Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Decoupling Generalizability and Membership Privacy Risks in Neural Networks

Xingli Fang, Jung-Eun Kim

TL;DR

This work addresses privacy leakage in neural networks by showing that generalization and privacy risk are not uniformly distributed but localized to specific layers. It introduces the Privacy-Preserving Training Principle (PPTP), which freezes privacy-safe layers and retrains privacy-risky layers with privacy defenses to maintain or even improve generalization while reducing privacy leakage. Through experiments on CIFAR-100 and TinyImageNet, PPTP demonstrates comparable or better privacy under multiple MIAs and reduced training costs, highlighting practical gains for context-aware privacy defenses. Overall, the paper provides a scalable, layer-aware framework for balancing utility and privacy in deep networks.

Abstract

A deep learning model usually has to sacrifice some utilities when it acquires some other abilities or characteristics. Privacy preservation has such trade-off relationships with utilities. The loss disparity between various defense approaches implies the potential to decouple generalizability and privacy risks to maximize privacy gain. In this paper, we identify that the model's generalization and privacy risks exist in different regions in deep neural network architectures. Based on the observations that we investigate, we propose Privacy-Preserving Training Principle (PPTP) to protect model components from privacy risks while minimizing the loss in generalizability. Through extensive evaluations, our approach shows significantly better maintenance in model generalizability while enhancing privacy preservation.

Decoupling Generalizability and Membership Privacy Risks in Neural Networks

TL;DR

This work addresses privacy leakage in neural networks by showing that generalization and privacy risk are not uniformly distributed but localized to specific layers. It introduces the Privacy-Preserving Training Principle (PPTP), which freezes privacy-safe layers and retrains privacy-risky layers with privacy defenses to maintain or even improve generalization while reducing privacy leakage. Through experiments on CIFAR-100 and TinyImageNet, PPTP demonstrates comparable or better privacy under multiple MIAs and reduced training costs, highlighting practical gains for context-aware privacy defenses. Overall, the paper provides a scalable, layer-aware framework for balancing utility and privacy in deep networks.

Abstract

A deep learning model usually has to sacrifice some utilities when it acquires some other abilities or characteristics. Privacy preservation has such trade-off relationships with utilities. The loss disparity between various defense approaches implies the potential to decouple generalizability and privacy risks to maximize privacy gain. In this paper, we identify that the model's generalization and privacy risks exist in different regions in deep neural network architectures. Based on the observations that we investigate, we propose Privacy-Preserving Training Principle (PPTP) to protect model components from privacy risks while minimizing the loss in generalizability. Through extensive evaluations, our approach shows significantly better maintenance in model generalizability while enhancing privacy preservation.
Paper Structure (20 sections, 17 figures, 7 tables, 1 algorithm)

This paper contains 20 sections, 17 figures, 7 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Does Prediction Disparity Exist Everywhere?
  4. Why the Question Matters
  5. Sample-Level Measurement Design
  6. Empirical Verification
  7. Data Augmentation
  8. Feature Map Size
  9. Channel Size
  10. Depth
  11. Does Prediction Disparity Exist Everywhere?
  12. Privacy-Preserving Training Principle
  13. Experiments
  14. Experimental Settings
  15. Results and Discussions
  16. ...and 5 more sections

Figures (17)

  • Figure 1: The sample-level feature map differences (norm. distance on x-axis). No disparity is observed in Stage 1--3, whereas gradually increasing disparity is observed within Stage 4 (ResNet152, TinyImageNet, data augmented)
  • Figure 2: Overview of the three architectures' backbone modules.
  • Figure 3: Comparison of models trained with and without data augmentation. (ResNet18, TinyImageNet)
  • Figure 4: Comparison of ResNet18 with different feature map sizes in the 4th stage. (TinyImageNet, data augmented)
  • Figure 5: Comparison of ATM-XT in various channel sizes at the 3rd & 4th stage. (TinyImageNet, data augmented).
  • ...and 12 more figures