让图像识别模型在测试时对敏感数据输出高不确定性，保护隐私。
Inducing Uncertainty on Open-Weight Models for Test-Time Privacy in Image Recognition
- 通过帕累托最优目标，在不降低其他数据准确率的前提下增强敏感样本的不确定性。
- 实测显示敏感样本不确定性提升超3倍，准确率损失极小。
- 适合需要高测试阶段隐私保护的应用场景，如医疗图像识别。
机器学习中一个关键的安全问题长期被忽视：如何防止用户利用模型对错误个人数据的预测来伤害他人？尤其在开放权重模型普及的背景下，仅遮蔽输出已不足以防范攻击者恢复有害预测。为此，我们提出“测试时隐私”概念，并设计算法在保护实例上诱导最大不确定性，同时保持其他实例的预测准确率。所提方法采用帕累托最优目标，显式平衡隐私与效用。我们还提供一种可验证的近似算法，无需凸性假设即可获得$(\varepsilon, δ)$保证。理论证明了该方法带来的隐私-效用权衡的紧界。实验表明，该方法在多个图像识别基准上使敏感实例不确定性提升超过3倍，而准确率下降可忽略。整体框架为终端用户提供额外保护。
原文摘要 · Abstract (English)
A key concern for AI safety remains understudied in the machine learning (ML) literature: how can we ensure users of ML models do not leverage predictions on incorrect personal data to harm others? This is particularly pertinent given the rise of open-weight models, where simply masking model outputs does not suffice to prevent adversaries from recovering harmful predictions. To address this threat, which we call *test-time privacy*, we induce maximal uncertainty on protected instances while preserving accuracy on all other instances. Our proposed algorithm uses a Pareto optimal objective that explicitly balances test-time privacy against utility. We also provide a certifiable approximation algorithm which achieves $(\varepsilon, δ)$ guarantees without convexity assumptions. We then prove a tight bound that characterizes the privacy-utility tradeoff that our algorithms incur. Empirically, our method obtains at least $>3\times$ stronger uncertainty than pretraining with marginal drops in accuracy on various image recognition benchmarks. Altogether, this framework provides a tool to guarantee additional protection to end users.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。