{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/machine-learning-with-membership-privacy","title":"Machine Learning with Membership Privacy using Adversarial Regularization","arxiv_id":"1807.05852","date":"2018-07-16","proceeding":null,"authors":["Milad Nasr","Reza Shokri","Amir Houmansadr"],"abstract":"Machine learning models leak information about the datasets on which they are\ntrained. An adversary can build an algorithm to trace the individual members of\na model's training dataset. As a fundamental inference attack, he aims to\ndistinguish between data points that were part of the model's training set and\nany other data points from the same distribution. This is known as the tracing\n(and also membership inference) attack. In this paper, we focus on such attacks\nagainst black-box models, where the adversary can only observe the output of\nthe model, but not its parameters. This is the current setting of machine\nlearning as a service in the Internet.\n  We introduce a privacy mechanism to train machine learning models that\nprovably achieve membership privacy: the model's predictions on its training\ndata are indistinguishable from its predictions on other data points from the\nsame distribution. We design a strategic mechanism where the privacy mechanism\nanticipates the membership inference attacks. The objective is to train a model\nsuch that not only does it have the minimum prediction error (high utility),\nbut also it is the most robust model against its corresponding strongest\ninference attack (high privacy). We formalize this as a min-max game\noptimization problem, and design an adversarial training algorithm that\nminimizes the classification loss of the model as well as the maximum gain of\nthe membership inference attack against it. This strategy, which guarantees\nmembership privacy (as prediction indistinguishability), acts also as a strong\nregularizer and significantly generalizes the model.\n  We evaluate our privacy mechanism on deep neural networks using different\nbenchmark datasets. We show that our min-max strategy can mitigate the risk of\nmembership inference attacks (close to the random guess) with a negligible cost\nin terms of the classification error.","url_abs":"http://arxiv.org/abs/1807.05852v1","url_pdf":"http://arxiv.org/pdf/1807.05852v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"machine-learning-with-membership-privacy","repo_url":"https://github.com/hyhmia/BlindMI","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}}],"tasks":[{"task_slug":"machine-learning","task_name":"BIG-bench Machine Learning"},{"task_slug":"classification","task_name":"General Classification"},{"task_slug":"inference-attack","task_name":"Inference Attack"},{"task_slug":"membership-inference-attack","task_name":"Membership Inference Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1807.05852","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}