arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2302.01428cs.LGcs.AIcs.NEstat.ML

理解基于神经正切核和数据集蒸馏的重构攻击

Understanding Reconstruction Attacks with the Neural Tangent Kernel and Dataset Distillation

MIT CSAIL(麻省理工学院计算机科学与人工智能实验室)

Noel Loo, Ramin Hasani, Mathias Lechner, Alexander Amini, Daniela Rus

AI总结:

本文提出更强数据集重构攻击,证明无限宽度下可恢复全部训练数据,并揭示攻击成功依赖对神经正切核极限的偏离,且重构图像多为离群点,可用于数据集蒸馏。

摘要:

现代深度学习需要大量数据,这些数据可能包含敏感或私人信息,不能泄露。近期研究表明,对于同质神经网络,仅通过访问训练好的网络参数,就能重构出大部分训练数据。尽管该攻击在经验上有效,但对其有效范围以及哪些数据点容易受到重构影响,缺乏形式化的理解。在本工作中,我们首先构建了一个更强版本的数据集重构攻击,并证明在无限宽度条件下,该攻击能够可证明地恢复整个训练集。随后,我们在两层网络上实证研究该攻击的特征,揭示其成功与否很大程度上取决于对冻结的无限宽度神经正切核极限的偏离。接下来,我们研究容易被重构的图像的性质。我们在理论和实证上均表明,被重构的图像往往是数据集中的“离群点”,并且这些重构攻击可用于数据集蒸馏,即我们可以在重构图像上重新训练并获得高预测精度。

英文摘要:

Modern deep learning requires large volumes of data, which could contain sensitive or private information that cannot be leaked. Recent work has shown for homogeneous neural networks a large portion of this training data could be reconstructed with only access to the trained network parameters. While the attack was shown to work empirically, there exists little formal understanding of its effective regime which datapoints are susceptible to reconstruction. In this work, we first build a stronger version of the dataset reconstruction attack and show how it can provably recover the \emph{entire training set} in the infinite width regime. We then empirically study the characteristics of this attack on two-layer networks and reveal that its success heavily depends on deviations from the frozen infinite-width Neural Tangent Kernel limit. Next, we study the nature of easily-reconstructed images. We show that both theoretically and empirically, reconstructed images tend to "outliers" in the dataset, and that these reconstruction attacks can be used for \textit{dataset distillation}, that is, we can retrain on reconstructed images and obtain high predictive accuracy.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑