14 Sep 2017 | Briland Hitaj, Giuseppe Ateniese, Fernando Perez-Cruz
This article presents a novel attack on collaborative deep learning systems that exploits the real-time nature of the learning process to infer sensitive information from private data. The authors demonstrate that even with privacy-preserving techniques such as differential privacy (DP), collaborative deep learning is vulnerable to attacks that can extract private information from participants' data. The attack leverages Generative Adversarial Networks (GANs) to generate samples that mimic the distribution of the targeted training data, allowing an adversary to infer sensitive information from a victim's device. The attack is effective even when parameters are obfuscated via DP, as the model's accuracy is sufficient to enable the GAN to generate convincing samples. The authors show that this attack can be applied to various types of data, including medical records, images, and speech recordings, and can lead to privacy violations even when the data is not directly exposed. The paper also discusses the limitations of current privacy-preserving techniques and highlights the importance of designing systems that are robust against such attacks. The authors propose a new class of active inference attacks on deep neural networks in a collaborative setting, which is more effective than existing black-box or white-box information extraction mechanisms. The paper concludes that collaborative learning for privacy is less desirable than the centralized learning approach it was supposed to improve upon, as any user in a collaborative system can potentially compromise the privacy of other users. The authors also discuss the implications of their findings for real-world applications, including Google's Federated Learning and Apple's use of differential privacy in collaborative deep learning.This article presents a novel attack on collaborative deep learning systems that exploits the real-time nature of the learning process to infer sensitive information from private data. The authors demonstrate that even with privacy-preserving techniques such as differential privacy (DP), collaborative deep learning is vulnerable to attacks that can extract private information from participants' data. The attack leverages Generative Adversarial Networks (GANs) to generate samples that mimic the distribution of the targeted training data, allowing an adversary to infer sensitive information from a victim's device. The attack is effective even when parameters are obfuscated via DP, as the model's accuracy is sufficient to enable the GAN to generate convincing samples. The authors show that this attack can be applied to various types of data, including medical records, images, and speech recordings, and can lead to privacy violations even when the data is not directly exposed. The paper also discusses the limitations of current privacy-preserving techniques and highlights the importance of designing systems that are robust against such attacks. The authors propose a new class of active inference attacks on deep neural networks in a collaborative setting, which is more effective than existing black-box or white-box information extraction mechanisms. The paper concludes that collaborative learning for privacy is less desirable than the centralized learning approach it was supposed to improve upon, as any user in a collaborative system can potentially compromise the privacy of other users. The authors also discuss the implications of their findings for real-world applications, including Google's Federated Learning and Apple's use of differential privacy in collaborative deep learning.