Rethinking Privacy Preserving Deep Learning: How to Evaluate and Thwart Privacy Attacks

TL;DR

This paper evaluates privacy-preserving deep learning methods, introduces a new attack formulation, and proposes a novel network to enhance privacy protection while maintaining model accuracy.

Contribution

It presents a quantitative framework for privacy-accuracy trade-offs, formulates reconstruction attacks as solving noisy linear systems, and introduces the Secret Polarization Network to thwart privacy attacks.

Findings

Model accuracy improved by 5-20% over baselines.

Reconstruction attacks can be defeated if certain conditions are unmet.

Theoretical analysis supports the effectiveness of the proposed SPN.

Abstract

This paper investigates capabilities of Privacy-Preserving Deep Learning (PPDL) mechanisms against various forms of privacy attacks. First, we propose to quantitatively measure the trade-off between model accuracy and privacy losses incurred by reconstruction, tracing and membership attacks. Second, we formulate reconstruction attacks as solving a noisy system of linear equations, and prove that attacks are guaranteed to be defeated if condition (2) is unfulfilled. Third, based on theoretical analysis, a novel Secret Polarization Network (SPN) is proposed to thwart privacy attacks, which pose serious challenges to existing PPDL methods. Extensive experiments showed that model accuracies are improved on average by 5-20% compared with baseline mechanisms, in regimes where data privacy are satisfactorily protected.