Machine learning system, method, inference apparatus and computer-readable storage medium for resisting membership inference attacks

1 . A machine learning method, comprising:

a first learning phase for training parameters θ of a learning model f by performing machine learning using a first dataset as a training data with a correct answer label; and

a second learning phase for training parameters τ of a defender u and parameters ω of identifier h by performing machine learning using member data contained in the first dataset and non-member data contained in a second dataset, wherein the member data is used in the first learning phase and the non-member data is not used in the first learning phase;

in the second learning phase,

the member data or the non-member data is randomly selected as an input data,

the learning model f outputs a first output result when the member data or the non-member data is input to the learning model f as the input data,

the defender u modifies the first output result, and then outputs a second output result, wherein the defender performs defense processing the first output result so that an inference result for the member data is not distinguished from an inference result for the non-member data, and

the identifier h outputs an identification result identifying whether the input data is the member data or the non-member data based on the first output result or the second output result,

the second learning phase alternately performs,

a first step for updating the parameters ω of the identifier h using the identification result when a first input result and a second input result are input to the identifier h, and

a second step for updating the parameters τ of the defender u using the first output result, the second output result and the identification result.

2 . The machine learning method according to claim 1 , wherein in the first step,

the identifier h outputs the identification result based on the input data, the correct answer label and the first output result when the input data is the non-member data, and

the identifier h outputs the identification result based on the input data, the correct answer label and the second output result when the input data is the member data.

3 . The machine learning method according to claim 1 ,

wherein, in the first step, the parameters ω are updated such that the identifier h outputs a correct identification result from the first output result when the input data is the non-member data and the second output result when the input data is the member data, and

wherein, in the second step, the parameters τ are updated based on a loss function between the first output result and the second output result when the input data is the non-member data.

4 . The machine learning method according to claim 3 ,

wherein, in the second step, the parameters τ are updated such that the identifier h identifies the input data as the non-member data when the input data is the member data.

5 . A machine learning system, comprising:

a parameter learning unit configured to train parameters θ of a learning model f by performing machine learning using a first dataset as a training data with a correct answer label in a first learning phase;

a first update unit configured to update parameters τ of a defender u by performing machine learning using member data contained in the first dataset and non-member data contained in a second dataset in a second learning phase; and

a second update unit configured to update parameters ω of identifier h by performing machine learning using the member data contained in the first dataset and the non-member data contained in the second dataset in the second learning phase, wherein the member data is used in the first learning phase and the non-member data is not used in the first learning phase;

in the second learning phase,

the member data or the non-member data is randomly selected as an input data,

the learning model f outputs a first output result when the member data or the non-member data is input to the learning model f as the input data,

the defender u modifies the first output result, and then outputs a second output result, wherein the defender performs defense processing the first output result so that an inference result for the member data is not distinguished from an inference result for the non-member data, and

the identifier h outputs an identification result identifying whether the input data is the member data or the non-member data based on the first output result or the second output result,

the second learning phase alternately performs,

a first step for updating the parameters ω of the identifier h using the identification result when a first input result and a second input result are input to the identifier h, and

a second step for updating the parameters τ of the defender u using the first output result, the second output result and the identification result.

6 . The machine learning system according to claim 5 ,

wherein in the first step,

the identifier h outputs the identification result based on the input data, the correct answer label and the first output result when the input data is the non-member data, and

the identifier h outputs the identification result based on the input data, the correct answer label and the second output result when the input data is the member data.

7 . The machine learning system according to claim 5 ,

wherein, in the first step, the parameters ω are updated such that the identifier h outputs a correct identification result from the first output result when the input data is the non-member data and the second output result when the input data is the member data, and

wherein, in the second step, the parameters τ are updated based on a loss function between the first output result and the second output result when the input data is the non-member data.

8 . The machine learning system according to claim 7 ,

wherein, in the second step, the parameters τ are updated such that the identifier h identifies the input data as the non-member data when the input data is the member data.

9 . A non-transitory computer-readable storage medium storing a program that causes a computer to execute an inference method, the method comprising:

a first learning phase for training parameters θ of a learning model f by performing machine learning using a first dataset as a training data with a correct answer label; and

a second learning phase for training parameters τ of a defender u and parameters ω of identifier h by performing machine learning using member data contained in the first dataset and non-member data contained in a second dataset, wherein the member data is used in the first learning phase and the non-member data is not used in the first learning phase;

in the second learning phase,

the member data or the non-member data is randomly selected as an input data,

the learning model f outputs a first output result when the member data or the non-member data is input to the learning model f as the input data,

the defender u modifies the first output result, and then outputs a second output result, wherein the defender performs defense processing the first output result so that an inference result for the member data is not distinguished from an inference result for the non-member data, and

the identifier h outputs an identification result identifying whether the input data is the member data or the non-member data based on the first output result or the second output result,

the second learning phase alternately performs,

a first step for updating the parameters ω of the identifier h using the identification result when a first input result and a second input result are input to the identifier h; and

a second step for updating the parameters τ of the defender u using the first output result, the second output result and the identification result.