arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2404.02462cs.CV

基于部分感知能力的视觉自监督编码器统一成员推理方法

A Unified Membership Inference Method for Visual Self-supervised Encoder via Part-aware Capability

Peking University(北京大学);Tsinghua University(清华大学)

Jie Zhu, Jirong Zha, Ding Li, Leye Wang

AI总结:

本文针对黑盒视觉自监督模型提出统一成员推理方法PartCrop,利用模型的部分感知能力裁剪图像对象部分查询响应,验证了其有效性与泛化性,并评估了早停、差分隐私及缩小裁剪尺度范围等防御手段。

摘要:

自监督学习在利用大量无标签数据方面展现出潜力,但也面临重大的隐私问题,尤其是在视觉领域。本文旨在更现实的设置下对视觉自监督模型进行成员推理:攻击者发起攻击时,自监督训练方法及细节是未知的,因为其在实践中通常面对的是黑盒系统。在此设置下,考虑到自监督模型可能由完全不同的自监督范式(例如,掩码图像建模和对比学习)及复杂的训练细节训练而成,我们提出了一种名为PartCrop的统一成员推理方法。其动机源于模型间共享的部分感知能力以及训练数据上更强的部分响应。具体而言,PartCrop裁剪图像中对象的部分,以在表示空间中查询这些部分与图像的响应。我们使用三个广泛使用的图像数据集,对不同训练协议和结构的自监督模型进行了广泛攻击。结果验证了PartCrop的有效性和泛化性。此外,为防御PartCrop,我们评估了两种常见方法,即早停和差分隐私,并提出了一种名为缩小裁剪尺度范围的定制方法。防御实验表明它们均有效。

英文摘要:

Self-supervised learning shows promise in harnessing extensive unlabeled data, but it also confronts significant privacy concerns, especially in vision. In this paper, we aim to perform membership inference on visual self-supervised models in a more realistic setting: self-supervised training method and details are unknown for an adversary when attacking as he usually faces a black-box system in practice. In this setting, considering that self-supervised model could be trained by completely different self-supervised paradigms, e.g., masked image modeling and contrastive learning, with complex training details, we propose a unified membership inference method called PartCrop. It is motivated by the shared part-aware capability among models and stronger part response on the training data. Specifically, PartCrop crops parts of objects in an image to query responses with the image in representation space. We conduct extensive attacks on self-supervised models with different training protocols and structures using three widely used image datasets. The results verify the effectiveness and generalization of PartCrop. Moreover, to defend against PartCrop, we evaluate two common approaches, i.e., early stop and differential privacy, and propose a tailored method called shrinking crop scale range. The defense experiments indicate that all of them are effective. Our code is available at https://github.com/JiePKU/PartCrop.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑