R ELAX L OSS : D EFENDING M EMBERSHIP I NFERENCE A TTACKS WITHOUT L OSING U TILITY
Anonymous authors
Paper under double-blind review
A BSTRACT
As a long-term threat to the privacy of training data, membership inference attacks (MIAs) emerge ubiquitously in machine learning models.
Existing works evidence strong connection between the distinguishability of the training and testing loss distributions and the model’s vulnerability to MIAs.
Motivated by existing results, we propose a novel training framework based on a relaxed loss ( RelaxLoss ) with a more achievable learning target, which leads to narrowed generalization gap and reduced privacy leakage.
RelaxLoss is applicable to any classification model with added benefits of easy implementation and negligible overhead.
Through extensive evaluations on five datasets with diverse modalities (images, medical data, transaction records), our approach consistently outperforms state-of-the-art defense mechanisms in terms of resilience against MIAs as well as model utility.
Our defense is the first that can withstand a wide range of attacks while preserving (or even improving) the target model’s utility.
I NTRODUCTION
While deep learning (DL) models have achieved tremendous success in the past few years, their deployments in many sensitive domains (e.g., medical, financial) bring privacy concerns since data misuse in these domains induces severe privacy risks to individuals.
In particular, modern deep neural networks (NN) are prone to memorize training data due to their high capacity, making them vulnerable to privacy attacks that extract detailed information about the individuals from models (Shokri et al., 2017; Song et al., 2017;
Yeom et al., 2018) .
In membership inference attack (MIA), an adversary attempts to identify whether a specific data sample was used to train a target victim model.
This threat is pervasive in various data domains (e.g., images, medical data, transaction records) and inevitably poses serious privacy threats to individuals (Shokri et al., 2017; Nasr et al., 2018; Salem et al., 2019), even given only black-box access (query inputs in, posterior predictions out)
(Shokri et al., 2017; Salem et al., 2019; Song &
Mittal, 2020) or partially observed output predictions (e.g., top-k predicted labels) (Choo et al., 2020).
Significant advances have been achieved to defend against MIAs.
Conventionally, regularization methods designed for mitigating overfitting such as dropout (Srivastava et al., 2014) and weightdecay (Geman et al., 1992) are regarded as defense mechanisms (Salem et al., 2019;
Jia et al., 2019; Shokri et al., 2017).
However, as conveyed by Kaya et al.
(2020); Kaya & Dumitras (2021), vanilla regularization techniques (which are not designed for MIA), despite slight improvement towards reducing the generalization gap, are generally unable to eliminate MIA.
In contrast, recent works design defenses tailored to MIA.
A common strategy among such defenses is adversarial training (Goodfellow et al., 2014b;a), where a surrogate attack model (represented as a NN) is used to approximate the real attack and subsequently the target model is modified to maximize prediction errors of the surrogate attacker via adversarial training.
This strategy contributes to remarkable success in defending NN-based attacks (Nasr et al., 2018;
Jia et al., 2019).
However, these methods are greatly restricted by strong assumptions on attack models, thereby failing to generalize to novel attacks unanticipated by the defender (e.g., a simple metric-based attack) (Song & Mittal, 2020).
In order to defend attacks beyond the surrogate one, differentially private (DP) training techniques (Abadi et al., 2016; Papernot et al., 2016; 2018) that provide strict guarantees against MIA are exploited.
Nevertheless, as evidenced by Rahman et al.
; Jia et al.
; Hayes et al.
; Jayaraman
& Evans (2019)
; Chen et al.
(2020); Kaya & Dumitras (2021), incorporating DP constraints inevitably compromises model utility and increases computation cost.
In this paper, we present an effective defense against MIAs while avoiding negative impacts on the defender’s model utility.
Our approach is built on two main insights: (i) the optimal attack only depends on the sample loss under mild assumptions of the model parameters (Sablayrolles et al., 2019); (ii) a large difference between the training loss and the testing loss provably causes high membership privacy risks (Yeom et al., 2018).
By intentionally ‘relaxing’ the target training loss to a level which is more achievable for the test loss, our approach narrows the loss gap and reduces the distinguishability between the training and testing loss distributions, effectively preventing various types of attacks in practice.
Moreover, our approach allows for a utility-preserving (or even improving) defense, greatly improving upon previous results.
As a practical benefit, our approach is easy to implement and can be integrated into any classification models with minimal overhead.
Contributions.
(i)
We propose RelaxLoss , a simple yet effective defense mechanism to strengthen a target model’s resilience against MIAs without degrading its utility.
To the best of our knowledge, our approach for the first time addresses a wide range of attacks while preserving (or even improving) the model utility.
(ii)
We derive our method from a Bayesian optimal attacker and provide both empirical and analytical evidence supporting the main principles of our approach.
(iii) Extensive evaluations on five datasets with diverse modalities demonstrate that our method outperforms state-of-the-art approaches by a large margin in membership inference protection and privacy-utility trade-off.
R ELATED W ORK
Membership Inference Attack.
Inferring membership information from deep NNs has been investigated in various application scenarios, ranging from the white-box setting where the whole target model is released (Nasr et al., 2019; Rezaei & Liu, 2020) to the black-box setting where the complete/partial output predictions are accessible to the adversary (Shokri et al., 2017; Salem et al., 2019; Yeom et al., 2018; Sablayrolles et al., 2019; Song & Mittal, 2020;
Choo et al., 2020; Hui et al., 2021; Truex et al., 2019).
An adversary first determines the most informative features (depending on the application scenarios) that faithfully reflect the sample membership (e.g., logits/posterior predictions (Shokri et al., 2017; Salem et al., 2019;
Jia et al., 2019), loss values (Yeom et al., 2018; Sablayrolles et al., 2019), and gradient norms (Nasr et al., 2019; Rezaei & Liu, 2020)), and subsequently extracts common patterns in these features among the training samples for identifying membership.
In this work, we work towards an effective defense by suppressing the common patterns that an optimal attack relies on.
Defense.
Existing defense mechanisms against MIA are mainly divided into three main categories: (i) regularization techniques to alleviate model overfitting, (ii) adversarial training to confuse surrogate attackers, and (iii) a differentially private mechanism offering rigorous privacy guarantees.
Our proposed approach can be regarded as a regularization technique owing to its effect in reducing generalization gap.
Unlike previous regularization techniques, our method is explicitly tailored towards defending MIAs by reducing the information that an attacker can exploit, leading to significantly better defense effectiveness.
Algorithmically, our approach shares similarity with techniques that suppress the target model’s confidence score predictions (e.g., label-smoothing (Guo et al., 2017;
Müller et al., 2019) and confidence-penalty (Pereyra et al., 2017)), but ours is fundamentally different in the sense that we modulate the loss distribution with gradient ascent.
Previous state-of-the-art defense mechanisms against MIA, such as Memguard (Jia et al., 2019) and Adversarial Regularization (Nasr et al., 2018), are built on top of the idea of adversarial training (Goodfellow et al., 2014b;a).
Such approaches usually rely on strong assumptions about attack models, making their effectiveness highly dependent on the similarity between the surrogate and the real attacker (Song & Mittal, 2020).
In contrast, our method does not rely on any assumptions about the attack model, and has shown consistent effectiveness across different attacker types.
Differential privacy (Dwork, 2008; Dwork et al., 2014; Abadi et al., 2016; Papernot et al., 2016) provides strict worst-case guarantees against arbitrarily powerful attackers that exceed practical limits, but inevitably sacrifices model utility (Rahman et al.,
; Jia et al., 2019; Hayes et al., 2019;
Chen et al., 2020; Kaya & Dumitras, 2021; Jayaraman & Evans, 2019) and meanwhile increases computation burden (Goodfellow, 2015; Dangel et al., 2019).
In contrast, we focus on practically realizable attacks for utility-preserving and computationally efficient defense.
P RELIMINARIES
Notations.
We denote by z i = ( x i , y i ) one data sample, where x i and y i are the feature and the one-hot label vector, respectively.
f ( · ; θ ) represents a classification model parametrized by θ , and p = f ( x ; θ ) ∈ [0 , 1] C denotes the predicted posterior scores (after the final softmax layer) where C denotes the number of classes.
1 denotes the indicator function, i.e., 1 [ p ] equals 1 if the predicate p is true, else 0.
We use subscripts for sample index and superscripts for class index.
Attacker’s Assumptions.
We consider the standard setting of MIA: the attacker has access to a query set S =
{ ( z i , m i ) }
Ni =1 containing both member (training) and non-member (testing) samples drawn from the same data distribution P data , where m i is the membership attribute ( m i
=
if z i is a member). The task is to infer the value of the membership attribute m i associated with each query sample
z i .
We design defense for a general attack with full access to the target model.
The attack A ( z i , θ ) is a binary classifier which predicts m i for a given query sample
z i and a target model parametrized by θ .
The Bayes optimal attack A opt ( z i , θ ) will output 1 if the query sample is more likely to be contained in the training set, based on the real underlying membership probability P ( m i = 1 |
z i , θ ) , which is usually formulated as a non-negative log ratio:
[Equation]
Defender’s Assumptions.
We closely mimic an assumption-free scenario in designing our defense method.
In particular, we consider a knowledge-limited defender which: (i) does not have access to additional public (unlabelled) training data (in contrast to Papernot et al.
(2016; 2018)); and (ii) lacks prior knowledge of the attack strategy (in contrast to Jia et al.
; Nasr et al.
For added rigor, we also study attacker’s countermeasures to our defense in Section 6.4.
R ELAX L OSS
The ultimate goal of the defender is two-fold: (i) privacy: reducing distinguishability of member and non-member samples; (ii) utility: avoiding the sacrifice of the target model’s performance.
We hereby introduce each component of our method targeting at privacy (Section 4.1) and utility (Section 4.2).
4. P RIVACY : R EDUCE D ISTINGUISHABILITY VIA R ELAXED T ARGET L OSS
We begin by exploiting the dependence of attack success rate on the sample loss (Yeom et al., 2018; Sablayrolles et al., 2019).
In particular, a large gap in the expected loss values on the member and non-member data, i.e., E [ ℓ ] non − E [ ℓ ] mem , is proved to be sufficient for conducting attacks (Yeom et al., 2018).
Along this line, Sablayrolles et al.
(2019) further show that the Bayes optimal attack only depends on the sample loss under a mild posterior assumption of the model parameter: P ( θ | z
[Equation]
[Equation]
Formally
[Equation]
[Equation]
where τ denotes a threshold function 2 .
Intuitively, Equation 2 shows that z i is likely to be used for training if the target model exhibits small loss value on it.
These results motivate our approach to mitigate MIAs by reducing distinguishablitiy between the member and non-member loss distributions.
empirical risk (cid:80) Ni = [Table]
m [Table] T [Table]
temperature [Table] We summarize both the strategy MALT and MAST from Sablayrolles et al. (2019) in Equation 2, where τ is a constant function for MALT.
Algorithm
Input: Dataset { ( x i , y i ) } Ni =1 , training epochs E , learning rates τ , batch size B , number of output classes C , target loss value α
Output: Model f ( · ; θ ) with parameters θ
Initialize model parameter θ ; for epoch in { 1 , ..., E } do for batch_index in { 1 , ..., K } do Get sample batch { ( x i , y i ) }
Bi =1 Perform forward pass: p i = f
( x i ; θ )
Compute cross entropy loss
L ( θ ) on the batch if L ( θ ) ≥ α then // gradient descent θ ← θ − τ · ∇L ( θ ) elseif epoch %2 =
then // gradient ascent θ ← θ + τ · ∇L ( θ ) else //
posterior flattening
Construct softlabel t i with t ci = (cid:26) p ci if y ci =(1 − p ci ) /
( C − 1) otherwise
Compute cross entropy loss with the softlabel: a )
[Equation]
θ , z i )
Update model parameters: θ ← θ − τ ∇L ( θ ) end end end endreturn model f ( · ; θ ) a sg stands for the stopgradient operator that [Table]
and
[Table]
derivatives, i.
[Table]
[Table]
constant.
Relaxing Loss Target with Gradient Ascent. Directly operating on member and non-member loss distributions, however, is impractical, since the exact distributions are intractable and a large amount of additional hold-out samples are required for estimating the distribution of non-member data. In order to bypass these issues and reduce the distinguishability between the member and nonmember loss distributions, we propose to simplify the problem by considering the mean of the loss distributions, and subsequently set a more achievable mean value for the target loss, where the loss target is relaxed to a level that is easier to be achieved for the non-member data. Algorithmically, instead of pursuing zero training loss of the target model, we relax the target mean loss value α to be larger than zero and apply a gradient ascent step as long as the average loss of the current batch is smaller than α .
4. U TILITY : A PPLY P OSTERIOR F LATTENING AND N ORMAL G RADIENT O PERATIONS
With the relaxed target loss, the predicted posterior score of the ground-truth class p gt is no longer maximized towards 1.
If the probability mass of all non-ground-truth classes 1 − p gt concentrates on only few of them (e.g., hard samples that are close to the decision boundary between two classes), it is very likely that one non-ground-truth class has a score larger than p gt (i.e., max c,c ̸ = gt p c > p gt ), thus leading to incorrect predictions.
To address this issue, we propose to encourage a large margin between the prediction score of the ground-truth-class and the others by flattening the target posterior scores for nonground-truth classes.
Specifically, we dynamically construct softlabels during each epoch by: (i) retaining the score of the ground-truth class, i.e., the current predicted value p gt , and (ii) re-allocating the remaining probability mass evenly to all non-ground-truth classes.
In summary, we run a repetitive training strategy to balance privacy and utility, which consists of two steps: (i) if the model is not well-trained, i.e., the current loss is larger than the target mean value α , we run a normal gradient descent step; (ii) otherwise, we apply gradient ascent or the posterior flattening step (See Algorithm 1).
A NALYTICAL I NSIGHTS
In this section, we analyze the key properties that explain the effectiveness of RelaxLoss.
We provide both analytical and empirical evidence showing that RelaxLoss can (i) reduce the generalization gap, and (ii) increase the variance of the training loss distribution, both contributing to mitigating MIAs. [Figure] [Figure]
[Table] +JNr</latexit
{+[Figure] <latexit sha1_base64="9UEdTd8bfRDEEFt4h/269qNgL9M=">AAAB+3icbVDLSsNAFJ34rPUV69LNYBEEoSRS1GVRFy4r2Ac0oUymN+3QySTMTMQS+ituXCji1h9x5984abPQ1gMXzpxzL3PvCRLOlHacb2tldW19Y7O0Vd7e2d3btw8qbRWnkkKLxjyW3YAo4ExASzPNoZtIIFHAoROMb3K/8whSsVg86EkCfkSGgoWMEm2kvl3xgHN8hr1b4Jrg/NW3q07NmQEvE7cgVVSg2be/vEFM0wiEppwo1XOdRPsZkZpRDtOylypICB2TIfQMFSQC5Wez3af4xCgDHMbSlNB4pv6eyEik1CQKTGdE9Egtern4n9dLdXjlZ0wkqQZB5x+FKcc6xnkQeMAkUM0nhhAqmdkV0xGRhGoTV9mE4C6evEza5zX3ola/r1cb10UcJXSEjtEpctElaqA71EQtRNETekav6M2aWi/ [Figure] /Uxb12xiplD9AfW5w
+}
t
[Figure]
RelaxLoss reduce the generalization gap.
We apply RelaxLoss to CIFAR-10 dataset and plot the resulting loss histograms in Figure 1.
With a more achievable learning target, RelaxLoss blurs the gap between the member and non-member loss distributions (Figure 1), which naturally leads to a narrowed generalization gap (Appendix Figure 7) and reduced privacy leakage (Yeom et al., 2018).
RelaxLoss increases the variance of the training loss distribution.
We observe that RelaxLoss spreads out the training loss distribution (i.e., increase the variance) due to its gradient ascent step (Appendix A.1): large loss samples tend to have a more significant increase in its loss value during the gradient ascent step (See Figure 2 for demonstration).
In contrast, except DP-SGD, existing defense methods do not have this property (Appendix C.10).
Intuition suggests that the increase of training loss variance suppresses the common pattern among training losses and reduces the information that can be exploited by an attacker, thus contributing to the protection against attacks.
To verify the association between the variance increasing effect and the defense effectiveness, we conduct experiments on CIFAR-10 dataset and measure the Pearson’s correlation coefficients between the training loss variance and the attack AUC (Appendix Figure 6).
With an overall score of -0.85 (-0.
and -0.94 for black-box and white-box attacks, respectively), we conclude a fairly strong negative relationship.
When considering a typical Gaussian assumption of the loss distributions (Yeom et al., 2018; Li et al., 2020), we further show this variance increasing property helps to lower an upper bound of the attack AUC, and provide formal analysis in Appendix A.2.
E XPERIMENTS
In this section, we rigorously evaluate the effectiveness of our defense across a wide range of datasets with diverse modalities, various strong attack models, and eight defense baselines representing the previous state of the art.
6. E XPERIMENTAL SETUP
Target Models and Datasets.
We set up seven target models, trained on five datasets (CIFAR10, CIFAR-100, CH-MNIST, Texas100, Purchase100) with diverse modalities (natural and medical images, medical records, and shopping histories).
For image datasets, we adopt a 20-layer ResNet (He et al., 2016) and an 11-layer VGG (Simonyan & Zisserman, 2015); and for non-image datasets, we adopt MLPs with the same architecture and same training protocol as in previous works (Nasr et al., 2018;
Jia et al., 2019).
We evenly split each dataset into five folds and use each fold as the training/testing set for the target/shadow model 3 , and use the last fold for training the surrogate attack model (for Jia et al.
Shokri et al.
We fix the random seed and training setting for a fair comparison among different defense methods.
See Appendix B for more details.
Attack methods.
To broadly handle attack methods in our defense evaluation, we consider attacks in a variety of application scenarios ( black-box and white-box ) and strategies.
We consider the following state-of-the-art attacks from two categories: (i) White-box attacks : Both Nasr et al.
; Rezaei &
Liu (2020) are based on gradient norm thresholding.
We denote these attacks by the type of gradient followed by its norm.
Grad-x and Grad-w stand for the gradient w.r.t.
the input and the model parameters , respectively; (ii) Black-box attacks : Salem et al.
(2019) (denoted as NN , standing for the proposed neural network attack model).
We adopt the implementation provided by Jia et al.
and use the complete logits prediction as input to the attacker.
Sablayrolles et al.
(2019) (denoted as
Loss for their loss thresholding method).
We use a general threshold independent of the query sample, as the adaptive thresholding version is more expensive computational-wise with no or only marginal improvements.
Song & Mittal (2020) (denoted as Entropy and M-Entropy for their proposed attack by thresholding the prediction entropy and a modified version, respectively.).
We exclude attacks that only use partial output predictions (e.g., top-1 predicted label) from our evaluation as they are strictly weaker than the attacks we include above (Choo et al., 2020).
Evaluation metrics.
We evaluate along two fronts: utility (measured by test accuracy of the victim model) and privacy.
For privacy, in line with previous works (Song & Mittal, 2020; Jia et al., 2019;
Sablayrolles et al., 2019; Shokri et al., 2017; Nasr et al., 2018; Salem et al., 2019), we consider the following two metrics: (i) attack accuracy : We evaluate the attack accuracy on a balanced query set, where a random guessing baseline corresponds to 50% accuracy.
For threshold-based attack methods, following Song & Mittal (2020), we select the threshold value to be the one with the best attack accuracy on the shadow model and shadow dataset; (ii) attack AUC : The area under the receiver operating characteristic curve (AUC), corresponding to an integral over all possible threshold values, represents the degree of separability.
A perfect defense mechanism corresponds to AUC=0.5.
6. C OMPARISON TO B ASELINES
Defense Baselines.
We consider two state-of-the-art defense methods: Memguard (Jia et al., 2019) and Adversarial regularization ( Adv-Reg ) (Nasr et al., 2018).
Additionally, we compare to five regularization methods: Early-stopping , Dropout (Srivastava et al., 2014), Label-smoothing (Guo et al., 2017; Müller et al., 2019), Confidence-penalty (Pereyra et al., 2017) and (Self-) Distillation (Hinton et al., 2015; Zhang et al., 2019).
Moreover, we compare to differential private mechanism, i.e., Differentially private stochastic gradient descent ( DP-SGD ) (Abadi et al., 2016) 4 .
We exclude defenses that additionally require public (unlabelled) data (Papernot et al., 2016; 2018) for training the target model from our evaluation.
[Figure]
Privacy-utility trade-off.
We vary the hyperparameters that best describe the privacy-utility trade-off of each method across their effective ranges (See Appendix B for details) and plot the corresponding privacy-utility curves.
We set the attack AUC value ( privacy ) as x-axis and the target model’s performance ( utility ) as the y-axis.
A better defense exhibits a privacy-utility curve approaching the top-left corner, i.e., high utility and low privacy risk.
As shown in Figure 3(a) and 3(b) (and Appendix Figure 9-13), we observe that our method improves the privacy-utility trade-off over baselines for almost all cases: (i) Previous state-of-the-art defenses (Memguard and Adv-Reg) are effective for the NN attack, but can hardly generalize to the other types of attack, which is also verified in Song & Mittal (2020).
Moreover, as a test-time defense, Memguard is not applicable to white-box attacks.
In contrast, our method is consistently effective irrespective of the attack model and applicable to all types of attacks.
(ii)
In comparison with other regularization methods, our method showcases significantly better defense effectiveness.
Specifically, when compared with Early-stopping, the generally most effective regularization-based defense baseline, our approach decreases the attack AUC (i.e., relative percentage change) by up to 26% on CIFAR-10 and 46% on CIFAR-100 for a same level of utility.
(iii) DP-SGD is generally the most effective defense baseline, despite the meaningless large ϵ values, which is consistent with Choo et al.
In comparison with DP-SGD, our method improves the target model’s test accuracy by around 16% on CIFAR-10 and 12% on CIFAR-100 (relative percentage increase) across different privacy levels.
(iv) (See detailed results in Appendix C.9)
Our approach is the only one that exhibit consistent defense effectiveness across various data modalities and model architectures, while the best baseline methods can only show effectiveness for at most one data modality (e.g., DP-SGD for images, and Label-smoothing for transaction records).
6. R ELAX L OSS V S . A TTACKS
As can be seen from the privacy-utility curves in Figure 3 and Appendix C.9, our approach is the only one that can consistently defend various MIAs without sacrificing the model utility.
We then evaluate to what extend the attacks can be defended without loss in the model utility .
To this end, we select α corresponds to the model with the lowest privacy risk (lowest attack AUC averaged over all attacks), under the constraint that the defended model achieve a top-1 test accuracy not worse than the undefended model.
Utility.
Table 1 summarizes the test accuracy of target models defended with our method.
Compared with vanilla training, our method achieves a consistent improvement (up to 7.46%) in terms of utility
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure] [Table] [Figure] [Table]
[Figure] [Table] [Figure] [Table]
[Figure]
[Table] [Figure] [Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
h
[Figure]
e
[Figure]
[Figure]
[Figure]
A U C
[Figure] [Figure]
I F
[Figure]
R )
[Figure]
[Figure]
[Figure]
across different datasets and model architectures, albeit a 0.2% accuracy drop for a saturated topaccuracy (99.6% compared to 99.8%)
Privacy.
Figure 4 shows the membership privacy risk ( AUC ) of the target models in Table 1.
We observe that our method is consistently effective for all types of attacks, datasets, and model architectures.
In particular, our method consistently reduces the attack AUC: (i) to <0.6 for all non-image datasets; (ii) from 0.7 to 0.55 for CH-MNIST; (iii) from >0.8 to 0.55 for CIFAR-10 (R) and from >0.9 to <0.6 for CIFAR-100 (R).
We also include the attack accuracy values in Appendix
Table 5, which shows our method reduces most attacks to a random-guessing level.
We thus conclude that our method improves both target models’ utility as well as their resilience against MIAs.
6. A DAPTIVE A TTACK
We further analyze the robustness of our method against attack’s countermeasures.
Namely, we consider the situations where attackers have full knowledge about our defense mechanism and the selected hyperparameters, and have tailored the attacks to our defense method.
We simulate the adaptive attacks by: (i) training shadow models with the same configuration used for training our defended target models in Table 1, (ii) simulating the adaptive attacks using the calibrated shadow models. We report the highest attack accuracy (i.e., worst-case privacy risk) among different adaptive attacks in Table 2 (See Appendix C.4 for details).
We observe that despite being less effective in defending against adaptive attacks than non-adaptive attacks, our method still greatly decreases the highest adaptive attacker’s accuracy by 13.6%-37.6% compared to vanilla training.
[Table]
6. A BLATION STUDY
We study the impact of each component of our approach and plot the results in Figure 5.
We observe that while applying posterior flattening alone (without gradient ascent) has limited effects, using it together with gradient ascent indeed improves the model’s test accuracy across a wide range of attack
AUC, which validates the necessity of all components of our method
[Table]
[Figure]
s t
A cc u r a c y
[Figure]
D ISCUSSION
Properties of RelaxLoss.
RelaxLoss enjoys several properties which explain its superiority over existing defense methods.
In particular, we provide empirical and analytical evidence showing that in contrast to most existing methods (Appendix C.10), RelaxLoss reduces the generalization gap and spreads out the training loss distributions (Section 5), thereby effectively defeating MIAs.
Moreover, we observe that RelaxLoss soften the decision boundaries (Appendix C.11), which contributes to improving model generalization (Zhang et al., 2017; Pereyra et al., 2017).
Practicality.
We consider the practicality of our method from the following aspects: (i) Hyperparameter tuning : Our method involves a single hyperparameter α that controls the trade-off between privacy and utility.
A fine-grained grid search on a validation set (i.e., first estimating the privacyutility trade-off with varying value of α , and subsequently selecting the α corresponding to the desired privacy/utility level) allows precise control over the expected privacy/utility level of the target model.
(ii) Computation cost : Our method incurs negligible additional computation cost when compared with backpropagation in vanilla training (Appendix C.8).
In contrast, baseline methods generally suffer from a larger computation burden.
For instance, Memguard slows down the inference due to its test-time optimization step, while the training speed of DP-SGD and Adv-Reg is greatly hindered by per-sample gradient computation (Goodfellow, 2015; Dangel et al., 2019) and adversarial update step, respectively.
C ONCLUSION
In this paper, we present RelaxLoss , a novel training scheme that is highly effective in protecting against privacy attacks while improving the utility of target models.
Our primary insight is that membership privacy risks can be reduced by narrowing the gap between the loss distributions.
We validate the effectiveness of our method on a wide range of datasets and models, and evidence its superiority when compared with eight defense baselines which represent previous state of the art.
As
RelaxLoss exhibits superior protection and performance and is easy to be implemented in various machine learning models, we expect it to be highly practical and widely used.
Our code and models will be released upon publication.
Appendix Table of Contents A Theoretical Analysis
A.1 How Does Gradient Ascent Step Increase Loss Variance? . . . . . . . . . . . .
A.2 How Does RelaxLoss Affect MIA? . . . . . . . . . . . . . . . . . . . . . . . .
B Experiment Setup
B.1 Datasets . .
B.2 Model Architectures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B.3 Training Protocol . .
B.4 Required Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B.5 Defense Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
C Additional Results and Discussion
C.1 Limitations and Future Works . . . . . . . . . . . . . . . . . . . . . . . . . . .
C.2 Correlation Between Loss Variance and Attack AUC . . . . . . . . . . . . . . .
C.3 RelaxLoss Vs.
Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
C.4 Adaptive Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
C.5 Generalization Gap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
C.6 Compatibility with Data [Table] [Table] [Table]
[Table] [Table]
[Table] [Table]
[Table]
This appendix provides additional support to the main ideas presented in the submission: §A provides additional theoretical analysis giving rise to insights on the foundations of our method.
Moreover, as we have conducted a rigorous and broad experimental analysis that goes beyond the key insights presented in the main paper, we provide additional details on the experimental setup in §B and a range of additional evaluation results and discussion in §C.
A T HEORETICAL A NALYSIS A. H OW D OES G RADIENT A SCENT S TEP I NCREASE L OSS V ARIANCE ?
In this section, we show how the gradient ascent step in RelaxLoss increase the loss variance.
We write ℓ for the loss instead of ℓ ( θ , z i ) for brevity if the dependence is not relevant for our argumentation.
Theorem A.1.
If Cov( ℓ, ∆ ℓ ) > 0 , then the variance of loss distribution Var( ℓ ) is increased after a gradient ascent step.
Proof.
The variance of loss distribution before and after applying gradient ascent step amounts to
Var( ℓ ) and Var( ℓ + ∆ ℓ ) , respectively.
Following from the fact that
[Equation]
and the non-negativity of Var(∆ ℓ ) as well as Cov( ℓ, ∆ ℓ ) , we conclude Var( ℓ + ∆ ℓ ) >
Var( ℓ ) , i.e., the loss variance will increase.
We focus on the loss increase after the gradient ascent step (i.e., assuming that ∆ ℓ ≥ 0 , which holds for most cases, despite the stochasticity) and interpret ∆ ℓ as the rate of loss change.
The condition Cov( ℓ, ∆ ℓ ) > 0 can be understood as: the larger the loss value is, the faster it changes, and vice versa.
This is a reasonable assumption for most training algorithms for achieving convergence.
We reason the exact condition and the related assumptions below.
Condition A.1.
The gradient magnitude (squared ℓ 2 norm) is positively correlated to the loss value, i.e., Cov( ∥∇ ℓ ∥ 22 , ℓ ) > 0 .
Intuitively, it means the gradient norm tends to decrease as the loss decreases.
We use the cross-entropy loss as an example:
[Equation]
The gradient is given by:
[Equation]
where J θ i represents the jacobian of the logits (before the final softmax layer) w.r.t.
the model parameter θ .
Once the loss on sample z i becomes smaller, we have ∥ p i − y i ∥ 2 → 0 , i.e., the prediction get closer to the ground-truth label.
By the submultiplicativity of matrix norm and the continuity of the squared function, we then have ∥∇ ℓ CE ( θ , z i ) ∥ 22 → 0 , i.e., the gradient norm decreases as the loss value gets smaller.
Hence, ℓ CE ( θ , z i ) has the desired property required by
Condition A.1.
Condition A.2.
The change in loss after the gradient ascent step ∆ ℓ is linear in the squared gradient norm ∥∇ ℓ ∥ 22 , i.e., ∆ ℓ = c 1 ∥∇ ℓ ∥ 22 + c 2 with c 1 , c 2 the constants quantifying the linear relationship.
Corollary A.1.
Given the assumption that the gradient of each sample within a batch (1) has the same norm and (2) has non-negative inner product (i.e., well-aligned) with each other and the gradient alignments remain the same over different batches, the gradient ascent step: θ ( t +1)
= θ ( t ) + τ ∇L ( θ ( t ) ) satisfy the linearity (in Condition A.2) with c 1 > 0 , where the superscript t corresponds to the t -th iteration, and ∇L denotes the batch gradient with batchsize =
B .
Proof.
This follows from the nature of the first-order gradient-based optimization method.
Applying a first-order Taylor-expansion of the sample loss at θ ( t ) , we obtain:
[Equation]
where cos( α ij ) is the cosine of the angle between gradients of sample i and j , and O ( τ ) summarizes the higher-order terms and is regarded as a constant (i.e., c 2 ).
Given the assumption that each sample within a batch exhibits well-aligned gradients with the same norm, i.e., ∥∇ ℓ ( θ ( t ) , z i ) ∥ 2 = ∥∇ ℓ ( θ ( t ) , z j ) ∥ 2 and cos( α ij ) ≥ 0 for all j ̸
= i , we have Equation 6 and τB (cid:0) 1 + (cid:80) j ̸ = i cos( α ij ) (cid:1) > 0 . Additionally, given that the gradient alignments remain the same over different batches, i.e., (cid:0) 1 + (cid:80) j ̸ = i cos( α ij ) (cid:1) is constant for all i, j , we have c 1 = τB (cid:0) 1 + (cid:80)
j ̸ = i cos( α ij ) (cid:1) > 0 .
Lemma A.1.
Given the Condition A.1 and A.2, we have the desired property Cov( ℓ, ∆ ℓ ) by linearity.
Proof.
[Equation]
where Equation 7 and 8 are yielded by using Condition A.2 and A.1, respectively.
[Equation]
In this section, we show how RelaxLoss affects the optimal MIA A opt (measured by its AUC value).
We exploit the following results for relating the attack AUC to a statistical distance between the loss distributions.
We first regard the MIA as a binary hypothesis testing problem with the null H 0 and alternate hypothesis H 1 defined as follows: [Equation] [Equation]
[Equation]
The attacker need to make a decision on whether the query sample came from D train based on a rejection region S reject .
As discussed in Section 4.1, under a posterior assumption on the model parameter, S reject for the optimal attack A opt (Sablayrolles et al., 2019) fully depends on the sample loss, i.e., A opt rejects the null hypothesis if ℓ ( θ , z i ) ∈ S reject .
The type I error (i.e., the H 0 is true but rejected) is defined as P ( ℓ ( θ ,
D train ) ∈ S reject ) , and the type II error (i.e., the H 0 is false but retained) is defined as P ( ℓ ( θ ,
D train ) ∈ S reject ) .
Theorem A.2.
(Kairouz et al., 2015; Lin et al., 2018; 2021) Let TP and FP denote the true positive rate ( 1 − type II error) and false positive rate (type I error) of A opt respectively, their relation to the total variation distance between the loss distributions D TV ( P, Q ) is quantified as follows (See
Kairouz et al.
Appendix A for the derivation):
[Equation]
[Equation]
where P and Q denote the distribution of the training loss ℓ ( θ , D train ) and the testing loss ℓ ( θ , D train ) , respectively.
The ROC curve is obtained by plotting the largest achievable true positive ( TP ) rate on the vertical axis against the false positive ( FP ) rate on the horizontal axis, while the AUC value corresponds to a summation over all pairs of TP and FP .
Corollary A.2.
The AUC value can be upper bounded as follows (Lin et al.
Corollary 1):
[Equation]
For ease of analysis, we then upper bound the total variation distance via the Hellinger distance, which is symmetric and has a closed-form expression for common distributions such as Gaussian.
Theorem A.3.
(Steerneman, 1983)The total variance distance can be upper bounded by the Hellinger distance:
[Equation]
where the Hellinger distance {+satisfies 
+} ≤ D H ( P, Q ) ≤
For Gaussian distributions, the Hellinger distance has a closed form:
[Equation]
[Equation]
where µ 1 , µ 2 denote the mean and σ 1 , σ 2 denote the variance of P and Q .
Let c = σ 2 /σ 1 denote the ratio of the training and testing loss variance, we see that D H ( P, Q ) is fully characterized by: (i) the value of the training loss variance σ 21 , (ii) the squared distance between the mean ( µ 1 − µ 2 ) 2 , and (iii) the variance ratio c :
[Equation]
Our approach decreases the ( µ 1 − µ 2 ) 2 and increases σ 21 (Section 5) as well, both of which lead to a decrease of the Hellinger distance, and thus decreases the upper bound of the attacker AUC as desired.
It remains to consider how our approach will change c and how the change in c will affect the
Hellinger distance.
First, we observe that c ≥ 1 , i.e., the testing distribution has larger variance than the training distribution (See Appendix C.10).
Moreover, c gets closer to 1 when applying our approach (See Figure 1 in the main paper).
As a result, ( ∗ ) will increase (Corollary A.3) and ( ∗∗ ) will decrease (Corollary A.4).
Corollary A.3.
If c ′ ≥ c ≥ 1 , then (cid:113) 2 c 1+ c 2 ≥ (cid:113) 2 c ′ 1+ c ′
Proof.
Let f ( c )
= (cid:113) 2 c 1+ c 2 .
We have f ′ ( c ) =
1 − c 2 √ 2 c ( c 2 +1) 3 / 2 .
It is obvious that f has critical point at c = 1 , i.e., f ′ (1) = {+
+}
and f ′ ( c ) ≤ 0 .
Corollary A.4.
For fixed value of µ 1 , µ 2 and σ 1 , if c ′ ≥ c ≥ 1 , then [Equation]
Proof.
It is obvious as c occurs in the denominator inside the exponential term.
Additionally, we notice that the change in the ( ∗ ) dominates in most cases: the ( ∗∗ ) term commonly has value within [0 . 9 , 1 . 0] , while the ( ∗ ) term changes from 10 − 3 to 1 when our approach is applied.
Therefore, under a Gaussian assumption of the loss distributions, our method can decrease the
Hellinger distance between the distributions, thereby reducing an upper bound of the attack AUC.
B E XPERIMENT S ETUP B. D ATASETS
CIFAR-10 (Krizhevsky et al., 2009) is a dataset of 60k color images with shape 32 × 32 × 3 .
Each image corresponds to a label of 10 classes which categorizes the object inside the image.
Following the standard preprocessing procedure 5 , we normalize the image pixel value to have zero mean and unit standard deviation.
CIFAR-100 (Krizhevsky et al., 2009) consists of 60k color images of size 32 × 32 × 3 inclasses.
Same as for the CIFAR-10 dataset, we perform mean-subtraction and standardization.
CH-MNIST (Kather et al., 2016) contains 5000 greyscale images of 8 different types of tissues from patients with colorectal cancer.
We obtain the preprocessed dataset from Kaggle 6 and use images of size 28×28 for our experiments.
All images are normalized to [ − 1 , 1] .
Texas100 contains medical records of 67,330 patients published by the Texas Department of State
Health Services 7 .
Each patient’s record contains 6,169 binary features (such as diagnosis, generic information, and procedures the patient underwent) and is labeled by its most suitable procedure (among the 100 most frequent ones).
We use the preprocessed data provided by Shokri et al.
Song & Mittal (2020) 8 .
Purchase100 is a dataset of customers’ shopping records released by the Kaggle Acquire Valued
Shoppers Challenge 9 .
We use the preprocessed version provided by Shokri et al.
; Song &
Mittal (2020) 8 , which contains 197,324 data samples.
Each sample, representing one user’s purchase history, consists of 600 binary features.
Each feature denotes the presence of one product in the corresponding user’s purchase history.
The data is clustered into 100 classes of different purchase styles.
The classification task is to predict the purchase style given the 600 binary features.
We summarize all datasets in details in Table 3.
[Table]
B. M ODEL A RCHITECTURES
For CIFAR-10 and CIFAR-100 datasets, we use a 20-layer ResNet and an 11-layer VGG architecture 10 .
For CH-MNIST, we adopt a 20-layer ResNet.
And for the non-image datasets, we adopt the same architecture as used in Nasr et al.
(2018) 11 : a 4-layer fully-connected neural network with layer size [1024, 512, 256, 100] for Purchase100, and a 5-layer fully-connected neural network with layer size [2048, 1024, 512, 256, 100] for Texas100.
B. T RAINING P ROTOCOL
We apply SGD optimizer with momentum=0.9 and weight-decay=1e-4 by default.
We set the initial learning rate τ = 0 .
1 and drop the learning rate by a factor of 10 at each decay epoch 10 .
We list below the decay epochs in square brackets and the total number of training epochs are marked in parentheses: CIFAR-10 and CIFAR-100 [150,225] (300);
CH-MNIST [40,60] (80);
Texas100 and
Purchase100 [50,100] (120).
By default, no data augmentation is applied.
B. R EQUIRED R ESOURCES
All our models and methods are implemented in PyTorch.
Our experiments are conducted with
Nvidia Tesla V100 and Quadro RTX8000 GPUs.
Our method introduces minimal changes and negligible additional cost compared with vanilla training and thus can be flexibly integrated into any deep learning framework without imposing specific constraints on the required hardware resources.
B. D EFENSE M ETHODS Early-stopping.
The basic idea behind Early-stopping is to truncate training before a model starts to overfit.
In our experiments, we save target models’ checkpoints at varying numbers of training epochs and subsequently evaluate the attack AUC and test accuracy of each model checkpoint.
We set checkpoints at the following epochs: [25 , 50 , 75 , 100 , 125 , 150 , 175 , 200 , 225 , 250 , 275] for CIFAR-10 and CIFAR-100 datasets; [5 , 10 , 15 , 20 , 25 , 30 , 40 , 50] for CH-MNIST dataset; [10 , 20 , 30 , 40 , 50 , 60 , 70 , 80 , 90 , 100 , 110] for Texas100 and Purchase100 datasets.
Dropout.
Dropout prevents co-adaptation of feature detectors by randomly masking out a set of neurons in the networks, thereby alleviating model overfitting.
In our experiments, we apply dropout to the last fully-connected layer of each target model and evaluate across a wide range of dropout rates (over [0 . 1 , 0 . 3 , 0 . 5 , 0 . 7 , 0 . 9] ).
Label-smoothing.
Label-smoothing prevents overconfident predictions by incorporating a regularization term into the training objective that penalizes the distance (measured by the KL-divergence) between the model predictions and the uniform distribution.
The objective is formularized as follows
[Equation]
(14) where D KL is the KL-divergence; U denotes the uniform distribution; p θ ( y | x ) denotes the output prediction.
α is a hyper-parameter with range [0 , 1] that balances the cross-entropy loss L CE and the regularization term.
We vary the α across its full range for plotting the privacy-utility curves.
Confidence-penalty.
Confidence-penalty regularizes models by penalizing low entropy output distributions.
This is achieved via an entropy regularization term in the objective:
[Equation]
where H ( p
[Equation]
( y | x
[Equation]
= − [Equation] [Equation] H represents the entropy of the output prediction, and α is a hyper-parameter that controls the importance of the entropy regularization term.
Consistent with the original paper (Pereyra et al., 2017), we vary the α over [0 . 1 , 0 .
Distillation.
Knowledge distillation stands for a general process of transferring knowledge from a set of teacher model(s) to a student model.
To focus our investigation on the effect of the distillation operation itself, we use self-distillation (Zhang et al., 2019) in our experiments, i.e., we train the student model to match a single teacher model with the same architecture.
The objective for training the student model (i.e., the target model) is:
[Equation]
[Equation]
where
[Equation]
The KL-divergence term D KL targets at minimizing discrepancy between the softened student (cid:101) p θ s ( y | x ) and teacher prediction (cid:101) p θ t ( y | x ) .
T denotes the temperature scaling factor that controls the degree of softening.
α is a hyper-parameter that balances the KL-divergence and the normal cross-entropy L CE term.
To determine the hyper-parameter that best describes the privacy-utility trade-off, we conduct preliminary experiments and investigate the effect of α and T independently.
By fixing one and changing the other, we observe similar results in terms of the privacy-utility trade-off.
Following practical standards, we then fix the α =0.5 and vary the temperature T over [1 , 2 , 5 , 10 , 20 , 50 , 100] for plotting the privacy-utility curves.
DP-SGD.
DP-SGD enforces privacy guarantees by modifying the optimization process.
It consists of two steps: (i) clipping the gradients to have a L 2 -norm upper-bounded by C at each training step; (ii) injecting random noise to the gradients before performing update steps.
We adopt the implementation provided by the Opacus library 12 .
We tune the clipping bound C when fixing the noise scale to 0 .
1 , as suggested by the official documents.
To plot the privacy-utility curves, we vary the noise scale with a fixed pre-selected clipping bound.
Memguard.
Memguard modifies the output predictions of pre-trained target models during test-time, i.e., output predictions are perturbed by adversarial noise to fool a surrogate attack model.
Following the official implementation 13 , we adopt the same architecture for the surrogate and the real NN attack model, and use the complete logits prediction as input to the attack models.
Each surrogate attack model is trained on the target model’s predictions when inputting the target model’s training data (used as member samples) and a separate hold-out set data (used as non-member samples).
The privacy-utility trade-off is fully determined by the magnitude of the adversarial noise (measured by
L 1 -norm).
We plot the privacy-utility curves by increasing the noise magnitude from 0 until the NN attack has been defended (i.e., attack AUC ≈ 0.5).
Adv-Reg.
Adv-Reg incorporates an adversarial objective when training the target model: the target model is trained to minimize a weighted sum of the cross-entropy loss and the adversarial loss (obtained from a surrogate attack).
Same as in Memguard, each surrogate attack model is trained on the target model’s training data and a separate hold-out set data.
We follow the official implementationand vary the weight α (=1.0 by default) of the adversarial loss across [0 . 8 , 1 . 0 , 1 . 2 , 1 . 4 , 1 . 6 , 1 . 8] for plotting the privacy-utility curves.
C A DDITIONAL R ESULTS AND D ISCUSSION C. L IMITATIONS AND F UTURE W ORKS
Although RelaxLoss is empirically proven effective for improving target models’ utility, it is generally hard to explain such improvement, as understanding the generalization ability is still an open problem.
As an attempt
[Figure]
we conduct experiments on toy datasets and attribute the improvement to a flat decision boundary (See Appendix C.11).
A thorough investigation into how each individual components of our approach affects generalization are left for our future works.
In addition, the assumptions of model parameters (Sablayrolles et al., 2019) which are made for the optimal attack demand further validation.
C. C ORRELATION B ETWEEN L OSS V ARIANCE AND A TTACK AUC
We plot the attack AUC values versus the training loss variance in Figure 6.
Each point in the figure corresponds to one target model trained with different defense mechanisms.
We indeed observe a negative correlation between the loss variance and the AUC value of both the black-box and white-box attacks, which supports Section 5 in the main paper.
[Figure]
C. R ELAX L OSS V S . A TTACKS
Supplementary to Table 1 in the main paper, Table 4 summarizes the top-1 training and test accuracy as well as the generalization gap (i.e., difference between the top-1 training and test accuracy) of target models with or without being defended via our method.
We observe that our approach, as desired, reduces the generalization gap and is still able to achieve high performance.
[Table] In Table
[Table]
we show the attack accuracy values on target models trained with and without (wo) applying our defense method, which is supplementary to Table 1 and Figure 4 in the main paper.
Same as in previous work (Song & Mittal, 2020) 8 , the attack’s decision threshold is selected to be the one that yields the best attack accuracy on undefended shadow models.
We observe that our approach effectively reduces the attack accuracy to a random-guessing level (around 50%) for most cases. In
[Table] particular, we find that the selected decision thresholds is highly biased in certain cases s [Table]
t. all the queried samples are predicted to be positive (or negative), which leads to exactly 50% accuracy. C. A DAPTIVE A TTACK In Table
[Table]
we show the accuracy of adaptive (a.) attacks on target models trained with (w/) applying our defense method, which is supplementary to Section 6.4 in the main paper.
For thresholding-based attacks, the attack’s decision threshold is selected to be the one that yields the best attack accuracy on the shadow models (which is trained with exactly the same configuration as our defended target models in Table 1).
And for the NN-based attack, we use the complete logits prediction from the pre-trained shadow models as features to train the adaptive attack models (modeled as a NN).
We observe that our approach consistently reduces the attack accuracy for all cases, though the reduction is less significant compared to non-adaptive attacks shown in Table
[Table]
C. G ENERALIZATION G AP
We show the training and testing accuracy (and the generalization gap) when applying RelaxLoss with varying value of α in Figure 7.
We observe that increasing the value of α will reduce the generalization gap.
Moreover, RelaxLoss with a reasonable value of α can even improves the test accuracy of vanilla training [Table]
[Figure]
C. C OMPATIBILITY WITH D ATA A UGMENTATION
Additionally, we investigate the effectiveness of our approach when data augmentation is applied.
Following practical standard
[Figure]
we apply random cropping and random flipping when training the target models on CIFAR-100 dataset.
As illustrated in Figure [Figure] RelaxLoss is compatible with standard data augmentation techniques: our approach enjoys the performance boost introduced by data augmentation while retaining its effectiveness in defending MIAs. [Figure]
s
[Figure]
A
[Figure]
u r a c y
[Figure]
C. E FFECT ON D IFFERENT C LASSES OF I NDIVIDUALS
To analyze the effect of RelaxLoss on different individuals, we conduct additional experiments on
Texas and Purchase datasets which consist of 100 classes with non-uniform class distribution (i.e., the proportion of each class ranges from 0.35% to 4.5% for Texas, and 0.05%-2.6% for Purchase) and evaluate the attack performance on each class separately.
In Table 7, we show the 10 highest Attack AUC (in increasing order) among all the classes, which can be regarded as the estimated worst-case privacy risk of different classes of individuals.
As can be seen from the tables, applying our defense method effectively reduces the Top-10 Attack AUC (i.e., worst-case privacy risk), and the effectiveness is consistent on each dataset across different attack methods, with which we conclude that our method, despite the nonuniformity, does defend MIAs for different individuals.
C. C OMPUTATIONAL C OMPLEXITY
The additional computation cost of RelaxLoss scales as O ( BC )
( B : batch size; C : number of classes), which includes: (i) softlabel construction of cost O ( BC ) ; and (ii) computation of the cross-entropy loss on the softlabel O ( BC ) .
Note that we reuse the prediction p i generated by the previous forward-pass and thus no additional forward (nor backward) pass is required.
Compared to the forward and backward pass, which is of magnitude at least O ( BNL ) ( N : number of neurons per layer; L : number of layers), the additional costs of RelaxLoss are negligible as NL (roughly the total [Table] amount of neurons of the whole network) is much larger than C (the number of neurons of the last layer).
C. P RIVACY - UTILITY C URVES
In this section, we include detailed results with regard to various datasets and different target models’ architectures: we show results on CIFAR-10 dataset with VGG11 architecture in Figure 9; CIFARdataset with VGG11 architecture in Figure 10; CH-MNIST with ResNet20 architecture in Figure 11;
Texas100 with MLP architecutre in Figure 12; Purchase100 with MLP architecutre in Figure 13.
We observe that while baseline approaches are effective for at most one data modality, our approach is the only one that is consistently effective in defending MIAs, across all different datasets and model architectures.
Natural Images.
See Figure 3(a)-3(b) in main paper, and Figure 9-10: for natural image datasets (CIFAR-10 and CIFAR-100), DP-SGD is the best baseline method in terms of defending MIAs and preserving model utility, but is inferior to RelaxLoss as our method consistently achieve better test accuracy (model utility) across the full range of achievable privacy level.
Among all regularization-based defense methods, Early-stopping is the only one that exhibits noticeable effects in reducing attack AUCs.
In comparison, our approach can achieve the same level of defense effectiveness with a much better model utility.
Moreover, our approach can further decrease the attack AUC to a random-guessing level, which is not achievable by Early-stopping.
Memguard and Adv-Reg, previous state-of-the-art defense mechanisms specifically designed for
MIAs, are highly effective in defending NN-based attack but generally lose their effectiveness for other types of attacks.
In comparison, our approach shows much better defense effectiveness for all types of attacks while achieving better model utility at the same time.
Gray-scale Medical Images See Figure 11: for gray-scale medical image (CH-MNIST)
, our approach is comparable with the best baseline methods (i.e., Confidence-penalty), as both approaches are able to reduce the MIAs to a random-guessing level while preserving the model utility. [Figure] [Figure] In comparision
[Figure] DP-SGD is significantly worse than our approach for this data modality [Figure] as it inevitably degrades the model utility.
Memguard and Adv-Reg are still highly effective in defending NN-based attack.
Moreover, Memguard is able to defend black-box MIAs to a random-guessing level without degrading the model utility, but is not applicable to white-box attacks.
In contrast, our approach is applicable to all attacks, and achieves comparable (or better) effectiveness for black-box attacks.
[Figure]
Binary Medical and Transaction Records.
See Figure 12-13: for binary medical and transaction records (Texas100 and Purchase100), Label-smoothing performs generally the best among all baseline methods.
Compared to our approach, Label-smoothing can achieve superior model utility when the Attack AUC is of range around 0.65-0.8 on Texas100 and 0.55-0.65 on Purchase100.
However, our approach is able to reduce the attack AUC to around the random-guessing level, which is not always possible for Label-smoothing (white-box attacks on Purchase100, black-box attacks on both datasets).
DP-SGD exhibits unexpected results for these two datasets: small noise scale results in both lower
Attack AUC and higher model utility, which is contradictory to the common belief that small-scale noise only provides weak privacy guarantee and thus the Attack AUC will remain high.
We conjecture that there exists a non-negligible gap between the worst-case privacy guarantee that provided by the theoretical privacy analysis and the real-world attack performance in practice.
Especially for the small-scale noise case, the privacy cost ϵ is meaninglessly large and cannot faithfully reflect the risk when facing practical MIAs.
We tried varying the noise scale in the experiments: by decreasing the noise scale, we find DP-SGD cannot reduce the Attack AUC to random-guessing level, while by increasing the noise scale, the utility soon drops significantly.
In comparison, our approach consistently yields better privacy-utility trade-off.
[Figure] [Figure]
C. L OSS H ISTOGRAMS
To better understand the effect of each defense method, we additionally plot the loss histograms when applying different defense methods on target models with a ResNet20 architecture trained on
CIFAR-10 dataset in Figure 14-20.
In the parentheses of each subtitle, we show the hyper-parameter values corresponding to each subfigure from left to right.
We observe that: (i) Regularization techniques in general have limited effects in reducing the gap between the training and testing loss distributions.
(ii) Unlike our approach (See Figure 1 in the main paper), baseline methods are generally not able to increase the training loss variance nor closing the gaps between the member and non-member distributions, which explains the superior performance of our approach in defending various types of MIAs.
(iii)
By setting a relatively large noise scale,
DP-SGD is able to increase the training loss variance and reducing the gap between the training and testing loss values (See last column of Figure 17).
However, the large scale of noise dampen the learning signal in this case, leading to a non-negligible utility drop.
[Figure] [Figure]
o r m a li
z
e
d f r
[Figure]
qu e n c y
[Figure] [Figure]
[Figure] [Figure]
[Figure] [Figure]
n o r m a li
z e d f r e qu e n c y
[Figure]
C. A NALYSIS OF M ODEL G ENERALIZATION
As supplementary to Section 7 of our main paper, we show results of toy experiments that investigate the impact of our approach on model generalization.
We visualize the prediction scores and the decision boundaries in Figure 21.
In contrast to vanilla training that assigns high confidence scores on hard examples near the decision boundary, our approach can soften the decision boundaries, leading to a large area with low (and well-calibrated) predicted confidence scores.
In line with Zhang et al.
(2017); Pereyra et al.
(2017), we conjecture that the flatness of decision boundaries improves model generalization, while an in-depth analysis is left as future work.
[Figure]