Please use this identifier to cite or link to this item:
http://hdl.handle.net/10397/95544
Title: | Protecting decision boundary of machine learning model with differentially private perturbation | Authors: | Zheng, H Ye, Q Hu, H Fang, C Shi, J |
Issue Date: | May-2022 | Source: | IEEE transactions on dependable and secure computing, May-June 2022, v. 19, no. 3, p. 2007-2022 | Abstract: | Machine learning service API allows model owners to monetize proprietary models by offering prediction services to third-party users. However, existing literature shows that model parameters are vulnerable to extraction attacks which accumulate prediction queries and their responses to train a replica model. As countermeasures, researchers have proposed to reduce the rich API output, such as hiding the precise confidence. Nonetheless, even with response being only one bit, an adversary can still exploit fine-tuned queries with differential property to infer the decision boundary of the underlying model. In this paper, we propose boundary differential privacy (BDP) against such attacks by obfuscating the prediction responses with noises. BDP guarantees an adversary cannot learn the decision boundary of any two classes by a predefined precision no matter how many queries are issued to the prediction API. We first design a perturbation algorithm called boundary randomized response for a binary model. Then we prove it satisfies ε-BDP, followed by a generalization of this algorithm to a multiclass model. Finally, we generalize a hard boundary to soft boundary and design an adaptive perturbation algorithm that can still work in the latter case. The effectiveness and high utility of our solution are verified by extensive experiments on both linear and non-linear models. | Keywords: | Adversarial machine learning Boundary differential privacy Model defense Model extraction |
Publisher: | Institute of Electrical and Electronics Engineers | Journal: | IEEE transactions on dependable and secure computing | ISSN: | 1545-5971 | EISSN: | 1941-0018 | DOI: | 10.1109/TDSC.2020.3043382 | Rights: | This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0 The following publication H. Zheng, Q. Ye, H. Hu, C. Fang and J. Shi, "Protecting Decision Boundary of Machine Learning Model With Differentially Private Perturbation," in IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 3, pp. 2007-2022, 1 May-June 2022 is available at https://doi.org/10.1109/TDSC.2020.3043382 |
Appears in Collections: | Journal/Magazine Article |
Files in This Item:
File | Description | Size | Format | |
---|---|---|---|---|
Zheng_Protecting_Decision_Boundary.pdf | 3.78 MB | Adobe PDF | View/Open |
Page views
71
Last Week
1
1
Last month
Citations as of Oct 13, 2024
Downloads
89
Citations as of Oct 13, 2024
SCOPUSTM
Citations
17
Citations as of Oct 17, 2024
WEB OF SCIENCETM
Citations
15
Citations as of Oct 17, 2024
Google ScholarTM
Check
Altmetric
Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.