用近邻方法量化数据贡献与隐私风险,兼顾效率与鲁棒性。
WaKA: Data Attribution using K-Nearest Neighbors and Membership Privacy Principles
- 基于Wasserstein距离和k近邻,无需采样即可分析数据贡献。
- 自引用值比泛化贡献更能预测成员推理攻击成功率。
- 适用于隐私评估与数据价值衡量,尤其在不平衡数据上更稳健。
本文提出WaKA(Wasserstein K-近邻归因),一种新颖的归因方法,结合LiRA(似然比攻击)框架与k近邻分类器(k-NN)。WaKA高效衡量单个数据点对模型损失分布的贡献,无需采样训练集子集即可分析所有可能的k-NN结构。该方法灵活,可后验用于成员推理攻击(MIA)评估隐私风险,或先验用于隐私影响测量与数据估值。因此,WaKA统一了数据归因与成员推理攻击,实现了数据价值与隐私风险的区分。例如,我们发现自归因值与攻击成功率的相关性高于数据对模型泛化的贡献。在多个真实数据集上的实验表明,作为k-NN分类器的MIA时,WaKA性能接近LiRA,但计算效率更高;在不平衡数据集上的数据最小化任务中,其对数据删减/增加的鲁棒性优于Shapley Values。
原文摘要 · Abstract (English)
In this paper, we introduce WaKA (Wasserstein K-nearest-neighbors Attribution), a novel attribution method that leverages principles from the LiRA (Likelihood Ratio Attack) framework and k-nearest neighbors classifiers (k-NN). WaKA efficiently measures the contribution of individual data points to the model's loss distribution, analyzing every possible k-NN that can be constructed using the training set, without requiring to sample subsets of the training set. WaKA is versatile and can be used a posteriori as a membership inference attack (MIA) to assess privacy risks or a priori for privacy influence measurement and data valuation. Thus, WaKA can be seen as bridging the gap between data attribution and membership inference attack (MIA) by providing a unified framework to distinguish between a data point's value and its privacy risk. For instance, we have shown that self-attribution values are more strongly correlated with the attack success rate than the contribution of a point to the model generalization. WaKA's different usage were also evaluated across diverse real-world datasets, demonstrating performance very close to LiRA when used as an MIA on k-NN classifiers, but with greater computational efficiency. Additionally, WaKA shows greater robustness than Shapley Values for data minimization tasks (removal or addition) on imbalanced datasets.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。