Data-Centric Defense: Shaping Loss Landscape with Augmentations to Counter Model Inversion

Si Chen, Nikhil Abhyankar, Feiyang Kang, Ming Jin, Ruoxi Jia

Keywords: model inversion attacks; data-centric defenses

Abstract:

Machine learning (ML) models are widely used but vulnerable to privacy attacks, such as model inversion. Current defense techniques are mostly model-centric, involving modifying the model training or inference process. However, these approaches require model trainers' cooperation, are computationally expensive, and often result in a significant privacy-utility tradeoff.
To address these limitations, this paper proposes a novel data-centric approach to mitigate model inversion attacks. Compared to traditional model-centric techniques, our approach offers the unique advantage of decentralization, enabling individual users to control their data's privacy risk. Specifically, we introduce several privacy-focused data augmentations that modify the private data uploaded to the model trainer. These augmentations will shape the resulting model's loss landscape, making it challenging for attackers to generate private target samples. Additionally, we provide theoretical analysis to support our approach and explain how data augmentation can reduce the risk of model inversion. We evaluate our approach against state-of-the-art model inversion attacks and demonstrate its effectiveness and robustness across various model architectures and datasets. Specifically, in standard face recognition benchmarks, we reduce face reconstruction success rates to less or equal to 5%, while maintaining high utility with only a 2% classification accuracy drop, surpassing state-of-the-art model-centric defenses by 90%. This is the first study to propose a data-centric approach for mitigating model inversion attacks, showing potential for decentralized privacy protection.

Primary Area: societal considerations including fairness, safety, privacy

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.

Submission Guidelines: I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2024/AuthorGuide.

Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors' identity.

No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.

Submission Number: 3895