提出DeMem方法，在保护隐私的同时保持模型对对抗样本的鲁棒性。
DeMem: Privacy-Enhanced Robust Adversarial Learning via De-Memorization
- 针对高风险样本实施去记忆化，精准保护隐私
- 在多个数据集上隐私泄露降低，自然与对抗样本鲁棒性均保持
- 可无缝集成到多种对抗训练中，适用性强
对抗鲁棒性是确保机器学习模型在现实应用中可信的关键。然而，以往研究表明，通过对抗训练提升鲁棒性会增加模型面临隐私攻击的风险。虽然差分隐私可缓解此类攻击，但常以牺牲对自然样本和对抗样本的鲁棒性为代价。我们的分析发现，差分隐私对低风险样本影响更大，导致性能意外下降。为此，我们提出DeMem，仅对高风险样本进行去记忆化处理，实现隐私保护与模型鲁棒性的更好平衡。DeMem具有通用性，可无缝融入多种对抗训练方法。在多个训练策略和数据集上的广泛评估表明，DeMem显著降低了隐私泄露，同时维持了对自然样本和对抗样本的鲁棒性。结果验证了其有效性与广泛适用性。
原文摘要 · Abstract (English)
Adversarial robustness, the ability of a model to withstand manipulated inputs that cause errors, is essential for ensuring the trustworthiness of machine learning models in real-world applications. However, previous studies have shown that enhancing adversarial robustness through adversarial training increases vulnerability to privacy attacks. While differential privacy can mitigate these attacks, it often compromises robustness against both natural and adversarial samples. Our analysis reveals that differential privacy disproportionately impacts low-risk samples, causing an unintended performance drop. To address this, we propose DeMem, which selectively targets high-risk samples, achieving a better balance between privacy protection and model robustness. DeMem is versatile and can be seamlessly integrated into various adversarial training techniques. Extensive evaluations across multiple training methods and datasets demonstrate that DeMem significantly reduces privacy leakage while maintaining robustness against both natural and adversarial samples. These results confirm DeMem's effectiveness and broad applicability in enhancing privacy without compromising robustness.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。