Defending Against Neural Network Model Inversion Attacks via Data Poisoning.

Area of Science:

• Machine Learning Security
• Data Privacy
• Cybersecurity

Background:

• Model inversion attacks threaten machine learning privacy by reconstructing sensitive data.
• Existing defenses often compromise model utility or require impractical retraining.
• A trade-off exists between privacy protection and classifier utility.

Purpose of the Study:

• To develop a novel defense mechanism balancing privacy and utility against model inversion attacks.
• To introduce a retraining-free defense paradigm for large-scale models.
• To counter adversaries using machine learning inversion models.

Main Methods:

• Leveraging data poisoning to contaminate the training data of inversion models.
• Proposing label-preserving poisoning attacks for all output vectors (LPA).
• Introducing label-flipping poisoning for partial output vectors (LFP).

Main Results:

• LPA significantly increases data reconstruction difficulty without compromising classifier utility.
• LFP selectively perturbs output vectors and alters labels.
• LPA demonstrates superior performance compared to state-of-the-art defenses.

Conclusions:

• Data poisoning offers a viable retraining-free defense against model inversion attacks.
• The proposed methods effectively protect privacy while preserving model utility.
• LPA emerges as a highly effective defense strategy.