Mnemonist: Locating Model Parameters that Memorize Training Examples

Ali Shahin Shamsabadi, Jamie Hayes, Borja Balle, Adrian Weller
Proceedings of the Thirty-Ninth Conference on Uncertainty in Artificial Intelligence, PMLR 216:1879-1888, 2023.

Abstract

Recent work has shown that an adversary can reconstruct training examples given access to the parameters of a deep learning image classification model. We show that the quality of reconstruction depends heavily on the type of activation functions used. In particular, we show that ReLU activations lead to much lower quality reconstructions compared to smooth activation functions. We explore if this phenomenon is a fundamental property of models with ReLU activations, or if it is a weakness of current attack strategies. We first study the training dynamics of small MLPs with ReLU activations and identify redundant model parameters that do not memorise training examples. Building on this, we propose our Mnemonist method, which is able to detect redundant model parameters, and then guide current attacks to focus on informative parameters to improve the quality of reconstructions of training examples from ReLU models.

Cite this Paper

BibTeX
@InProceedings{pmlr-v216-shahin-shamsabadi23a, title = {Mnemonist: Locating Model Parameters that Memorize Training Examples}, author = {Shahin Shamsabadi, Ali and Hayes, Jamie and Balle, Borja and Weller, Adrian}, booktitle = {Proceedings of the Thirty-Ninth Conference on Uncertainty in Artificial Intelligence}, pages = {1879--1888}, year = {2023}, editor = {Evans, Robin J. and Shpitser, Ilya}, volume = {216}, series = {Proceedings of Machine Learning Research}, month = {31 Jul--04 Aug}, publisher = {PMLR}, pdf = {https://proceedings.mlr.press/v216/shahin-shamsabadi23a/shahin-shamsabadi23a.pdf}, url = {https://proceedings.mlr.press/v216/shahin-shamsabadi23a.html}, abstract = {Recent work has shown that an adversary can reconstruct training examples given access to the parameters of a deep learning image classification model. We show that the quality of reconstruction depends heavily on the type of activation functions used. In particular, we show that ReLU activations lead to much lower quality reconstructions compared to smooth activation functions. We explore if this phenomenon is a fundamental property of models with ReLU activations, or if it is a weakness of current attack strategies. We first study the training dynamics of small MLPs with ReLU activations and identify redundant model parameters that do not memorise training examples. Building on this, we propose our Mnemonist method, which is able to detect redundant model parameters, and then guide current attacks to focus on informative parameters to improve the quality of reconstructions of training examples from ReLU models.} }
Endnote
%0 Conference Paper %T Mnemonist: Locating Model Parameters that Memorize Training Examples %A Ali Shahin Shamsabadi %A Jamie Hayes %A Borja Balle %A Adrian Weller %B Proceedings of the Thirty-Ninth Conference on Uncertainty in Artificial Intelligence %C Proceedings of Machine Learning Research %D 2023 %E Robin J. Evans %E Ilya Shpitser %F pmlr-v216-shahin-shamsabadi23a %I PMLR %P 1879--1888 %U https://proceedings.mlr.press/v216/shahin-shamsabadi23a.html %V 216 %X Recent work has shown that an adversary can reconstruct training examples given access to the parameters of a deep learning image classification model. We show that the quality of reconstruction depends heavily on the type of activation functions used. In particular, we show that ReLU activations lead to much lower quality reconstructions compared to smooth activation functions. We explore if this phenomenon is a fundamental property of models with ReLU activations, or if it is a weakness of current attack strategies. We first study the training dynamics of small MLPs with ReLU activations and identify redundant model parameters that do not memorise training examples. Building on this, we propose our Mnemonist method, which is able to detect redundant model parameters, and then guide current attacks to focus on informative parameters to improve the quality of reconstructions of training examples from ReLU models.
APA
Shahin Shamsabadi, A., Hayes, J., Balle, B. & Weller, A.. (2023). Mnemonist: Locating Model Parameters that Memorize Training Examples. Proceedings of the Thirty-Ninth Conference on Uncertainty in Artificial Intelligence, in Proceedings of Machine Learning Research 216:1879-1888 Available from https://proceedings.mlr.press/v216/shahin-shamsabadi23a.html.

Related Material