Unknown-Aware Bilateral Dependency Optimization for Defending Against Model Inversion Attacks.

Area of Science:

• Artificial Intelligence
• Machine Learning Security
• Data Privacy

Background:

• Model inversion (MI) attacks threaten data privacy by recovering training data from classifiers.
• Unilateral dependency optimization mitigates MI but compromises classification performance.
• This creates a trade-off between privacy and model utility.

Purpose of the Study:

• To develop a novel strategy, Bilateral Dependency Optimization (BiDO), to enhance privacy against MI attacks without sacrificing classification performance.
• To address the diminished out-of-distribution (OOD) detection capabilities of BiDO models.
• To propose an upgraded framework, BiDO+, integrating OOD detection for comprehensive privacy and security.

Main Methods:

• Proposed Bilateral Dependency Optimization (BiDO) to minimize feature-latent dependency while maximizing latent-label dependency.
• Identified reduced OOD detection in BiDO models.
• Integrated auxiliary OOD data into BiDO to create BiDO+ for improved OOD detection.

Main Results:

• BiDO effectively enhances privacy against MI attacks.
• BiDO models showed reduced OOD detection performance.
• The BiDO+ framework significantly improved OOD detection, reducing FPR95 by 55.02% and enhancing AUCROC by 9.52% compared to BiDO-HSIC, with comparable utility.

Conclusions:

• BiDO offers a dual-objective approach to balance privacy and classification performance.
• BiDO+ successfully addresses the security risks associated with OOD detection limitations.
• The proposed framework provides a robust solution for both privacy and security in deep learning systems.