Fetching the paper…

Reading the bibliography…

Trade-offs between membership privacy & adversarially robust learning · Around

2020

Trade-offs between membership privacy & adversarially robust learning

Hayes, Jamie

Original
PDF
Post on X

Understand

Historically, machine learning methods have not been designed with security in mind.

In turn, this has given rise to adversarial examples, carefully perturbed input samples aimed to mislead detection at test time, which have been applied to attack spam and malware classification, and more recently to attack image classification.
Consequently, an abundance of research has been devoted to designing machine learning methods that are robust to adversarial examples.
Unfortunately, there are desiderata besides robustness that a secure and safe machine learning model must satisfy, such as fairness and privacy.

Built on

Adversarial robustness may be at odds with simplicity
Original
Nakkiran, P. 2019 · 1901
Earlier work this paper cites.
Theoretically principled trade-off between robustness and accuracy
Original
Zhang, H.; Yu, Y.; Jiao, J.; Xing, E. P.; Ghaoui, L. E.; and Jordan, M. I. 2019 · 1901
Earlier work this paper cites.
Adversarial training can hurt generalization
Original
Raghunathan, A.; Xie, S. M.; Yang, F.; Duchi, J. C.; and Liang, P. 2019 · 1906
Earlier work this paper cites.
White-box vs black-box: Bayes optimal strategies for membership inference
Original
Sablayrolles, A.; Douze, M.; Ollivier, Y.; Schmid, C.; and Jégou, H. 2019 · 1908
Earlier work this paper cites.
Scaling up the accuracy of naive-bayes classifiers: A decision-tree hybrid
Kohavi, R. 1996 · 1996
Earlier work this paper cites.
Gradient-based learning applied to document recognition
LeCun, Y.; Bottou, L.; Bengio, Y.; Haffner, P.; et al. 1998 · 1998
Earlier work this paper cites.
More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Models
Original
Chen, L.; Min, Y.; Zhang, M.; and Karbasi, A. 2020 · 2002
Earlier work this paper cites.
The curious case of adversarially robust models: More data can help, double descend, or hurt generalization
Original
Min, Y.; Chen, L.; and Karbasi, A. 2020 · 2002
Earlier work this paper cites.
Understanding and mitigating the tradeoff between robustness and accuracy
Original
Raghunathan, A.; Xie, S. M.; Yang, F.; Duchi, J.; and Liang, P. 2020 · 2002
Earlier work this paper cites.
Overfitting in adversarially robust deep learning
Original
Rice, L.; Wong, E.; and Kolter, J. Z. 2020 · 2002
Earlier work this paper cites.
Adversarial classification
Dalvi, N.; Domingos, P.; Sanghai, S.; and Verma, D. 2004 · 2004
Earlier work this paper cites.
Information Leakage in Embedding Models
Original
Song, C.; and Raghunathan, A. 2020 · 2004
Earlier work this paper cites.
Influence Functions in Deep Learning Are Fragile
Original
Basu, S.; Pope, P.; and Feizi, S. 2020 · 2006
Earlier work this paper cites.
Calibrating noise to sensitivity in private data analysis
Dwork, C.; McSherry, F.; Nissim, K.; and Smith, A. 2006 · 2006
Earlier work this paper cites.
Label-Only Membership Inference Attacks
Original
Choo, C. A. C.; Tramer, F.; Carlini, N.; and Papernot, N. 2020 · 2007
Earlier work this paper cites.
Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays
Homer, N.; Szelinger, S.; Redman, M.; Duggan, D.; Tembe, W.; Muehling, J.; Pearson, J. V.; Stephan, D. A.; Nelson, S. F.; and Craig, D. W. 2008 · 2008
Earlier work this paper cites.

Similar

Learning multiple layers of features from tiny images
Krizhevsky, A.; et al. 2009 · 2009
Cited alongside, same era.
Intriguing properties of neural networks
Original
Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R. 2013 · 2013
Cited alongside, same era.
Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing
Fredrikson, M.; Lantz, E.; Jha, S.; Lin, S.; Page, D.; and Ristenpart, T. 2014 · 2014
Cited alongside, same era.
Explaining and harnessing adversarial examples
Original
Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2014 · 2014
Cited alongside, same era.
Robust traceability from trace amounts
Dwork, C.; Smith, A.; Steinke, T.; Ullman, J.; and Vadhan, S. 2015 · 2015
Cited alongside, same era.

Then

On the effectiveness of interval bound propagation for training verifiably robust models
Original
Gowal, S.; Dvijotham, K.; Stanforth, R.; Bunel, R.; Qin, C.; Uesato, J.; Mann, T.; and Kohli, P. 2018 · 2018
Later among the works it cites.
Adversarial risk bounds for binary classification via function transformation
Original
Khim, J.; and Loh, P.-L. 2018 · 2018
Later among the works it cites.
Differentiable abstract interpretation for provably robust neural networks
Mirman, M.; Gehr, T.; and Vechev, M. 2018 · 2018
Later among the works it cites.
Comprehensive privacy analysis of deep learning: Stand-alone and federated learning under passive and active white-box inference attacks
Original
Nasr, M.; Shokri, R.; and Houmansadr, A. 2018 · 2018
Later among the works it cites.
Privacy Risks of General-Purpose Language Models
Pan, X.; Zhang, M.; Ji, S.; and Yang, M. 2018 · 2018

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Model inversion attacks that exploit confidence information and basic countermeasures

Fredrikson, M.; Jha, S.; and Ristenpart, T. 2015 · 2015

Cited alongside, same era.

Membership privacy in MicroRNA-based studies

Backes, M.; Berrang, P.; Humbert, M.; and Manoharan, P. 2016 · 2016

Cited alongside, same era.

Deep residual learning for image recognition

He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016 · 2016

Cited alongside, same era.

A methodology for formalizing model-inversion attacks

Wu, X.; Fredrikson, M.; Jha, S.; and Naughton, J. F. 2016 · 2016

Cited alongside, same era.

Understanding black-box predictions via influence functions

Koh, P. W.; and Liang, P. 2017 · 2017

Cited alongside, same era.

Towards deep learning models resistant to adversarial attacks

Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2017 · 2017

Cited alongside, same era.

Membership inference attacks against machine learning models

Shokri, R.; Stronati, M.; Song, C.; and Shmatikov, V. 2017 · 2017

Cited alongside, same era.

Later among the works it cites.

Adversarially robust generalization requires more data

Schmidt, L.; Santurkar, S.; Tsipras, D.; Talwar, K.; and Madry, A. 2018 · 2018

Later among the works it cites.

Adversarial risk and the dangers of evaluating against weak attacks

Uesato, J.; O’Donoghue, B.; Oord, A. v. d.; and Kohli, P. 2018 · 2018

Later among the works it cites.

Privacy risk in machine learning: Analyzing the connection to overfitting

Yeom, S.; Giacomelli, I.; Fredrikson, M.; and Jha, S. 2018 · 2018

Later among the works it cites.

Rademacher complexity for adversarially robust generalization

Yin, D.; Ramchandran, K.; and Bartlett, P. 2018 · 2018

Later among the works it cites.

Differential privacy has disparate impact on model accuracy

Bagdasaryan, E.; Poursaeed, O.; and Shmatikov, V. 2019 · 2019

Later among the works it cites.

The secret sharer: Evaluating and testing unintended memorization in neural networks

Carlini, N.; Liu, C.; Erlingsson, Ú.; Kos, J.; and Song, D. 2019 · 2019

Later among the works it cites.

Unlabeled data improves adversarial robustness

Carmon, Y.; Raghunathan, A.; Schmidt, L.; Duchi, J. C.; and Liang, P. S. 2019 · 2019

Later among the works it cites.

Robustness to adversarial perturbations in learning from incomplete data

Najafi, A.; Maeda, S.-i.; Koyama, M.; and Miyato, T. 2019 · 2019

Later among the works it cites.

Language Models are Unsupervised Multitask Learners

Radford, A.; Wu, J.; Child, R.; Luan, D.; Amodei, D.; and Sutskever, I. 2019 · 2019

Later among the works it cites.

Privacy risks of securing machine learning models against adversarial examples

Song, L.; Shokri, R.; and Mittal, P. 2019 · 2019

Later among the works it cites.

What neural networks memorize and why: Discovering the long tail via influence estimation

Feldman, V.; and Zhang, C. 2020 · 2020

Closest in time.