Salvato in:
| Autori principali: | , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2024
|
| Soggetti: | |
| Accesso online: | https://arxiv.org/abs/2412.08544 |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866912152458100736 |
|---|---|
| author | Runkel, Christina Gandikota, Kanchana Vaishnavi Geiping, Jonas Schönlieb, Carola-Bibiane Moeller, Michael |
| author_facet | Runkel, Christina Gandikota, Kanchana Vaishnavi Geiping, Jonas Schönlieb, Carola-Bibiane Moeller, Michael |
| contents | Being able to reconstruct training data from the parameters of a neural network is a major privacy concern. Previous works have shown that reconstructing training data, under certain circumstances, is possible. In this work, we analyse such reconstructions empirically and propose a new formulation of the reconstruction as a solution to a bilevel optimisation problem. We demonstrate that our formulation as well as previous approaches highly depend on the initialisation of the training images $x$ to reconstruct. In particular, we show that a random initialisation of $x$ can lead to reconstructions that resemble valid training samples while not being part of the actual training dataset. Thus, our experiments on affine and one-hidden layer networks suggest that when reconstructing natural images, yet an adversary cannot identify whether reconstructed images have indeed been part of the set of training samples. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2412_08544 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Training Data Reconstruction: Privacy due to Uncertainty? Runkel, Christina Gandikota, Kanchana Vaishnavi Geiping, Jonas Schönlieb, Carola-Bibiane Moeller, Michael Machine Learning Cryptography and Security Being able to reconstruct training data from the parameters of a neural network is a major privacy concern. Previous works have shown that reconstructing training data, under certain circumstances, is possible. In this work, we analyse such reconstructions empirically and propose a new formulation of the reconstruction as a solution to a bilevel optimisation problem. We demonstrate that our formulation as well as previous approaches highly depend on the initialisation of the training images $x$ to reconstruct. In particular, we show that a random initialisation of $x$ can lead to reconstructions that resemble valid training samples while not being part of the actual training dataset. Thus, our experiments on affine and one-hidden layer networks suggest that when reconstructing natural images, yet an adversary cannot identify whether reconstructed images have indeed been part of the set of training samples. |
| title | Training Data Reconstruction: Privacy due to Uncertainty? |
| topic | Machine Learning Cryptography and Security |
| url | https://arxiv.org/abs/2412.08544 |