The membership inference attack (MIA) is a popular paradigm for compromising
the privacy of a machine learning (ML) model. MIA exploits the natural
inclination of ML models to overfit upon the training data. MIAs are trained to
distinguish between training and testing prediction confidence to infer
membership information. Federated Learning (FL) is a privacy-preserving ML
paradigm that enables multiple clients to train a unified model without
disclosing their private data. In this paper, we propose an enhanced Membership
Inference Attack with the Batch-wise generated Attack Dataset (MIA-BAD), a
modification to the MIA approach. We investigate that the MIA is more accurate
when the attack dataset is generated batch-wise. This quantitatively decreases
the attack dataset while qualitatively improving it. We show how training an ML
model through FL, has some distinct advantages and investigate how the threat
introduced with the proposed MIA-BAD approach can be mitigated with FL
approaches. Finally, we demonstrate the qualitative effects of the proposed
MIA-BAD methodology by conducting extensive experiments with various target
datasets, variable numbers of federated clients, and training batch sizes.

本文提出了一种改进的批量生成攻击数据集的增强型会员推断攻击（MIA-BAD）方法，研究了批量生成攻击数据集对 MIA 方法准确性的影响，以及如何通过联邦学习（FL）方法减轻 MIA-BAD 引入的威胁，并通过大量实验展示了 MIA-BAD 方法的定性效果。

MIA-BAD：增强会员推断攻击及其联邦学习的缓解方法

MIA-BAD: An Approach for Enhancing Membership Inference Attack and its  Mitigation with Federated Learning

Privacy-Preserving ML (PPML) based on Homomorphic Encryption (HE) is a
promising foundational privacy technology. Making it more practical requires
lowering its computational cost, especially, in handling modern large deep
neural networks. Model compression via pruning is highly effective in
conventional plaintext ML but cannot be effectively applied to HE-PPML as is.
We propose Artemis, a highly effective DNN pruning technique for HE-based
inference. We judiciously investigate two HE-aware pruning strategies
(positional and diagonal) to reduce the number of Rotation operations, which
dominate compute time in HE convolution. We find that Pareto-optimal solutions
are based fully on diagonal pruning. Artemis' benefits come from coupling DNN
training, driven by a novel group Lasso regularization objective, with pruning
to maximize HE-specific cost reduction (dominated by the Rotation operations).
We show that Artemis improves on prior HE-oriented pruning and can achieve a
1.2-6x improvement when targeting modern convolutional models (ResNet18 and
ResNet18) across three datasets.

通过使用一种新颖的组 Lasso 正则化目标和修剪技术，我们提出了一种在基于同态加密的推断中非常有效的神经网络修剪技术 Artemis，并证明当应用于现代卷积模型（ResNet18 和 ResNet18）时，可以在三个数据集上实现 1.2-6 倍的性能提升。