Comparing privacy notions for protection against reconstruction attacks in machine learning
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866909480480931840 |
|---|---|
| author | Biswas, Sayan Dras, Mark Faustini, Pedro Fernandes, Natasha McIver, Annabelle Palamidessi, Catuscia Sadeghi, Parastoo |
| author_facet | Biswas, Sayan Dras, Mark Faustini, Pedro Fernandes, Natasha McIver, Annabelle Palamidessi, Catuscia Sadeghi, Parastoo |
| contents | Within the machine learning community, reconstruction attacks are a principal concern and have been identified even in federated learning (FL), which was designed with privacy preservation in mind. In response to these threats, the privacy community recommends the use of differential privacy (DP) in the stochastic gradient descent algorithm, termed DP-SGD. However, the proliferation of variants of DP in recent years\textemdash such as metric privacy\textemdash has made it challenging to conduct a fair comparison between different mechanisms due to the different meanings of the privacy parameters $ε$ and $δ$ across different variants. Thus, interpreting the practical implications of $ε$ and $δ$ in the FL context and amongst variants of DP remains ambiguous. In this paper, we lay a foundational framework for comparing mechanisms with differing notions of privacy guarantees, namely $(ε,δ)$-DP and metric privacy. We provide two foundational means of comparison: firstly, via the well-established $(ε,δ)$-DP guarantees, made possible through the Rényi differential privacy framework; and secondly, via Bayes' capacity, which we identify as an appropriate measure for reconstruction threats. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2502_04045 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Comparing privacy notions for protection against reconstruction attacks in machine learning Biswas, Sayan Dras, Mark Faustini, Pedro Fernandes, Natasha McIver, Annabelle Palamidessi, Catuscia Sadeghi, Parastoo Machine Learning Cryptography and Security Information Theory Within the machine learning community, reconstruction attacks are a principal concern and have been identified even in federated learning (FL), which was designed with privacy preservation in mind. In response to these threats, the privacy community recommends the use of differential privacy (DP) in the stochastic gradient descent algorithm, termed DP-SGD. However, the proliferation of variants of DP in recent years\textemdash such as metric privacy\textemdash has made it challenging to conduct a fair comparison between different mechanisms due to the different meanings of the privacy parameters $ε$ and $δ$ across different variants. Thus, interpreting the practical implications of $ε$ and $δ$ in the FL context and amongst variants of DP remains ambiguous. In this paper, we lay a foundational framework for comparing mechanisms with differing notions of privacy guarantees, namely $(ε,δ)$-DP and metric privacy. We provide two foundational means of comparison: firstly, via the well-established $(ε,δ)$-DP guarantees, made possible through the Rényi differential privacy framework; and secondly, via Bayes' capacity, which we identify as an appropriate measure for reconstruction threats. |
| title | Comparing privacy notions for protection against reconstruction attacks in machine learning |
| topic | Machine Learning Cryptography and Security Information Theory |
| url | https://arxiv.org/abs/2502.04045 |