Privacy-preserving machine learning (PPML) enables multiple data owners to contribute their data privately to a set of servers that run a secure multi-party computation (MPC) protocol to train a joint ML model. In these protocols, the input data remains private throughout the training process, and only the resulting model is made available. While this approach benefits privacy, it also exacerbates the risks of data poisoning, where compromised data owners induce undesirable model behavior by contributing malicious datasets. Existing MPC mechanisms can mitigate certain poisoning attacks, but these measures are not exhaustive. To complement existing poisoning defenses, we introduce UTrace: a framework for User-level Traceback of poisoning attacks in PPML. Utrace computes user responsibility scores using gradient similarity metrics aggregated across the most relevant samples in an owner's dataset. UTrace is effective at low poisoning rates and is resilient to poisoning attacks distributed across multiple data owners, unlike existing unlearning-based methods. We introduce methods for checkpointing gradients with low storage overhead, enabling traceback in the absence of data owners at deployment time. We also design several optimizations that reduce traceback time and communication in MPC. We provide a comprehensive evaluation of UTrace across four datasets from three data modalities (vision, text, and malware) and show its effectiveness against 10 poisoning attacks.

翻译：隐私保护机器学习（PPML）允许多个数据所有者将其数据隐私地提交给一组服务器，这些服务器通过运行安全多方计算（MPC）协议来训练联合机器学习模型。在此类协议中，输入数据在整个训练过程中保持私密，仅最终生成的模型对外公开。虽然这种方法有利于隐私保护，但也加剧了数据投毒的风险——即被攻陷的数据所有者通过提交恶意数据集来诱导模型产生不良行为。现有的MPC机制能够缓解某些投毒攻击，但这些措施并非完备。为了补充现有的投毒防御手段，我们提出了UTrace：一种用于PPML中投毒攻击的用户级溯源框架。UTrace通过聚合数据所有者数据集中最相关样本的梯度相似性度量来计算用户责任分数。与现有的基于遗忘的方法不同，UTrace在低投毒率下依然有效，并且能够抵御分布在多个数据所有者之间的投毒攻击。我们提出了低存储开销的梯度检查点方法，使得在部署阶段数据所有者缺席时仍能进行溯源。我们还设计了多种优化方案以减少MPC中的溯源时间和通信开销。我们在涵盖三种数据模态（视觉、文本和恶意软件）的四个数据集上对UTrace进行了全面评估，并验证了其对10种投毒攻击的有效性。