Data Exfiltration by Compression Attack: Definition and Evaluation on Medical Image Data

TL;DR

This paper introduces a novel compression-based data exfiltration attack on medical imaging models, demonstrating its effectiveness and exploring privacy-preserving countermeasures.

Contribution

It presents a new attack method exploiting image compression for data theft from medical models, and evaluates countermeasures like differential privacy and model fine-tuning.

Findings

The attack successfully reconstructs high-fidelity medical images.

Differential privacy reduces attack effectiveness but also decreases data leakage.

Model fine-tuning can prevent the attack without significant performance loss.

Abstract

With the rapid expansion of data lakes storing health data and hosting AI algorithms, a prominent concern arises: how safe is it to export machine learning models from these data lakes? In particular, deep network models, widely used for health data processing, encode information from their training dataset, potentially leading to the leakage of sensitive information upon its export. This paper thoroughly examines this issue in the context of medical imaging data and introduces a novel data exfiltration attack based on image compression techniques. This attack, termed Data Exfiltration by Compression, requires only access to a data lake and is based on lossless or lossy image compression methods. Unlike previous data exfiltration attacks, it is compatible with any image processing task and depends solely on an exported network model without requiring any additional information to be collected during the training process. We explore various scenarios, and techniques to limit the size of the exported model and conceal the compression codes within the network. Using two public datasets of CT and MR images, we demonstrate that this attack can effectively steal medical images and reconstruct them outside the data lake with high fidelity, achieving an optimal balance between compression and reconstruction quality. Additionally, we investigate the impact of basic differential privacy measures, such as adding Gaussian noise to the model parameters, to prevent the Data Exfiltration by Compression Attack. We also show how the attacker can make their attack resilient to differential privacy at the expense of decreasing the number of stolen images. Lastly, we propose an alternative prevention strategy by fine-tuning the model to be exported.