PPA：一种针对联邦学习的偏好剖析攻击
PPA: Preference Profiling Attack Against Federated Learning
摘要：
联邦学习（FL）在许多分散的用户中训练全局模型，每个用户都有一个本地数据集。与传统的集中式学习相比，FL不需要直接存取本地数据集，因此旨在减轻数据隐私问题。然而，由于推理攻击，包括成员推理，属性推理和数据倒置，FL中的数据隐私泄漏仍然存在。在这项工作中，我们提出了一种新型的隐私推理攻击，创造了偏好分析攻击（PPA），准确地描述了本地用户的私人偏好，例如，来自客户的在线购物的最喜欢（不喜欢）的项目和来自用户的自拍的最常见的表达。一般来说，PPA可以剖析top-k（即，k = 1，2，3，特别是k = 1）取决于本地客户端（用户）的特性的偏好。我们的关键见解是，一个本地用户的模型的梯度变化有一个可区分的敏感性，一个给定的类，特别是多数（少数）类的样本比例。PPA通过观察用户模型对某个类的梯度敏感度，可以刻画出该类在用户本地数据集中的样本比例，从而暴露出用户对该类的偏好。FL固有的统计异质性进一步促进PPA。我们使用四个数据集（MNIST，CIFAR 10，RAF-DB和Products-10 K）广泛评估了PPA的有效性。我们的研究结果表明，PPA实现了90%和98%的前1攻击准确率MNIST和CIFAR 10，分别。更重要的是，在现实世界的商业购物场景中（即，产品-10 K）和社交网络（即，RAF-DB），PPA在前一种情况下获得78%的前1攻击准确度，以推断最有序的项目（即，作为商业竞争对手），在后一种情况下，88%的人推断受害者用户最常见的面部表情，例如，恶心
英文摘要：
Federated learning (FL) trains a global model across a number of decentralized users, each with a local dataset. Compared to traditional centralized learning, FL does not require direct access to local datasets and thus aims to mitigate data privacy concerns. However, data privacy leakage in FL still exists due to inference attacks, including membership inference, property inference, and data inversion. In this work, we propose a new type of privacy inference attack, coined Preference Profiling Attack (PPA), that accurately profiles the private preferences of a local user, e.g., most liked (disliked) items from the client's online shopping and most common expressions from the user's selfies. In general, PPA can profile top-k (i.e., k = 1, 2, 3 and k = 1 in particular) preferences contingent on the local client (user)'s characteristics. Our key insight is that the gradient variation of a local user's model has a distinguishable sensitivity to the sample proportion of a given class, especially the majority (minority) class. By observing a user model's gradient sensitivity to a class, PPA can profile the sample proportion of the class in the user's local dataset, and thus the user's preference of the class is exposed. The inherent statistical heterogeneity of FL further facilitates PPA. We have extensively evaluated the PPA's effectiveness using four datasets (MNIST, CIFAR10, RAF-DB and Products-10K). Our results show that PPA achieves 90% and 98% top-1 attack accuracy to the MNIST and CIFAR10, respectively. More importantly, in real-world commercial scenarios of shopping (i.e., Products-10K) and social network (i.e., RAF-DB), PPA gains a top-1 attack accuracy of 78% in the former case to infer the most ordered items (i.e., as a commercial competitor), and 88% in the latter case to infer a victim user's most often facial expressions, e.g., disgusted.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
