本文从理论与实验两方面分析 SERA 边重构攻击对图表示的隐私威胁，证明其在稀疏图上的重构能力及 NAG 的缓解作用。
摘要：
图表示学习（GRL）对于从复杂网络结构中提取洞见至关重要，但由于这些表示中存在潜在隐私漏洞，它也引发了安全担忧。本文研究图神经模型中的结构性漏洞，在这些模型中，敏感拓扑信息可通过边重构攻击被推断出来。我们的研究主要探讨基于相似性的边重构攻击（SERA）的理论基础，并对其重构能力给出非渐近分析。此外，我们提供了经验证据，表明随着图规模增大，此类攻击能够完美重构稀疏图。相反，我们通过对（稠密）随机块模型的分析和实验证明，稀疏性是 SERA 有效性的关键因素。最后，我们探究通过噪声聚合（NAG）机制生成的私有图表示对 SERA 的抵御能力。通过理论分析和经验评估，我们确认 NAG 可缓解 SERA。与此同时，我们还从经验上刻画了 SERA 表现出有效性和不足的情形，以使其能够作为阐明隐私与效用之间权衡的工具。
英文摘要：
Graph representation learning (GRL) is critical for extracting insights from complex network structures, but it also raises security concerns due to potential privacy vulnerabilities in these representations. This paper investigates the structural vulnerabilities in graph neural models where sensitive topological information can be inferred through edge reconstruction attacks. Our research primarily addresses the theoretical underpinnings of similarity-based edge reconstruction attacks (SERA), furnishing a non-asymptotic analysis of their reconstruction capacities. Moreover, we present empirical corroboration indicating that such attacks can perfectly reconstruct sparse graphs as graph size increases. Conversely, we establish that sparsity is a critical factor for SERA's effectiveness, as demonstrated through analysis and experiments on (dense) stochastic block models. Finally, we explore the resilience of private graph representations produced via noisy aggregation (NAG) mechanism against SERA. Through theoretical analysis and empirical assessments, we affirm the mitigation of SERA using NAG . In parallel, we also empirically delineate instances wherein SERA demonstrates both efficacy and deficiency in its capacity to function as an instrument for elucidating the trade-off between privacy and utility.
New Jersey Institute of Technology（新泽西理工学院）；Kent State University（肯特州立大学）；University of Oregon（俄勒冈大学）；University of Arkansas（阿肯色大学）；University of Florida（佛罗里达大学）
In this paper, we propose a novel Heterogeneous Gaussian Mechanism (HGM) to preserve differential privacy in deep neural networks, with provable robustness against adversarial examples. We first relax the constraint of the privacy budget in the traditional Gaussian Mechanism from (0, 1] to (0, \infty), with a new bound of the noise scale to preserve differential privacy. The noise in our mechanism can be arbitrarily redistributed, offering a distinctive ability to address the trade-off between model utility and privacy loss. To derive provable robustness, our HGM is applied to inject Gaussian …
Stanford University（斯坦福大学）；Google Cloud AI Research（谷歌云人工智能研究部）
In applications involving sensitive data, such as finance and healthcare, the necessity for preserving data privacy can be a significant barrier to machine learning model development. Differential privacy (DP) has emerged as one canonical standard for provable privacy. However, DP's strong theoretical guarantees often come at the cost of a large drop in its utility for machine learning, and DP guarantees themselves can be difficult to interpret. In this work, we propose a novel privacy notion, membership inference privacy (MIP), to address these challenges. We give a precise characterization o…
A surprising phenomenon in modern machine learning is the ability of a highly overparameterized model to generalize well (small error on the test data) even when it is trained to memorize the training data (zero error on the training data). This has led to an arms race towards increasingly overparameterized models (c.f., deep learning). In this paper, we study an underexplored hidden cost of overparameterization: the fact that overparameterized models may be more vulnerable to privacy attacks, in particular the membership inference attack that predicts the (potentially sensitive) examples used…
College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）；JZTData Technology（JZTData科技公司 (JZTData Technology)）
With the increasing demands for privacy protection, privacy-preserving machine learning has been drawing much attention in both academia and industry. However, most existing methods have their limitations in practical applications. On the one hand, although most cryptographic methods are provable secure, they bring heavy computation and communication. On the other hand, the security of many relatively efficient private methods (e.g., federated learning and split learning) is being questioned, since they are non-provable secure. Inspired by previous work on privacy-preserving machine learning, …
Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy
Department of Computer Science, Technical University of Munich（慕尼黑技术大学计算机科学系）；Munich Data Science Institute（慕尼黑数据科学研究所）；MCML；Machine Learning Research, Morgan Stanley（摩根大通机器学习研究）
Federated learning (FL) is a popular distributed learning framework that can reduce privacy risks by not explicitly sharing private data. However, recent works demonstrated that sharing model updates makes FL vulnerable to inference attacks. In this work, we show our key observation that the data representation leakage from gradients is the essential cause of privacy leakage in FL. We also provide an analysis of this observation to explain how the data presentation is leaked. Based on this observation, we propose a defense against model inversion attack in FL. The key idea of our defense is le…
Unveiling Privacy Vulnerabilities: Investigating the Role of Structure in Graph Data
State Key Laboratory of Blockchain and Security（区块链与安全国家重点实验室）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新区（滨江）区块链与数据安全研究院）；Fudan University（复旦大学）；Zhejiang University（浙江大学）；Peking University（北京大学）；Finvolution Group（Finvolution集团）
Your Privacy Depends on Others: Collusion Vulnerabilities in Individual Differential Privacy
Technical University of Munich（慕尼黑技术大学）；TUM University Hospital（TUM大学医院）；University of Potsdam（波茨坦大学）；Imperial College London（伦敦帝国学院）；Google DeepMind（谷歌DeepMind）
Provable Privacy Advantages of Decentralized Federated Learning via Distributed Optimization
CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全中心）；Aalborg University（奥尔堡大学）；University of Twente（特温特大学）；Netherlands Defence Academy（荷兰国防学院）；Delft University of Technology（代尔夫特理工大学）
Provable Differentially Private Computation of the Cross-Attention Mechanism
The University of Hong Kong（香港大学）；University of Wisconsin-Madison（威斯康星大学麦迪逊分校）；The Simons Institute for the Theory of Computing at the University of California, Berkeley（伯克利大学计算理论研究所）
Do Fairness Interventions Come at the Cost of Privacy: Evaluations for Binary Classifiers
Australian Artificial Intelligence Institute and the School of Computer Science, University of Technology Sydney（澳大利亚人工智能研究所和悉尼技术大学计算机学院）；Data61, CSIRO（Data61和澳大利亚联邦科学与工业研究组织）；City University of Macau（澳门城市大学）
EPFL（洛桑联邦理工学院）；University College London（伦敦大学学院）；University of California, Berkeley（加州大学伯克利分校）
Machine-learning models for security-critical applications such as bot, malware, or spam detection, operate in constrained discrete domains. These applications would benefit from having provable guarantees against adversarial examples. The existing literature on provable adversarial robustness of models, however, exclusively focuses on robustness to gradient-based attacks in domains such as images. These attacks model the adversarial cost, e.g., amount of distortion applied to an image, as a $p$-norm. We argue that this approach is not well-suited to model adversarial costs in constrained doma…
Clemson University（克莱姆森大学）；University of Illinois at Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）
By enabling multiple agents to cooperatively solve a global optimization problem in the absence of a central coordinator, decentralized stochastic optimization is gaining increasing attention in areas as diverse as machine learning, control, and sensor networks. Since the associated data usually contain sensitive information, such as user locations and personal identities, privacy protection has emerged as a crucial need in the implementation of decentralized stochastic optimization. In this paper, we propose a decentralized stochastic optimization algorithm that is able to guarantee provable …
FedSC: Provable Federated Self-supervised Learning with Spectral Contrastive Objective over Non-i.i.d. Data
University of California, San Francisco（加州大学旧金山分校）；Lehigh University（利哈伊大学）；New Jersey Institute of Technology（新泽西理工学院）；University of Louisiana at Lafayette（路易斯安那大学拉法叶分校）
Pennsylvania State University（宾夕法尼亚州立大学）；University of Michigan（密歇根大学）
Advances in machine learning (ML) in recent years have enabled a dizzying array of applications such as data analytics, autonomous systems, and security diagnostics. ML is now pervasive---new systems and models are being deployed in every domain imaginable, leading to rapid and widespread deployment of software based inference and decision making. There is growing recognition that ML exposes new vulnerabilities in software systems, yet the technical community's understanding of the nature and extent of these vulnerabilities remains limited. We systematize recent findings on ML security and pri…
Can Federated Learning Safeguard Private Data in LLM Training? Vulnerabilities, Attacks, and Defense Evaluation
State Key Laboratory of Virtual Reality Technology and Systems, School of Computer Science and Engineering, Beihang University, Beijing, China（虚拟现实技术与系统国家重点实验室，计算机科学与工程学院，北京航空航天大学）；Hangzhou Innovation Institute of Beihang University, Zhejiang Key Laboratory of Industrial Big Data and Robot Intelligent Systems, Hangzhou, China（北京航空航天大学杭州创新研究院，浙江省工业大数据与机器人智能系统重点实验室）；Center for AI Business Innovation, Department of Management Science and Systems, University at Buffalo, Buffalo, New York, USA（人工智能商业创新中心，管理科学与系统系，布法罗大学）；University of North Texas, Denton, Texas, USA（德克萨斯大学达文波特分校）；Zhongguancun Laboratory, Beijing, China（中关村实验室）
In Vino Veritas and Vulnerabilities: Examining LLM Safety via Drunk Language Inducement
School of Computer Science and Engineering, UNSW Sydney（计算机科学与工程学院，新南威尔士大学悉尼分校）；School of Computing and Information System, the University of Melbourne（计算与信息系统学院，墨尔本大学）
Federated Learning (FL) is a distributed learning paradigm that enables different parties to train a model together for high quality and strong privacy protection. In this scenario, individual participants may get compromised and perform backdoor attacks by poisoning the data (or gradients). Existing work on robust aggregation and certified FL robustness does not study how hardening benign clients can affect the global model (and the malicious clients). In this work, we theoretically analyze the connection among cross-entropy loss, attack success rate, and clean accuracy in this setting. Moreo…
