通过重构攻击研究降维方法中的隐私泄露
Investigating Privacy Leakage in Dimensionality Reduction Methods via Reconstruction Attack
AI总结：
本文提出一种基于神经网络的降维重构攻击，在MNIST和NIH Chest X-ray数据集上评估六种降维方法，发现攻击对PCA和Isomap等确定性方法有效，对随机初始化方法无效，并验证了加性噪声可有效缓解攻击。
摘要：
本研究通过一种新颖的基于机器学习重构攻击，研究降维方法中的隐私泄露问题。采用知情对手威胁模型，我们开发了一个神经网络，能够从低维嵌入中重构高维数据。我们评估了六种流行的降维技术：主成分分析（PCA）、稀疏随机投影（SRP）、多维缩放（MDS）、Isomap、t分布随机邻域嵌入（t-SNE）和均匀流形近似与投影（UMAP）。使用MNIST和NIH Chest X-ray数据集，我们进行了定性分析，以识别影响重构质量的关键因素。此外，我们评估了加性噪声机制在缓解这些重构攻击方面的有效性。我们在两个数据集上的实验结果表明，该攻击对确定性方法（PCA和Isomap）有效，但对采用随机初始化的方法（SRP、MDS、t-SNE和UMAP）无效。实验结果还表明，对于PCA和Isomap，我们的重构网络相比之前提出的网络产生了更高质量的输出。我们还研究了加性噪声机制防止重构攻击的效果。我们的实验表明，在执行PCA或Isomap之前对图像添加较大噪声时，攻击产生了严重失真的重构结果。相比之下，对于其他四种方法，重构结果仍然显示出一些可识别的特征，尽管它们与原始图像几乎没有相似之处。代码可在https://github.com/Chayadon/Reconstruction_attack_on_DR获取。
英文摘要：
This study investigates privacy leakage in dimensionality reduction methods through a novel machine learning-based reconstruction attack. Employing an informed adversary threat model, we develop a neural network capable of reconstructing high-dimensional data from low-dimensional embeddings. We evaluate six popular dimensionality reduction techniques: principal component analysis (PCA), sparse random projection (SRP), multidimensional scaling (MDS), Isomap, $t$-distributed stochastic neighbor embedding ($t$-SNE), and uniform manifold approximation and projection (UMAP). Using both MNIST and NIH Chest X-ray datasets, we perform a qualitative analysis to identify key factors affecting reconstruction quality. Furthermore, we assess the effectiveness of an additive noise mechanism in mitigating these reconstruction attacks. Our experimental results on both datasets reveal that the attack is effective against deterministic methods (PCA and Isomap). but ineffective against methods that employ random initialization (SRP, MDS, $t$-SNE and UMAP). The experimental results also show that, for PCA and Isomap, our reconstruction network produces higher quality outputs compared to a previously proposed network. We also study the effect of additive noise mechanism to prevent the reconstruction attack. Our experiment shows that, when adding the images with large noises before performing PCA or Isomap, the attack produced severely distorted reconstructions. In contrast, for the other four methods, the reconstructions still show some recognizable features, though they bear little resemblance to the original images. The code is available at https://github.com/Chayadon/Reconstruction_attack_on_DR
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
