用分位数回归提升单次运行下隐私审计的精度
Enhancing One-run Privacy Auditing with Quantile Regression-Based Membership Inference
- 用分位数回归增强成员推断攻击，改进黑盒场景下的审计方法
- 在CIFAR-10上实现更紧的隐私边界，接近理论上限
- 保持单次训练开销小的优势，适合实际部署中的快速审计
差分隐私审计旨在为如DP-SGD等差分隐私机制提供经验下界。尽管已有方法需大量训练轮次且成本高昂，近期工作提出了高效的一次运行审计方法，在白盒设置下表现良好。然而在更实际的黑盒设置中（训练时无法操控梯度，仅能观察最终模型参数），现有方法仍存在经验下界与理论上限之间的显著差距。为此，本文研究如何通过更强的成员推断攻击（MIA）来改进黑盒场景中的一次运行审计。在使用DP-SGD训练的CIFAR-10图像分类模型上，我们证明所提出的基于分位数回归的MIA方法，在保持一次运行计算效率的同时，显著提升了审计结果的紧致性，获得更优的隐私下界。
原文摘要 · Abstract (English)
Differential privacy (DP) auditing aims to provide empirical lower bounds on the privacy guarantees of DP mechanisms like DP-SGD. While some existing techniques require many training runs that are prohibitively costly, recent work introduces one-run auditing approaches that effectively audit DP-SGD in white-box settings while still being computationally efficient. However, in the more practical black-box setting where gradients cannot be manipulated during training and only the last model iterate is observed, prior work shows that there is still a large gap between the empirical lower bounds and theoretical upper bounds. Consequently, in this work, we study how incorporating approaches for stronger membership inference attacks (MIA) can improve one-run auditing in the black-box setting. Evaluating on image classification models trained on CIFAR-10 with DP-SGD, we demonstrate that our proposed approach, which utilizes quantile regression for MIA, achieves tighter bounds while crucially maintaining the computational efficiency of one-run methods.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。