( zi , f ( · ; θ ) ) = 1 [ log P ( mi = 1|zi , θ ) P ( mi = 0|zi , θ ) ≥ 0 ] ( 1 ) Defender ’ s Assumptions . We closely mimic an assumption-free scenario in designing our defense method . In particular , we consider a knowledge-limited defender which : ( i ) does not have access to additional public ( unlabelled ) training data ( in contrast to Papernot et al . ( 2016 ; 2018 ) ) ; and ( ii ) lacks prior knowledge of the attack strategy ( in contrast to Jia et al . ( 2019 ) ; Nasr et al . ( 2018 ) ) . For added rigor , we also study attacker ’ s countermeasures to our defense in Section 6.4 .

Summary: The study tackles the problem of defense against membership inference attack, with a focus on (1) decreasing the performance of the attack, (2) maintaining the classifier’s performance, (3) assuming the blindness towards the attack model. They achieve (1) by closing the distance between the train and test distributions and maintain the utility of the model by flattening the posterior scores of the non-target classes. Their method is shown to be computationally efficient (i.e., the additional computational cost is negligible), close to optimal in maintaining the trade-off between the utility and attack performance, and effective in the face of attack’s countermeasures.