Matryoshka: Exploiting the Over-Parametrization of Deep Learning Models for Covert Data Transmission

Area of Science:

• Machine Learning Security
• Data Privacy
• Cybersecurity

Background:

• High-quality private machine learning (ML) data is crucial for AI competitiveness.
• Protecting sensitive ML data in local data centers is a significant challenge.

Purpose of the Study:

• To introduce a novel insider attack, Matryoshka, that breaches ML data privacy.
• To demonstrate the possibility of extracting private ML data even without an exposed interface.

Main Methods:

• Employing a scheduled-to-publish deep neural network (DNN) as a carrier model for covert data transmission.
• Utilizing a novel parameter sharing approach to exploit the carrier model's learning capacity for information hiding.

Main Results:

• Matryoshka achieves high data transmission capacity with minimal carrier model utility loss.
• The attack allows efficient decoding of hidden models and effective recovery of ML models or raw training data.
• The method demonstrates robustness against post-processing and covertness, making it difficult to detect.

Conclusions:

• Matryoshka presents a significant threat to the privacy of ML data stored in local data centers.
• The attack highlights vulnerabilities in current ML data security practices, even without external interfaces.