Membership Privacy for Machine Learning Models Through Knowledge Transfer

Large capacity machine learning (ML) models are prone to membership inference attacks (MIAs), which aim infer whether the target sample is a member of model's training dataset. The serious privacy concerns due have motivated multiple defenses against MIAs, e.g., differential and adversarial regularization. Unfortunately, these produce ML with unacceptably low classification performances. Our work proposes new defense, called distillation for (DMP), MIAs that preserves utility resulting significantly better than prior defenses. DMP leverages knowledge train privacy. We provide novel criterion tune data used transfer in order amplify DMP. extensive evaluation shows provides tradeoffs between accuracies compared state-of-the-art MIA For instance, achieves ~100% accuracy improvement over regularization DenseNet trained on CIFAR100, similar (measured using risk): when risk 53.7%, adversarially regularized 33.6% accurate, while DMP-trained 65.3% accurate. released our code at github.com/vrt1shjwlkr/AAAI21-MIA-Defense.