arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2402.19232cs.LGcs.CR
收藏

经过训练的随机森林会完全泄露你的数据集

Trained Random Forests Completely Reveal your Dataset

CIRRELT;SCALE-AI Chair in Data-Driven Supply Chains(SCALE-AI数据驱动供应链讲席);Polytechnique Montréal(蒙特利尔理工学院);University of Waterloo(滑铁卢大学);Ecole nationale des ponts et chaussées(巴黎路桥学院)

Julien Ferry, Ricardo Fukasawa, Timothée Pascal, Thibaut Vidal

AI总结:

本研究提出基于优化的重建攻击方法,仅用常用库信息即可通过约束规划求解NP难的组合重建问题,实证证明随机森林存在数据泄露漏洞,为这类攻击的可行性提供了明确实证依据。

摘要:

我们提出了一种基于优化的重建攻击方法,能够完全或近乎完全地重建用于训练随机森林的数据集。值得注意的是,我们的方法仅依赖scikit-learn等常用库中现成可得的信息。为实现这一目标,我们将重建问题构建为最大似然目标下的组合问题。我们证明该问题属于NP难问题,但可借助约束规划(一种基于约束传播和解域约简的方法)进行大规模求解。通过大量计算研究,我们证明:未采用bootstrap aggregation(自助聚合)但使用特征随机化训练的随机森林易遭受完全重建攻击,即便树的数量很少时也是如此。即便采用了自助聚合,大部分数据仍可被重建。这些发现揭示了广泛应用的集成方法所固有的关键漏洞,值得关注与缓解。尽管隐私研究中已讨论过此类重建攻击的可能性,但我们的研究为其可行性提供了明确的实证证据。

英文摘要:

We introduce an optimization-based reconstruction attack capable of completely or near-completely reconstructing a dataset utilized for training a random forest. Notably, our approach relies solely on information readily available in commonly used libraries such as scikit-learn. To achieve this, we formulate the reconstruction problem as a combinatorial problem under a maximum likelihood objective. We demonstrate that this problem is NP-hard, though solvable at scale using constraint programming -- an approach rooted in constraint propagation and solution-domain reduction. Through an extensive computational investigation, we demonstrate that random forests trained without bootstrap aggregation but with feature randomization are susceptible to a complete reconstruction. This holds true even with a small number of trees. Even with bootstrap aggregation, the majority of the data can also be reconstructed. These findings underscore a critical vulnerability inherent in widely adopted ensemble methods, warranting attention and mitigation. Although the potential for such reconstruction attacks has been discussed in privacy research, our study provides clear empirical evidence of their practicability.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑