基于逐块随机与噪声 CutMix 的视觉 Transformer 隐私保护分割学习
Privacy-Preserving Split Learning with Vision Transformers using Patch-Wise Random and Noisy CutMix
AI总结：
本文提出 DP-CutMixSL 框架，通过在分割学习中注入高斯噪声并跨客户端随机混合粉碎数据块，以差分隐私机制增强 ViT 训练时的隐私保护，同时提升分类准确性。
摘要：
在计算机视觉领域，视觉 Transformer（ViT）在准确性和鲁棒性方面已日益取代卷积神经网络（CNN）。然而，ViT 模型规模大、样本复杂度高，使其难以在资源受限的边缘设备上训练。分割学习（SL）成为一种可行的解决方案，它利用服务器端资源训练 ViT，同时使用分布式设备上的私有数据。然而，SL 需要在设备与服务器之间进行额外的权重更新信息交换，这些信息可能暴露于针对私有训练数据的各种攻击之下。为了降低分类任务中数据泄露的风险，受 CutMix 正则化的启发，我们提出了一种新颖的隐私保护 SL 框架，该框架向粉碎数据中注入高斯噪声，并在客户端之间混合随机选择的粉碎数据块，命名为 DP-CutMixSL。我们的分析表明，DP-CutMixSL 是一种差分隐私（DP）机制，能够在前向传播过程中增强对成员推理攻击的隐私保护。通过仿真实验，我们证明 DP-CutMixSL 在抵御成员推理攻击、重构攻击和标签推理攻击方面提升了隐私保护能力，同时与 DP-SL 和 DP-MixSL 相比也提高了准确性。
英文摘要：
In computer vision, the vision transformer (ViT) has increasingly superseded the convolutional neural network (CNN) for improved accuracy and robustness. However, ViT's large model sizes and high sample complexity make it difficult to train on resource-constrained edge devices. Split learning (SL) emerges as a viable solution, leveraging server-side resources to train ViTs while utilizing private data from distributed devices. However, SL requires additional information exchange for weight updates between the device and the server, which can be exposed to various attacks on private training data. To mitigate the risk of data breaches in classification tasks, inspired from the CutMix regularization, we propose a novel privacy-preserving SL framework that injects Gaussian noise into smashed data and mixes randomly chosen patches of smashed data across clients, coined DP-CutMixSL. Our analysis demonstrates that DP-CutMixSL is a differentially private (DP) mechanism that strengthens privacy protection against membership inference attacks during forward propagation. Through simulations, we show that DP-CutMixSL improves privacy protection against membership inference attacks, reconstruction attacks, and label inference attacks, while also improving accuracy compared to DP-SL and DP-MixSL.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
