Machine learning models are vulnerable to data inference attacks, such as
membership inference and model inversion attacks. In these types of breaches,
an adversary attempts to infer a data record's membership in a dataset or even
reconstruct this data record using a confidence score vector predicted by the
target model. However, most existing defense methods only protect against
membership inference attacks. Methods that can combat both types of attacks
require a new model to be trained, which may not be time-efficient. In this
paper, we propose a differentially private defense method that handles both
types of attacks in a time-efficient manner by tuning only one parameter, the
privacy budget. The central idea is to modify and normalize the confidence
score vectors with a differential privacy mechanism which preserves privacy and
obscures membership and reconstructed data. Moreover, this method can guarantee
the order of scores in the vector to avoid any loss in classification accuracy.
The experimental results show the method to be an effective and timely defense
against both membership inference and model inversion attacks with no reduction
in accuracy.

本文提出了一种采用差分隐私机制的数据推断攻击防御方法，通过调节一个参数，即隐私预算，处理成员推断和模型反演两种类型的攻击。该方法能够保持分类精度，并通过修改和标准化置信度得分矢量来保护成员隐私信息。实验结果表明，该方法对于成员推断和模型反演两种攻击是一种有效且及时的防御方法，不影响模型分类准确度。

一参数防御 —— 利用差分隐私抵御数据推断攻击

One Parameter Defense -- Defending against Data Inference Attacks via Differential Privacy

Neural networks are susceptible to data inference attacks such as the model
inversion attack and the membership inference attack, where the attacker could
infer the reconstruction and the membership of a data sample from the
confidence scores predicted by the target classifier. In this paper, we propose
a unified approach, namely purification framework, to defend data inference
attacks. It purifies the confidence score vectors predicted by the target
classifier by reducing their dispersion. The purifier can be further
specialized in defending a particular attack via adversarial learning. We
evaluate our approach on benchmark datasets and classifiers. We show that when
the purifier is dedicated to one attack, it naturally defends the other one,
which empirically demonstrates the connection between the two attacks. The
purifier can effectively defend both attacks. For example, it can reduce the
membership inference accuracy by up to 15% and increase the model inversion
error by a factor of up to 4. Besides, it incurs less than 0.4% classification
accuracy drop and less than 5.5% distortion to the confidence scores.

本文提出了一种称为净化框架的统一方法来防御神经网络所容易受到的数据推断攻击，并通过敌对学习来专门针对某一攻击方式进行保护。在基准数据集和分类器上进行了评估，结果表明该净化器可以有效防御数据推断攻击，减少成员推断准确性高达 15％，模型反演误差增加 4 倍，并且对置信度分数仅有少量影响。