通过图像变换防御成员推断攻击，保护联邦学习中的隐私数据。
AugMixCloak: A Defense against Membership Inference Attacks via Image Transformation
- 对疑似训练集的图像进行增强与PCA融合处理
- 在五个数据集上有效抵御两类成员推断攻击
- 相比正则化和置信度掩码，防御更强且泛化更好
传统机器学习引发严重隐私担忧，而联邦学习（FL）通过将数据保留在本地设备来缓解数据泄露风险。然而，FL的训练过程仍可能泄露敏感信息，攻击者可借此实施成员推断攻击（MIA），判断特定数据是否属于训练集。本文提出两阶段防御机制AugMixCloak，针对感知哈希（pHash）识别出的与训练集图像相同或高度相似的查询图像，采用数据增强与主成分分析（PCA）信息融合策略。实验表明，该方法在五个数据集及多种去中心化联邦学习（DFL）拓扑下，均能有效防御基于二分类器和基于度量的MIA。相较于基于正则化的防御，AugMixCloak提供更强保护；相比置信度分数掩码，其泛化性能更优。
原文摘要 · Abstract (English)
Traditional machine learning (ML) raises serious privacy concerns, while federated learning (FL) mitigates the risk of data leakage by keeping data on local devices. However, the training process of FL can still leak sensitive information, which adversaries may exploit to infer private data. One of the most prominent threats is the membership inference attack (MIA), where the adversary aims to determine whether a particular data record was part of the training set. This paper addresses this problem through a two-stage defense called AugMixCloak. The core idea is to apply data augmentation and principal component analysis (PCA)-based information fusion to query images, which are detected by perceptual hashing (pHash) as either identical to or highly similar to images in the training set. Experimental results show that AugMixCloak successfully defends against both binary classifier-based MIA and metric-based MIA across five datasets and various decentralized FL (DFL) topologies. Compared with regularization-based defenses, AugMixCloak demonstrates stronger protection. Compared with confidence score masking, AugMixCloak exhibits better generalization.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。