Abstract:High-quality private machine learning (ML) data stored in local data centers becomes a key competitive factor for AI corporations. In this paper, we present a novel insider attack called Matryoshka to reveal the possibility of breaking the privacy of ML data even with no exposed interface. Our attack employs a scheduled-to-publish DNN model as a carrier model for covert transmission of secret models which memorize the information of private ML data that otherwise has no interface to the outsider. At the core of our attack, we present a novel parameter sharing approach which exploits the learning capacity of the carrier model for information hiding. Our approach simultaneously achieves: (i) High Capacity - With almost no utility loss of the carrier model, Matryoshka can transmit over 10,000 real-world data samples within a carrier model which has 220× less parameters than the total size of the stolen data, and simultaneously transmit multiple heterogeneous datasets or models within a single carrier model under a trivial distortion rate, neither of which can be done with existing steganography techniques; (ii) Decoding Efficiency - once downloading the published carrier model, an outside colluder can exclusively decode the hidden models from the carrier model with only several integer secrets and the knowledge of the hidden model architecture; (iii) Effectiveness - Moreover, almost all the recovered models either have similar performance as if it is trained independently on the private data, or can be further used to extract memorized raw training data with low error; (iv) Robustness - Information redundancy is naturally implemented to achieve resilience against common post-processing techniques on the carrier before its publishing; (v) Covertness - A model inspector with different levels of prior knowledge could hardly differentiate a carrier model from a normal model.

ArchNet: A data hiding design for distributed machine learning systems

ArchNet: Data Hiding Model in Distributed Machine Learning System

GELU-Net: A Globally Encrypted, Locally Unencrypted Deep Neural Network for Privacy-Preserved Learning.

CHEETAH: An Ultra-Fast, Approximation-Free, and Privacy-Preserved Neural Network Framework based on Joint Obscure Linear and Nonlinear Computations

Industrial Scale Privacy Preserving Deep Neural Network

Optimization of a Deep Learning Algorithm for Security Protection of Big Data from Video Images

Crypto-Nets: Neural Networks over Encrypted Data

Human-imperceptible, Machine-recognizable Images

NeuraCrypt: Hiding Private Health Data via Random Neural Networks for Public Training

2P-DNN : Privacy-Preserving Deep Neural Networks Based on Homomorphic Cryptosystem

Towards Scalable and Privacy-Preserving Deep Neural Network via Algorithmic-Cryptographic Co-design

Reversible Data Hiding in Encrypted Images Based on a Multi-Granularity Adaptive Classification Mechanism.

DeepEDN: A Deep-Learning-Based Image Encryption and Decryption Network for Internet of Medical Things

Demystifying Arch-hints for Model Extraction: An Attack in Unified Memory System

Novel asymmetric CNN-based and adaptive mean predictors for reversible data hiding in encrypted images

A novel image encryption algorithm with deep neural network

Toward Scalable and Privacy-preserving Deep Neural Network Via Algorithmic-Cryptographic Co-design

Data Security Utilizing a Memristive Coupled Neural Network in 3D Models

Arch-Net: Model Distillation for Architecture Agnostic Model Deployment

Matryoshka: Exploiting the Over-Parametrization of Deep Learning Models for Covert Data Transmission

Adversarial Data Encryption