Guarding the Privacy of Label-Only Access to Neural Network Classifiers via Formal(…)
summary
Claims a practical verifier, LUCID, that computes an iDP-DB overapproximation so noise is added only to inputs that actually risk leaking labels; it encodes networks as a mixed-integer linear program, builds an interval hyper-network and shrinks overapproximation via a novel branch-and-bound that splits intervals and uses linear relaxations. Evaluation shows LUCID attains perfect 0-iDP with 1.4% accuracy loss (1.2% for relaxed ε-iDP) versus ~12.7% loss from DP training, requires ~4.8 hours offline but gives huge inference speedups (reported 156K× vs brute force).
AI-written summary · about
chapters (11)
- 0:00Privacy leakage in neural networks
- 1:25Differential privacy limitations
- 2:47Individual privacy in classifiers
- 4:51Privacy leaks in inferences
- 6:37Bounds using classification confidence
- 8:01Formal verification challenges
- 9:26Hybrid networks solution
- 11:11Lucid inference process
- 12:15Evaluation results
- 13:00Summary of approach
- 13:21Q&A
related talks
24mVerification of Neural Networks’ Local Differential Classification Privacy
42mTowards Verification of General Neural Networks: A Dual Approach
33mPrivacy of Decentralized Machine Learning
33mHeterogeneity and Privacy in Modern Learning
31mScaling privacy embedded distributed ML systems
31mIs your model private?
53mPrivate Learning with Auxiliary Public Data
26mAaron Roth, Associate Professor, University of Pennsylvania, NYC 2017