New Research Trends in Cybersecurity Privacy Attacks on Decentralized Deep Learning

Transcription

1 New Research Trends in Cybersecurity Privacy Attacks on Decentralized Deep Learning Prof. Luigi V. Mancini Tel

2

3

4 Machine Learning Applications in the Public Sector Machine Learning to help public servants to: increase the quality of services offered to the citizens based on the actual data, make welfare payments and immigration decisions, detect fraud, plan new infrastructure projects, answer citizen queries, adjudicate bail hearings, triage health care cases, automate computer grading in schools. Machine learning may be better, cheaper, faster, or more accurate than humans at tasks that involve lots of data, complicated calculations, or repetitive tasks with clear rules.

5 Deep Learning Branch of machine learning that makes use of neural networks, to find solutions for a variety of complex tasks either in supervised or unsupervised way - Areas used: - Computer vision - Image processing - Face recognition - Speech recognition - Text-to-speech systems - Natural language processing - Games... image source: image source: image source: 5

6 Deep Learning - Neural Networks Components Input Layer Hidden Layers (1...n) - that s where the term deep learning derives Output Layer Weights, biases image sources: 6

7 Deep Learning - Neural Networks Types Multi Layer Perceptrons (MLP) Convolutional Neural Networks (CNN) Recurrent Neural Networks (RNN) Residual Neural Networks (ResNets) Capsule Nets image sources: 7

8 Huge computational power Deep Learning Large quantities of data image source: image source: 8

9 Centralized Learning Scheme - Privacy issues - data pooled on a central server - no control over the learning process What if the Adversary lies on the central authority (entity providing the service)? 9

10

11 Is it possible to train a neural network while preserving privacy of the data set??? 11

12 Privacy-Preserving Deep Learning / Decentralized Learning Scheme (collaborative / federated - Google AI) User 1 User 3 - local training on data - updates shared via a parameters server (ex. Google s federated learning) - participants indirectly influence each other s learning - differential privacy can be used to minimize leakages from parameter uploads 12

13 Can neural networks attack neural networks??? 13

14 YES! 14

15 Attacks on ML models 1) Hacking Smart Machines with Smarter Ones, 2011 by Mancini et al. 2) Model Inversion Attacks, 2015 by Fredrikson et al. 3) Membership Inference Attacks, 2017 by Shokri et al. 15

16 Decentralized Learning Scheme (collaborative/federated) - Adversary goal? Reconstruct private dataset of the victim - Indirectly influencing the learning of other participants 16

17 Generative Adversarial Network basic architecture Dataset Real Data Sample D real sample G Fake Data Sample Discriminator D Eyewitness fake sample Generator G Police Sketch Artist GAN Architecture 17

18 Our Attack: Deep Models Under the GAN What does Alice class look like??? data label data label [Bob] [Alice] [Eve] [Bob] Agreement - Common learning objective - Architecture of the model - Labels/Classes present 18

19 Victim s Turn data label [Bob] [Eve] data label [Alice] [Bob] w 1 w 2... w n data label [Alice] [Bob] Parameter Server Select a Portion of Parameters to Upload According to Protocol Train on Personal Data 19

20 Adversary s Turn data label [Bob] [Eve] data label [Alice] [Bob] w 1 w 2.. w n Update Local Model Download a Portion of Parameters According to Protocol Parameter Server 20

21 Adversary s Turn data label [Bob] [Eve] data label [Alice] [Bob]? Generator G Yes/No Local Model becomes Discriminator D 21

22 Adversary s Turn data label [Bob] [Eve] data label [Alice] [Bob] label [Eve] [Bob] data w 1 w 2... w n Adversary s Model Select a Portion of Parameters to Upload According to Protocol Parameter Server 22

23 Experiments (Adversary has NO data at all) training data training data Participant Participant training data Result without Differential Privacy Victim Parameter Server (PS) Adversary NO training data Result with Differential Privacy 23

24 Experiments without Differential Privacy Actual Images Generated Data Original vs Generated 24

25 Experiments with Differential Privacy Actual Images Generated Data Original vs Generated 25

26 Further Results Actual Images Generated Images 26

27 It seems that collaborative learning for citizens privacy is less desirable than centralized learning 27

28 Concluding Remarks Researchers are continuous in exploring Machine Learning and the related Privacy and Security Issues. In order to find a solution, it is necessary to invest in research and not only in the market. Acquire Kow-how so we can always be a little ahead of the attackers. The Public Administration protects the interests of the community and cannot afford to lag behind the attackers.