Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Prediction

Machine learning (ML) models are vulnerable to membership inference attacks (MIAs), which determine whether a given input is used for training the target model.While there have been many efforts to mitigate MIAs, they often suffer from limited privacy protection, large accuracy drop, and/or requiring additional data that may be difficult to acquire.This work proposes a defense technique, HAMP that can achieve both strong membership privacy and high accuracy, without requiring extra data.To mitigate MIAs in different forms, we observe that they can be unified as they all exploit the ML model's overconfidence in predicting training samples through different proxies.This motivates our design to enforce less confident prediction by the model, hence forcing the model to behave similarly on the training and testing samples.HAMP consists of a novel training framework with high-entropy soft labels and an entropy-based regularizer to constrain the model's prediction while still achieving high accuracy.To further reduce privacy risk, HAMP uniformly modifies all the prediction outputs to become low-confidence outputs while preserving the accuracy, which effectively obscures the differences between the prediction on members and non-members.We conduct extensive evaluation on five benchmark datasets, and show that HAMP provides consistently high accuracy and strong membership privacy.Our comparison with seven state-ofthe-art defenses shows that HAMP achieves a superior privacyutility trade off than those techniques 1 . Defender.We assume the defender has a private set D tr and his/her goal is to train a model that can both achieve high classification accuracy and protect against MIAs.We do not assume the defender has access to any additional data. C. Membership Inference AttacksThe attack model h(x, y, F (x)) → [0, 1] outputs the membership probability.We refer to D A tr , D A te as the set of members and non-members that are known to the adversary.The adversary's goal is to find a h that can best distinguish between D A tr and D A te .The empirical gain of the attack can be measured as:We categorize existing MIAs into score-based and labelonly attacks as follows.Score-based MIAs: This class of attacks either trains an inference model to infer membership [31], [38] or computes custom metrics such as prediction loss [49] to derive a threshold for distinction. NN-based attack[31], [38] trains an neural network (NN) A, to distinguish the target model's prediction on members and non-members: A : F (x) → [0, 1], x ∈ [D A tr , D A te ].By querying the target model with D A tr , D A te , the resulting output (F (D A tr ), 1), (F (D A te ), 0) forms the training set for A. In addition to output scores, other features like the ground-truth labels and prediction loss can also be used to train the inference model.

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.