论文标题
真实精华素：中毒机器学习模型以揭示其秘密
Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets
论文作者
论文摘要
我们引入了对机器学习模型的新攻击。我们表明，一个可以毒害培训数据集的对手会导致在该数据集上训练的模型，以泄露属于其他当事方的培训点的重要私人细节。我们的主动推理攻击连接了针对机器学习培训数据的完整性和隐私的两种独立的工作线。 我们的攻击在会员推理，属性推断和数据提取之间有效。例如，我们的目标攻击可以毒化<0.1％的训练数据集，以提高推理攻击的性能1至2个数量级。此外，控制大部分培训数据（例如50％）的对手可以发射不固定的攻击，从而使所有其他用户的原本私人数据点更精确地推断8倍的攻击。 如果当事方可以任意选择其培训数据的份额，我们的结果对密码隐私的相关性表示怀疑。
We introduce a new class of attacks on machine learning models. We show that an adversary who can poison a training dataset can cause models trained on this dataset to leak significant private details of training points belonging to other parties. Our active inference attacks connect two independent lines of work targeting the integrity and privacy of machine learning training data. Our attacks are effective across membership inference, attribute inference, and data extraction. For example, our targeted attacks can poison <0.1% of the training dataset to boost the performance of inference attacks by 1 to 2 orders of magnitude. Further, an adversary who controls a significant fraction of the training data (e.g., 50%) can launch untargeted attacks that enable 8x more precise inference on all other users' otherwise-private data points. Our results cast doubts on the relevance of cryptographic privacy guarantees in multiparty computation protocols for machine learning, if parties can arbitrarily select their share of training data.
