针对医学图像的数据窃取攻击：从数据湖导出网络是否安全？
Data Stealing Attack on Medical Images: Is it Safe to Export Networks from Data Lakes?
摘要：
在隐私保护机器学习中，学习模型的所有者通常不具有对数据的任何物理访问。相反，只有对数据湖的安全远程访问被授予模型所有者，而没有任何从数据湖检索数据的能力。然而，模型所有者可能希望定期从远程存储库中导出训练模型，这是否会导致数据泄漏的风险。本文介绍了神经网络导出过程中数据窃取攻击的概念。它包括在导出的网络中隐藏一些信息，允许在数据湖中重建最初存储在该数据湖中的图像。更准确地说，我们表明，它是可能的训练网络，可以执行有损图像压缩，并在同一时间解决一些实用的任务，如图像分割。然后，攻击通过导出压缩解码器网络以及一些图像代码来进行，这些代码导致在数据湖之外进行图像重建。我们探讨了这种攻击CT和MR图像数据库的可行性，表明有可能获得目标数据集的感知有意义的重建，并且被盗数据集可以轮流用于解决广泛的任务。综合实验和分析表明，数据窃取攻击应被视为对敏感成像数据源的威胁。
英文摘要：
In privacy-preserving machine learning, it is common that the owner of the learned model does not have any physical access to the data. Instead, only a secured remote access to a data lake is granted to the model owner without any ability to retrieve data from the data lake. Yet, the model owner may want to export the trained model periodically from the remote repository and a question arises whether this may cause is a risk of data leakage. In this paper, we introduce the concept of data stealing attack during the export of neural networks. It consists in hiding some information in the exported network that allows the reconstruction outside the data lake of images initially stored in that data lake. More precisely, we show that it is possible to train a network that can perform lossy image compression and at the same time solve some utility tasks such as image segmentation. The attack then proceeds by exporting the compression decoder network together with some image codes that leads to the image reconstruction outside the data lake. We explore the feasibility of such attacks on databases of CT and MR images, showing that it is possible to obtain perceptually meaningful reconstructions of the target dataset, and that the stolen dataset can be used in turns to solve a broad range of tasks. Comprehensive experiments and analyses show that data stealing attacks should be considered as a threat for sensitive imaging data sources.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
