用公平微调降低模型泄露训练数据分布的风险,保护隐私。
Fair Finetuning Mitigates Distribution Inference Attacks
- 在互补数据上施加平等机会约束进行微调,抑制分布泄露
- 在六个数据集上将攻击者准确率差距降至10%以下,最高降幅达11%
- 首次建立公平性与隐私防护的理论联系,适合关注隐私安全的研究者
基于敏感数据训练的机器学习模型可能无意中泄露其训练分布的人口统计信息,即分布推理攻击(DIA)。攻击者仅通过黑盒访问即可推断出子群体比例等敏感属性,无需直接观察训练数据。尽管已有差分隐私和属性遗忘等防御方法,但公平性约束与分布泄露之间的关系尚未被探索。本文提出公平微调(FFt):在互补分布样本上,以平等机会(EO)约束对模型进行微调。我们提供了完整的理论分析,证明对抗优势满足 $\text{Adv}(\mathcal{A},M_f) \le Δ_{\text{EO}} \cdot W$,其中 $W$ 衡量两类训练分布在敏感属性组成上的可区分程度。我们还确立了FFt降低对抗优势的必要条件,并证明该界是紧致的。在涵盖表格(ACS Income、COMPAS、German Credit)、图像(UTKFaces)和NLP(Bias in Bios)六种模态的数据集上评估,基于回放的FFt在所有设置下均使对抗准确率差距低于检测阈值 $τ=0.1$;在ACS Income上,差距从约15%降至4%以下。本工作首次将模型测量的EO偏差直接与DIA中的对抗优势关联起来,为统一的公平性与隐私防御开辟新路径。
原文摘要 · Abstract (English)
Machine learning models trained on sensitive data can inadvertently leak population-level information about their training distributions -- a threat known as distribution inference attack (DIA). An adversary with black-box access can infer sensitive demographic properties, such as subgroup proportions, without observing any training data directly. While defenses such as differential privacy and property unlearning have been proposed, the link between fairness constraints and distributional leakage remains unexplored. We propose Fair Fine-tuning (FFt): a trained model is fine-tuned on samples from the complementary distribution under an Equalized Odds (EO) constraint. We provide a complete theoretical characterization, proving the tight bound $\text{Adv}(\mathcal{A},M_f) \le Δ_{\text{EO}} \cdot W$, where $W$ quantifies how distinguishable the two training distributions are by their sensitive-attribute composition. We also establish a necessary condition for FFt to reduce adversarial advantage and prove tightness of the bound. We evaluate across six datasets spanning tabular (ACS Income, COMPAS, German Credit), image (UTKFaces), and NLP (Bias in Bios) modalities. Rehearsal-based FFt consistently reduces the adversarial accuracy gap below the detection threshold $τ!=!0.1$ across all settings; on ACS Income, the gap falls from $\sim!15%$ to under $4%$. Our work provides the first formal bound connecting a model's measured EO disparity directly to its adversarial advantage in the DIA game, opening a new avenue for unified fairness-and-privacy defenses.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。