通过分层学习率微调，阻止医疗数据泄露攻击
Mitigating Data Exfiltration Attacks through Layer-Wise Learning Rate Decay Fine-Tuning
- 用逐层递减学习率微调模型，干扰数据嵌入
- 在三个医学数据集上保持任务性能，击溃主流攻击
- 适合部署在数据湖和联邦学习中的隐私保护
数据湖支持在敏感高价值医疗数据上训练强大机器学习模型，但也因潜在的受保护健康信息泄露带来严重隐私风险。近期研究表明，攻击者可通过将隐含表示嵌入模型参数或借助多任务学习诱导记忆，从看似正常的模型中重建高保真医学图像，造成严重隐私威胁。本文提出一种简单有效的缓解策略：在模型导出时，通过分层递减学习率微调扰动模型参数，破坏嵌入数据，同时不降低任务性能。在DermaMNIST、ChestMNIST和MIMIC-CXR上的评估显示，该方法维持了任务性能，有效阻断当前最先进的泄露攻击，优于已有防御方案，并使窃取数据无法用于再训练。消融实验与自适应攻击讨论揭示了挑战与未来方向。研究为数据湖训练模型及集中式联邦学习提供了实用的防泄露方案。
原文摘要 · Abstract (English)
Data lakes enable the training of powerful machine learning models on sensitive, high-value medical datasets, but also introduce serious privacy risks due to potential leakage of protected health information. Recent studies show adversaries can exfiltrate training data by embedding latent representations into model parameters or inducing memorization via multi-task learning. These attacks disguise themselves as benign utility models while enabling reconstruction of high-fidelity medical images, posing severe privacy threats with legal and ethical implications. In this work, we propose a simple yet effective mitigation strategy that perturbs model parameters at export time through fine-tuning with a decaying layer-wise learning rate to corrupt embedded data without degrading task performance. Evaluations on DermaMNIST, ChestMNIST, and MIMIC-CXR show that our approach maintains utility task performance, effectively disrupts state-of-the-art exfiltration attacks, outperforms prior defenses, and renders exfiltrated data unusable for training. Ablations and discussions on adaptive attacks highlight challenges and future directions. Our findings offer a practical defense against data leakage in data lake-trained models and centralized federated learning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。