VPP: Privacy Preserving Machine Learning via Undervolting

Islam, Md Shohidul; Omidi, Behnam; Alouani, Lihsen; Khasawneh, Khaled

Document type :

Communication dans un congrès avec actes

DOI :

10.1109/HOST55118.2023.10133266

Title :

VPP: Privacy Preserving Machine Learning via Undervolting

Author(s) :

Islam, Md Shohidul [Auteur]
George Mason University [Fairfax]
Omidi, Behnam [Auteur]
George Mason University [Fairfax]
Alouani, Lihsen [Auteur]
COMmunications NUMériques - IEMN [COMNUM - IEMN]
Institut d’Électronique, de Microélectronique et de Nanotechnologie - UMR 8520 [IEMN]
Khasawneh, Khaled [Auteur]
George Mason University [Fairfax]

Conference title :

2023 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)

City :

San Jose

Country :

Etats-Unis d'Amérique

Start date of the conference :

2023-05-01

Publisher :

IEEE

HAL domain(s) :

Physique [physics]
Sciences de l'ingénieur [physics]

English abstract : [en]

Machine Learning (ML) systems are susceptible to membership inference attacks (MIAs), which leak private information from the training data. Specifically, MIAs are able to infer whether a target sample has been used in the ...
Show more >Machine Learning (ML) systems are susceptible to membership inference attacks (MIAs), which leak private information from the training data. Specifically, MIAs are able to infer whether a target sample has been used in the training data of a given model. Such privacy breaching concern motivated several defenses against MIAs. However, most of the state-of-theart defenses such as Differential Privacy (DP) come at the cost of lower utility (i.e, classification accuracy). In this work, we propose Privacy Preserving Volt $(V_{PP})$, a new lightweight inference-time approach that leverages undervolting for privacy-preserving ML. Unlike related work, V PP maintains protected models’ utility without requiring re-training. The key insight of our method is to blur the MIA differential analysis outcome by comprehensively garbling the model features using random noise. Unlike DP, which injects noise within the gradient at training time, V PP injects computational randomness in a set of layers’ during inference through carefully designed undervolting Specifically, we propose a bi-objective optimization approach to identify the noise characteristics that yield privacypreserving properties while maintaining the protected model’s utility. Extensive experimental results demonstrate that V PP yields a significantly more interesting utility/privacy tradeoff compared to prior defenses. For example, with comparable privacy protection on CIFAR-10 benchmark, V PP improves the utility by 32.93% over DP-SGD. Besides, while related noisebased defenses are defeated by label-only attacks, V PP shows high resilience to such adaptive MLA. More over, V PP comes with a by-product inference power gain of up to 61%. Finally, for a comprehensive analysis, we propose a new adaptive attacks that operate on the expectation over the stochastic model behavior. We believe that V PP represents a significant step towards practical privacy preserving techniques and considerably improves the state-of-the-art.Show less >

Language :

Anglais

Peer reviewed article :

Oui

Audience :

Internationale

Popular science :

Non

European Project :

Edge AI Technologies for Optimised Performance Embedded Processing

Collections :

Institut d'Électronique, de Microélectronique et de Nanotechnologie (IEMN) - UMR 8520

Source :

Harvested from HAL

Files

VPP_HOST_Camera_Ready.pdf
Open access
Access the document

document
Open access
Access the document

VPP_HOST_Camera_Ready.pdf
Open access
Access the document

VPP: Privacy Preserving Machine Learning ... BibTeX CSV Excel RIS

Files

VPP: Privacy Preserving Machine Learning ...

BibTeX

CSV

Excel

RIS