解释模型，保护你的数据：通过成员推理揭示和缓解事后模型解释的数据隐私风险
Explaining the Model, Protecting Your Data: Revealing and Mitigating the Data Privacy Risks of Post-Hoc Model Explanations via Membership Inference
AI总结：
针对高风险场景下图像分类基础模型事后解释的隐私风险，提出两种基于特征归因的新型成员推理攻击VAR-LRT和L1/L2-LRT，并发现优化的差分隐私微调能在保持高准确率的同时有效缓解这些攻击。
摘要：
预测性机器学习模型正越来越多地部署在涉及敏感个人数据的高风险场景中；在这些场景中，模型可解释性与数据隐私之间存在权衡。在这项工作中，我们突破了这一权衡的边界：以用于图像分类微调的基础模型为重点，我们揭示了事后模型解释无法预见的隐私风险，并随后提供了针对此类风险的缓解策略。首先，我们构建了VAR-LRT和L1/L2-LRT，这是两种基于特征归因解释的新型成员推理攻击，其成功率显著高于现有的利用解释的攻击，特别是在低假阳性率机制下，这使得对手能够自信地识别出特定的训练集成员。其次，我们从经验上发现，优化的差分隐私微调在保持高模型准确率的同时，大幅降低了上述攻击的成功率。我们使用5种视觉Transformer架构、5个基准数据集、4种最先进的事后解释方法和4种隐私强度设置，对2种新攻击进行了系统的实证研究。
英文摘要：
Predictive machine learning models are becoming increasingly deployed in high-stakes contexts involving sensitive personal data; in these contexts, there is a trade-off between model explainability and data privacy. In this work, we push the boundaries of this trade-off: with a focus on foundation models for image classification fine-tuning, we reveal unforeseen privacy risks of post-hoc model explanations and subsequently offer mitigation strategies for such risks. First, we construct VAR-LRT and L1/L2-LRT, two new membership inference attacks based on feature attribution explanations that are significantly more successful than existing explanation-leveraging attacks, particularly in the low false-positive rate regime that allows an adversary to identify specific training set members with confidence. Second, we find empirically that optimized differentially private fine-tuning substantially diminishes the success of the aforementioned attacks, while maintaining high model accuracy. We carry out a systematic empirical investigation of our 2 new attacks with 5 vision transformer architectures, 5 benchmark datasets, 4 state-of-the-art post-hoc explanation methods, and 4 privacy strength settings.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
