Conflicting Interactions Among Protection Mechanisms for Machine Learning Models

TL;DR

This paper investigates how different security and privacy protection mechanisms for machine learning models can conflict with each other, providing a framework for analysis and exploring ways to mitigate such conflicts.

Contribution

It introduces a framework for analyzing conflicting interactions among ML protection mechanisms and systematically studies pairwise conflicts, proposing potential solutions to avoid them.

Findings

Several pairwise interactions result in conflicts.

Modifying ownership verification can avoid conflicts with differential privacy.

No effective hyperparameter balance exists to mitigate conflicts.

Abstract

Nowadays, systems based on machine learning (ML) are widely used in different domains. Given their popularity, ML models have become targets for various attacks. As a result, research at the intersection of security/privacy and ML has flourished. Typically such work has focused on individual types of security/privacy concerns and mitigations thereof. However, in real-life deployments, an ML model will need to be protected against several concerns simultaneously. A protection mechanism optimal for one security or privacy concern may interact negatively with mechanisms intended to address other concerns. Despite its practical relevance, the potential for such conflicts has not been studied adequately. We first provide a framework for analyzing such "conflicting interactions". We then focus on systematically analyzing pairwise interactions between protection mechanisms for one concern, model and data ownership verification, with two other classes of ML protection mechanisms: differentially private training, and robustness against model evasion. We find that several pairwise interactions result in conflicts. We explore potential approaches for avoiding such conflicts. First, we study the effect of hyperparameter relaxations, finding that there is no sweet spot balancing the performance of both protection mechanisms. Second, we explore if modifying one type of protection mechanism (ownership verification) so as to decouple it from factors that may be impacted by a conflicting mechanism (differentially private training or robustness to model evasion) can avoid conflict. We show that this approach can avoid the conflict between ownership verification mechanisms when combined with differentially private training, but has no effect on robustness to model evasion. Finally, we identify the gaps in the landscape of studying interactions between other types of ML protection mechanisms.