Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Explanations Leak: Membership Inference with Differential Privacy and Active Learning Defense

Fatima Ezzeddine, Osama Zammar, Silvia Giordano, Omran Ayoub

TL;DR

This work interrogates how counterfactual explanations (CFs) amplify membership inference attacks (MIAs) in MLaaS and introduces a defense that combines Differential Privacy (DP) with Active Learning (AL) to curb memorization and data exposure. By analyzing shadow-based MIAs with and without CFs, the authors quantify a three-way trade-off between privacy leakage, predictive performance, and CF quality. Empirical results on EEG and In-Location datasets show that CFs can substantially degrade privacy protections even under DP, while DP dimensions may not heavily impair CF fidelity. The study highlights the delicate balance required to maintain transparency, utility, and privacy in explainable MLaaS deployments and suggests avenues for user-centered evaluation of CFs under privacy constraints.

Abstract

Counterfactual explanations (CFs) are increasingly integrated into Machine Learning as a Service (MLaaS) systems to improve transparency; however, ML models deployed via APIs are already vulnerable to privacy attacks such as membership inference and model extraction, and the impact of explanations on this threat landscape remains insufficiently understood. In this work, we focus on the problem of how CFs expand the attack surface of MLaaS by strengthening membership inference attacks (MIAs), and on the need to design defense mechanisms that mitigate this emerging risk without undermining utility and explainability. First, we systematically analyze how exposing CFs through query-based APIs enables more effective shadow-based MIAs. Second, we propose a defense framework that integrates Differential Privacy (DP) with Active Learning (AL) to jointly reduce memorization and limit effective training data exposure. Finally, we conduct an extensive empirical evaluation to characterize the three-way trade-off between privacy leakage, predictive performance, and explanation quality. Our findings highlight the need to carefully balance transparency, utility, and privacy in the responsible deployment of explainable MLaaS systems.

Explanations Leak: Membership Inference with Differential Privacy and Active Learning Defense

TL;DR

This work interrogates how counterfactual explanations (CFs) amplify membership inference attacks (MIAs) in MLaaS and introduces a defense that combines Differential Privacy (DP) with Active Learning (AL) to curb memorization and data exposure. By analyzing shadow-based MIAs with and without CFs, the authors quantify a three-way trade-off between privacy leakage, predictive performance, and CF quality. Empirical results on EEG and In-Location datasets show that CFs can substantially degrade privacy protections even under DP, while DP dimensions may not heavily impair CF fidelity. The study highlights the delicate balance required to maintain transparency, utility, and privacy in explainable MLaaS deployments and suggests avenues for user-centered evaluation of CFs under privacy constraints.

Abstract

Counterfactual explanations (CFs) are increasingly integrated into Machine Learning as a Service (MLaaS) systems to improve transparency; however, ML models deployed via APIs are already vulnerable to privacy attacks such as membership inference and model extraction, and the impact of explanations on this threat landscape remains insufficiently understood. In this work, we focus on the problem of how CFs expand the attack surface of MLaaS by strengthening membership inference attacks (MIAs), and on the need to design defense mechanisms that mitigate this emerging risk without undermining utility and explainability. First, we systematically analyze how exposing CFs through query-based APIs enables more effective shadow-based MIAs. Second, we propose a defense framework that integrates Differential Privacy (DP) with Active Learning (AL) to jointly reduce memorization and limit effective training data exposure. Finally, we conduct an extensive empirical evaluation to characterize the three-way trade-off between privacy leakage, predictive performance, and explanation quality. Our findings highlight the need to carefully balance transparency, utility, and privacy in the responsible deployment of explainable MLaaS systems.
Paper Structure (14 sections, 5 equations, 4 figures, 1 table)

This paper contains 14 sections, 5 equations, 4 figures, 1 table.

Table of Contents

  1. Introduction
  2. Related Work
  3. Reference Scenario and Methodology
  4. Reference Scenario: Shadow-based MIA
  5. No-CF setting
  6. CF-enabled setting.
  7. Defense with Differential Privacy and Active Learning
  8. Experimental Settings
  9. Experimental Results
  10. Model Predictive Performance
  11. Membership Inference Attack
  12. Defense at Micro- and Macro-Level
  13. CF Quality Analysis
  14. Conclusion

Figures (4)

  • Figure 1: Scenario illustrating model training procedures performed, alongside the attacker's strategy of performing MIA.
  • Figure 2: Accuracy, precision, and recall across baselines, privacy budgets $\varepsilon$ with and without using CFs for MIA.
  • Figure 3: Percentage of micro & macro defended records under DP-Post-AL & AL-Guided-DP, with & without CFs. Top row: EEG; bottom row: In-Location.
  • Figure 4: Sparsity and proximity of extracted CFs for EEG and In-Location across differential privacy budgets ($\varepsilon$).