Title: Theoretical Guarantees for Model Auditing with Finite Adversaries Show Chinese title

Title: 模型审计的理论保证与有限对手

Abstract: Privacy concerns have led to the development of privacy-preserving approaches for learning models from sensitive data. Yet, in practice, even models learned with privacy guarantees can inadvertently memorize unique training examples or leak sensitive features. To identify such privacy violations, existing model auditing techniques use finite adversaries defined as machine learning models with (a) access to some finite side information (e.g., a small auditing dataset), and (b) finite capacity (e.g., a fixed neural network architecture). Our work investigates the requirements under which an unsuccessful attempt to identify privacy violations by a finite adversary implies that no stronger adversary can succeed at such a task. We do so via parameters that quantify the capabilities of the finite adversary, including the size of the neural network employed by such an adversary and the amount of side information it has access to as well as the regularity of the (perhaps privacy-guaranteeing) audited model. Show Chinese abstract

Abstract: 隐私问题导致了从敏感数据中学习模型的隐私保护方法的发展。 然而，在实际中，即使具有隐私保证的模型也可能无意中记住独特的训练示例或泄露敏感特征。 为了识别此类隐私违规行为，现有的模型审计技术使用定义为具有（a）对某些有限辅助信息（例如，一个小的审计数据集）的访问权限，以及（b）有限能力（例如，固定的神经网络架构）的机器学习模型的有限对手。 我们的工作研究了在何种条件下，有限对手未能识别隐私违规尝试意味着没有更强的对手能够成功完成此类任务。 我们通过量化有限对手能力的参数来实现这一点，包括有限对手使用的神经网络的大小、它能访问的辅助信息量以及被审计模型（可能是具有隐私保证的模型）的规则性。