差分隐私保护的随机森林仍可被重构训练数据，揭示其隐私漏洞。
Training Set Reconstruction from Differentially Private Forests: How Effective is DP?
- 利用约束规划建模，结合树结构与差分隐私机制，逆推训练数据
- 在合理隐私预算下，攻击可重构部分训练数据，模型性能仍有效
- 提出更抗重构的构建建议，兼顾实用性能与隐私安全
近期研究显示，树集成等结构化机器学习模型易受针对训练数据的隐私攻击。为缓解风险，差分隐私（DP）已成为广泛采用的防护手段。本文针对最先进的ε-差分隐私随机森林，提出一种重构攻击方法。通过结合森林结构与差分隐私机制特征的约束规划模型，该方法可形式化重建最可能生成给定森林的数据集。大量计算实验揭示了模型效用、隐私保障与重构准确率之间的权衡关系。结果表明，即使在有意义的差分隐私保障下，随机森林仍可能泄露部分训练数据。具体而言，尽管DP降低了重构成功率，但仅有预测性能接近常数分类器的森林才对本攻击完全鲁棒。基于这些发现，本文进一步给出构建更具抗重构能力且保持非平凡预测性能的DP随机森林的实用建议。
原文摘要 · Abstract (English)
Recent research has shown that structured machine learning models such as tree ensembles are vulnerable to privacy attacks targeting their training data. To mitigate these risks, differential privacy (DP) has become a widely adopted countermeasure, as it offers rigorous privacy protection. In this paper, we introduce a reconstruction attack targeting state-of-the-art $ε$-DP random forests. By leveraging a constraint programming model that incorporates knowledge of the forest's structure and DP mechanism characteristics, our approach formally reconstructs the most likely dataset that could have produced a given forest. Through extensive computational experiments, we examine the interplay between model utility, privacy guarantees and reconstruction accuracy across various configurations. Our results reveal that random forests trained with meaningful DP guarantees can still leak portions of their training data. Specifically, while DP reduces the success of reconstruction attacks, the only forests fully robust to our attack exhibit predictive performance no better than a constant classifier. Building on these insights, we also provide practical recommendations for the construction of DP random forests that are more resilient to reconstruction attacks while maintaining a non-trivial predictive performance.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。