mlsanityData to 14 Oct 2026

Verification of Neural Networks Local Differential Classification Privacy

arXiv 2310.20299 ↗First posted 31 Oct 2023cs.LG cs.CR cs.LOcited by 0

Not on the map. Why?

Abstract (arXiv)

Neural networks are susceptible to privacy attacks. To date, no verifier can reason about the privacy of individuals participating in the training set. We propose a new privacy property, called local differential classification privacy (LDCP), extending local robustness to a differential privacy setting suitable for black-box classifiers. Given a neighborhood of inputs, a classifier is LDCP if it classifies all inputs the same regardless of whether it is trained with the full dataset or whether any single entry is omitted. A naive algorithm is highly impractical because it involves training a very large number of networks and verifying local robustness of the given neighborhood separately for every network. We propose Sphynx, an algorithm that computes an abstraction of all networks, with a high probability, from a small set of networks, and verifies LDCP directly on the abstract network. The challenge is twofold: network parameters do not adhere to a known distribution probability, making it difficult to predict an abstraction, and predicting too large abstraction harms the verification. Our key idea is to transform the parameters into a distribution given by KDE, allowing to keep the over-approximation error small. To verify LDCP, we extend a MILP verifier to analyze an abstract network. Experimental results show that by training only 7% of the networks, Sphynx predicts an abstract network obtaining 93% verification accuracy and reducing the analysis time by 1.7·104x.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 49 of its 76 references that are in the map. First posted on arXiv 31 Oct 2023.

Builds on

49 of 76 references.

References · 49

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2013Intriguing properties of neural networkscited by 5,155
  3. 2016Deep Learning with Differential Privacycited by 2,728
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  5. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 744
  6. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  7. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  8. 2020Label-Only Membership Inference Attackscited by 388
  9. 2018Certified Defenses against Adversarial Examplescited by 306
  10. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 248
  11. 2017Formal Verification of Piece-Wise Linear Feed-Forward Neural Networkscited by 242
  12. 2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 228
37 more
  1. 2020Membership Leakage in Label-Only Exposurescited by 168
  2. 2018Efficient Formal Safety Analysis of Neural Networkscited by 165
  3. 2018A Dual Approach to Scalable Verification of Deep Networkscited by 125
  4. 2019A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networkscited by 125
  5. 2019Deep Learning with Gaussian Differential Privacycited by 114
  6. 2014Preserving Statistical Validity in Adaptive Data Analysiscited by 103
  7. 2018Understanding Membership Inferences on Well-Generalized Learning Modelscited by 90
  8. 2015Algorithmic Stability for Adaptive Data Analysiscited by 88
  9. 2015Generalization in Adaptive Data Analysis and Holdout Reusecited by 83
  10. 2020Verification of Deep Convolutional Neural Networks Using ImageStarscited by 75
  11. 2020Learning Certified Individually Fair Representationscited by 69
  12. 2019An Abstraction-Based Framework for Neural Network Verificationcited by 68
  13. 2020Learn to Forget: Machine Unlearning via Neuron Maskingcited by 62
  14. 2018CNN-Cert: An Efficient Framework for Certifying Robustness of Convolutional Neural Networkscited by 50
  15. 2020Verifying Individual Fairness in Machine Learning Modelscited by 49
  16. 2019Local Differential Privacy for Deep Learningcited by 46
  17. 2018Probabilistic Verification of Fairness Properties via Concentrationcited by 45
  18. 2018Beyond One-hot Encoding: lower dimensional target embeddingcited by 43
  19. 2020Scaling Polyhedral Neural Network Verification on GPUscited by 43
  20. 2019Perfectly Parallel Fairness Certification of Neural Networkscited by 42
  21. 2019Optimization and Abstraction: A Synergistic Approach for Analyzing Neural Network Robustnesscited by 40
  22. 2020Parallelization Techniques for Verifying Neural Networkscited by 36
  23. 2014Preventing False Discovery in Interactive Data Analysis is Hardcited by 34
  24. 2020Abstraction based Output Range Analysis for Neural Networkscited by 34
  25. 2020DeepAbstract: Neural Network Abstraction for Accelerating Verificationcited by 31
  26. 2020Improving Deep Learning with Differential Privacy using Gradient Encoding and Denoisingcited by 30
  27. 2017Generalization for Adaptively-chosen Estimators via Stable Mediancited by 26
  28. 2021Formalizing Generalization and Robustness of Neural Networks to Weight Perturbationscited by 22
  29. 2021Certifying Robustness to Programmable Data Bias in Decision Treescited by 21
  30. 2020Scalable Polyhedral Verification of Recurrent Neural Networkscited by 20
  31. 2018The Limits of Post-Selection Generalizationcited by 16
  32. 2019Verification of Non-Linear Specifications for Neural Networkscited by 14
  33. 2020Abstract Neural Networkscited by 11
  34. 2019Guaranteed Validity for Empirical Approaches to Adaptive Data Analysiscited by 7
  35. 2022Verifying Neural Networks Against Backdoor Attackscited by 5
  36. 2022A Mixed Integer Programming Approach for Verifying Properties of Binarized Neural Networkscited by 3
  37. 2022VPN: Verification of Poisoning in Neural Networkscited by 2

Built on by

Not cited yet.