Machine learning (ML) models are vulnerable to membership inference attacks (MIAs), which determine whether a given input is used for training the target model. While there have been many efforts to mitigate MIAs, they often suffer from limited privacy protection, large accuracy drop, and/or requiring additional data that may be difficult to acquire. This work proposes a defense technique, HAMP that can achieve both strong membership privacy and high accuracy, without requiring extra data. To mitigate MIAs in different forms, we observe that they can be unified as they all exploit the ML model's overconfidence in predicting training samples through different proxies. This motivates our design to enforce less confident prediction by the model, hence forcing the model to behave similarly on the training and testing samples. HAMP consists of a novel training framework with high-entropy soft labels and an entropy-based regularizer to constrain the model's prediction while still achieving high accuracy. To further reduce privacy risk, HAMP uniformly modifies all the prediction outputs to become low-confidence outputs while preserving the accuracy, which effectively obscures the differences between the prediction on members and non-members. We conduct extensive evaluation on five benchmark datasets, and show that HAMP provides consistently high accuracy and strong membership privacy. Our comparison with seven state-of-the-art defenses shows that HAMP achieves a superior privacy-utility trade off than those techniques.

翻译：机器学习模型易受成员推理攻击（MIAs），该类攻击可判定给定输入是否用于训练目标模型。尽管已有诸多防御措施，但常存在隐私保护效果有限、精度显著下降及/或需额外数据而难以获取等问题。本文提出一种无需额外数据即可同时实现强成员隐私保护与高精度的防御技术HAMP。为抵御不同形式的MIAs，我们观察到这些攻击均通过不同代理指标利用模型对训练样本的过度自信进行预测，这促使我们设计强制模型降低预测置信度的方法，使模型对训练样本与测试样本的预测行为趋于一致。HAMP包含一个创新训练框架：采用高熵软标签结合基于熵的正则化器，在约束模型预测的同时保持高精度。为进一步降低隐私风险，HAMP在保持精度的前提下统一将预测输出修改为低置信度输出，有效模糊成员与非成员样本的预测差异。我们在五个基准数据集上的全面评估表明，HAMP能持续兼顾高精度与强成员隐私保护。与七种最先进防御技术的对比显示，HAMP实现了优于这些技术的隐私-效用权衡。