The original paper is in English. Non-English content has been machine-translated and may contain typographical errors or mistranslations. ex. Some numerals are expressed as "XNUMX".
Copyrights notice
The original paper is in English. Non-English content has been machine-translated and may contain typographical errors or mistranslations. Copyrights notice
Le nombre de services informatiques qui utilisent des algorithmes d’apprentissage automatique (ML) augmente continuellement et rapidement, tandis que nombre d’entre eux sont utilisés en pratique pour effectuer certains types de prédictions à partir de données personnelles. Il n’est pas surprenant qu’en raison de cet essor soudain du ML, la manière dont les données personnelles sont traitées dans les systèmes de ML commence à soulever de graves problèmes de confidentialité qui n’étaient pas pris en compte auparavant. Récemment, Fredrikson et al. [USENIX 2014] [CCS 2015] a proposé une nouvelle attaque contre les systèmes ML appelée attaque par inversion de modèle qui vise à déduire sensible valeurs d'attribut d'un utilisateur cible. Dans leur travail, pour que l'attaque par inversion de modèle réussisse, l'adversaire doit obtenir deux types d'informations concernant l'utilisateur cible avant l'attaque : la valeur de sortie (c'est-à-dire la prédiction) du système ML et l'ensemble des non sensible valeurs utilisées pour apprendre la sortie. Par conséquent, bien que l’attaque soulève de nouvelles préoccupations en matière de confidentialité, puisque l’adversaire est tenu de connaître à l’avance toutes les valeurs non sensibles, le niveau de risque encouru par l’attaque n’est pas tout à fait clair. En particulier, même si les utilisateurs peuvent considérer ces valeurs comme non sensibles, il peut être difficile pour l'adversaire d'obtenir toutes les valeurs d'attribut non sensibles avant l'attaque, rendant ainsi l'attaque invalide. L'objectif de cet article est de quantifier le risque d'attaques par inversion de modèle dans le cas où les attributs non sensibles d'un utilisateur cible ne sont pas disponibles pour l'adversaire. À cette fin, nous proposons d’abord un cadre d’inversion de modèle général (GMI), qui modélise la quantité d’informations auxiliaires disponibles pour l’adversaire. Notre cadre capture l'attaque d'inversion de modèle de Fredrikson et al. comme cas particulier, tout en capturant également les attaques d'inversion de modèle qui déduisent des attributs sensibles sans connaître les attributs non sensibles. Pour cette dernière attaque, nous fournissons une méthodologie générale sur la façon dont nous pouvons déduire les attributs sensibles d'un utilisateur cible sans connaître les attributs non sensibles. À un niveau élevé, nous utilisons le paradigme d'empoisonnement des données d'une manière conceptuellement nouvelle et injectons des données malveillantes dans le système ML afin de modifier le modèle ML interne utilisé dans un système de ML. l'objectif Modèle ML ; un type spécial de modèle ML qui permet d'effectuer des attaques d'inversion de modèle sans la connaissance des attributs non sensibles. Enfin, suivant notre méthodologie générale, nous introduisons des systèmes ML qui utilisent en interne des modèles de régression linéaire dans notre cadre GMI et proposons un algorithme concret pour les attaques par inversion de modèle qui ne nécessite pas de connaissance des attributs non sensibles. Nous montrons l'efficacité de notre attaque d'inversion de modèle grâce à une évaluation expérimentale utilisant deux ensembles de données réels.
Seira HIDANO
KDDI Research, Inc.
Takao MURAKAMI
National Institute of Advanced Industrial Science and Technology (AIST)
Shuichi KATSUMATA
National Institute of Advanced Industrial Science and Technology (AIST),University of Tokyo
Shinsaku KIYOMOTO
KDDI Research, Inc.
Goichiro HANAOKA
National Institute of Advanced Industrial Science and Technology (AIST)
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Copier
Seira HIDANO, Takao MURAKAMI, Shuichi KATSUMATA, Shinsaku KIYOMOTO, Goichiro HANAOKA, "Model Inversion Attacks for Online Prediction Systems: Without Knowledge of Non-Sensitive Attributes" in IEICE TRANSACTIONS on Information,
vol. E101-D, no. 11, pp. 2665-2676, November 2018, doi: 10.1587/transinf.2017ICP0013.
Abstract: The number of IT services that use machine learning (ML) algorithms are continuously and rapidly growing, while many of them are used in practice to make some type of predictions from personal data. Not surprisingly, due to this sudden boom in ML, the way personal data are handled in ML systems are starting to raise serious privacy concerns that were previously unconsidered. Recently, Fredrikson et al. [USENIX 2014] [CCS 2015] proposed a novel attack against ML systems called the model inversion attack that aims to infer sensitive attribute values of a target user. In their work, for the model inversion attack to be successful, the adversary is required to obtain two types of information concerning the target user prior to the attack: the output value (i.e., prediction) of the ML system and all of the non-sensitive values used to learn the output. Therefore, although the attack does raise new privacy concerns, since the adversary is required to know all of the non-sensitive values in advance, it is not completely clear how much risk is incurred by the attack. In particular, even though the users may regard these values as non-sensitive, it may be difficult for the adversary to obtain all of the non-sensitive attribute values prior to the attack, hence making the attack invalid. The goal of this paper is to quantify the risk of model inversion attacks in the case when non-sensitive attributes of a target user are not available to the adversary. To this end, we first propose a general model inversion (GMI) framework, which models the amount of auxiliary information available to the adversary. Our framework captures the model inversion attack of Fredrikson et al. as a special case, while also capturing model inversion attacks that infer sensitive attributes without the knowledge of non-sensitive attributes. For the latter attack, we provide a general methodology on how we can infer sensitive attributes of a target user without knowledge of non-sensitive attributes. At a high level, we use the data poisoning paradigm in a conceptually novel way and inject malicious data into the ML system in order to modify the internal ML model being used into a target ML model; a special type of ML model which allows one to perform model inversion attacks without the knowledge of non-sensitive attributes. Finally, following our general methodology, we cast ML systems that internally use linear regression models into our GMI framework and propose a concrete algorithm for model inversion attacks that does not require knowledge of the non-sensitive attributes. We show the effectiveness of our model inversion attack through experimental evaluation using two real data sets.
URL: https://global.ieice.org/en_transactions/information/10.1587/transinf.2017ICP0013/_p
Copier
@ARTICLE{e101-d_11_2665,
author={Seira HIDANO, Takao MURAKAMI, Shuichi KATSUMATA, Shinsaku KIYOMOTO, Goichiro HANAOKA, },
journal={IEICE TRANSACTIONS on Information},
title={Model Inversion Attacks for Online Prediction Systems: Without Knowledge of Non-Sensitive Attributes},
year={2018},
volume={E101-D},
number={11},
pages={2665-2676},
abstract={The number of IT services that use machine learning (ML) algorithms are continuously and rapidly growing, while many of them are used in practice to make some type of predictions from personal data. Not surprisingly, due to this sudden boom in ML, the way personal data are handled in ML systems are starting to raise serious privacy concerns that were previously unconsidered. Recently, Fredrikson et al. [USENIX 2014] [CCS 2015] proposed a novel attack against ML systems called the model inversion attack that aims to infer sensitive attribute values of a target user. In their work, for the model inversion attack to be successful, the adversary is required to obtain two types of information concerning the target user prior to the attack: the output value (i.e., prediction) of the ML system and all of the non-sensitive values used to learn the output. Therefore, although the attack does raise new privacy concerns, since the adversary is required to know all of the non-sensitive values in advance, it is not completely clear how much risk is incurred by the attack. In particular, even though the users may regard these values as non-sensitive, it may be difficult for the adversary to obtain all of the non-sensitive attribute values prior to the attack, hence making the attack invalid. The goal of this paper is to quantify the risk of model inversion attacks in the case when non-sensitive attributes of a target user are not available to the adversary. To this end, we first propose a general model inversion (GMI) framework, which models the amount of auxiliary information available to the adversary. Our framework captures the model inversion attack of Fredrikson et al. as a special case, while also capturing model inversion attacks that infer sensitive attributes without the knowledge of non-sensitive attributes. For the latter attack, we provide a general methodology on how we can infer sensitive attributes of a target user without knowledge of non-sensitive attributes. At a high level, we use the data poisoning paradigm in a conceptually novel way and inject malicious data into the ML system in order to modify the internal ML model being used into a target ML model; a special type of ML model which allows one to perform model inversion attacks without the knowledge of non-sensitive attributes. Finally, following our general methodology, we cast ML systems that internally use linear regression models into our GMI framework and propose a concrete algorithm for model inversion attacks that does not require knowledge of the non-sensitive attributes. We show the effectiveness of our model inversion attack through experimental evaluation using two real data sets.},
keywords={},
doi={10.1587/transinf.2017ICP0013},
ISSN={1745-1361},
month={November},}
Copier
TY - JOUR
TI - Model Inversion Attacks for Online Prediction Systems: Without Knowledge of Non-Sensitive Attributes
T2 - IEICE TRANSACTIONS on Information
SP - 2665
EP - 2676
AU - Seira HIDANO
AU - Takao MURAKAMI
AU - Shuichi KATSUMATA
AU - Shinsaku KIYOMOTO
AU - Goichiro HANAOKA
PY - 2018
DO - 10.1587/transinf.2017ICP0013
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E101-D
IS - 11
JA - IEICE TRANSACTIONS on Information
Y1 - November 2018
AB - The number of IT services that use machine learning (ML) algorithms are continuously and rapidly growing, while many of them are used in practice to make some type of predictions from personal data. Not surprisingly, due to this sudden boom in ML, the way personal data are handled in ML systems are starting to raise serious privacy concerns that were previously unconsidered. Recently, Fredrikson et al. [USENIX 2014] [CCS 2015] proposed a novel attack against ML systems called the model inversion attack that aims to infer sensitive attribute values of a target user. In their work, for the model inversion attack to be successful, the adversary is required to obtain two types of information concerning the target user prior to the attack: the output value (i.e., prediction) of the ML system and all of the non-sensitive values used to learn the output. Therefore, although the attack does raise new privacy concerns, since the adversary is required to know all of the non-sensitive values in advance, it is not completely clear how much risk is incurred by the attack. In particular, even though the users may regard these values as non-sensitive, it may be difficult for the adversary to obtain all of the non-sensitive attribute values prior to the attack, hence making the attack invalid. The goal of this paper is to quantify the risk of model inversion attacks in the case when non-sensitive attributes of a target user are not available to the adversary. To this end, we first propose a general model inversion (GMI) framework, which models the amount of auxiliary information available to the adversary. Our framework captures the model inversion attack of Fredrikson et al. as a special case, while also capturing model inversion attacks that infer sensitive attributes without the knowledge of non-sensitive attributes. For the latter attack, we provide a general methodology on how we can infer sensitive attributes of a target user without knowledge of non-sensitive attributes. At a high level, we use the data poisoning paradigm in a conceptually novel way and inject malicious data into the ML system in order to modify the internal ML model being used into a target ML model; a special type of ML model which allows one to perform model inversion attacks without the knowledge of non-sensitive attributes. Finally, following our general methodology, we cast ML systems that internally use linear regression models into our GMI framework and propose a concrete algorithm for model inversion attacks that does not require knowledge of the non-sensitive attributes. We show the effectiveness of our model inversion attack through experimental evaluation using two real data sets.
ER -