VPP: Privacy Preserving Machine Learning via Undervolting

Islam, Md Shohidul; Omidi, Behnam; Alouani, Lihsen; Khasawneh, Khaled

Type de document :

Communication dans un congrès avec actes

DOI :

10.1109/HOST55118.2023.10133266

Titre :

VPP: Privacy Preserving Machine Learning via Undervolting

Auteur(s) :

Islam, Md Shohidul [Auteur]
George Mason University [Fairfax]
Omidi, Behnam [Auteur]
George Mason University [Fairfax]
Alouani, Lihsen [Auteur]
COMmunications NUMériques - IEMN [COMNUM - IEMN]
Institut d’Électronique, de Microélectronique et de Nanotechnologie - UMR 8520 [IEMN]
Khasawneh, Khaled [Auteur]
George Mason University [Fairfax]

Titre de la manifestation scientifique :

2023 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)

Ville :

San Jose

Pays :

Etats-Unis d'Amérique

Date de début de la manifestation scientifique :

2023-05-01

Éditeur :

IEEE

Discipline(s) HAL :

Physique [physics]
Sciences de l'ingénieur [physics]

Résumé en anglais : [en]

Machine Learning (ML) systems are susceptible to membership inference attacks (MIAs), which leak private information from the training data. Specifically, MIAs are able to infer whether a target sample has been used in the ...
Lire la suite >Machine Learning (ML) systems are susceptible to membership inference attacks (MIAs), which leak private information from the training data. Specifically, MIAs are able to infer whether a target sample has been used in the training data of a given model. Such privacy breaching concern motivated several defenses against MIAs. However, most of the state-of-theart defenses such as Differential Privacy (DP) come at the cost of lower utility (i.e, classification accuracy). In this work, we propose Privacy Preserving Volt $(V_{PP})$, a new lightweight inference-time approach that leverages undervolting for privacy-preserving ML. Unlike related work, V PP maintains protected models’ utility without requiring re-training. The key insight of our method is to blur the MIA differential analysis outcome by comprehensively garbling the model features using random noise. Unlike DP, which injects noise within the gradient at training time, V PP injects computational randomness in a set of layers’ during inference through carefully designed undervolting Specifically, we propose a bi-objective optimization approach to identify the noise characteristics that yield privacypreserving properties while maintaining the protected model’s utility. Extensive experimental results demonstrate that V PP yields a significantly more interesting utility/privacy tradeoff compared to prior defenses. For example, with comparable privacy protection on CIFAR-10 benchmark, V PP improves the utility by 32.93% over DP-SGD. Besides, while related noisebased defenses are defeated by label-only attacks, V PP shows high resilience to such adaptive MLA. More over, V PP comes with a by-product inference power gain of up to 61%. Finally, for a comprehensive analysis, we propose a new adaptive attacks that operate on the expectation over the stochastic model behavior. We believe that V PP represents a significant step towards practical privacy preserving techniques and considerably improves the state-of-the-art.Lire moins >

Langue :

Anglais

Comité de lecture :

Oui

Audience :

Internationale

Vulgarisation :

Non

Projet Européen :

Edge AI Technologies for Optimised Performance Embedded Processing

Collections :

Institut d'Électronique, de Microélectronique et de Nanotechnologie (IEMN) - UMR 8520

Source :

Harvested from HAL

Fichiers

VPP_HOST_Camera_Ready.pdf
Accès libre
Accéder au document

document
Accès libre
Accéder au document

VPP_HOST_Camera_Ready.pdf
Accès libre
Accéder au document

VPP: Privacy Preserving Machine Learning ... BibTeX CSV Excel RIS

Fichiers

VPP: Privacy Preserving Machine Learning ...

BibTeX

CSV

Excel

RIS