Deep learning models, while achieving remarkable performance across various tasks, are vulnerable to member inference attacks, wherein adversaries identify if a specific data point was part of a model's training set. This susceptibility raises substantial privacy concerns, especially when models are trained on sensitive datasets. Current defense methods often struggle to provide robust protection without hurting model utility, and they often require retraining the model or using extra data. In this work, we introduce a novel defense framework against membership attacks by leveraging generative models. The key intuition of our defense is to remove the differences between member and non-member inputs which can be used to perform membership attacks, by re-generating input samples before feeding them to the target model. Therefore, our defense works \emph{pre-inference}, which is unlike prior defenses that are either training-time (modify the model) or post-inference time (modify the model's output). A unique feature of our defense is that it works on input samples only, without modifying the training or inference phase of the target model. Therefore, it can be cascaded with other defense mechanisms as we demonstrate through experiments. Through extensive experimentation, we show that our approach can serve as a robust plug-n-play defense mechanism, enhancing membership privacy without compromising model utility in both baseline and defended settings. For example, our method enhanced the effectiveness of recent state-of-the-art defenses, reducing attack accuracy by an average of 5.7\% to 12.4\% across three datasets, without any impact on the model's accuracy. By integrating our method with prior defenses, we achieve new state-of-the-art performance in the privacy-utility trade-off.

翻译：深度学习模型虽在各类任务中表现出色，却易遭受成员推理攻击——攻击者能够判断特定数据点是否属于模型训练集。这种脆弱性引发了重大隐私担忧，尤其当模型在敏感数据集上训练时。现有防御方法往往难以在提供强力保护的同时不损害模型效用，且常需重新训练模型或使用额外数据。本研究提出一种新型成员攻击防御框架，通过利用生成模型实现防护。其核心思路在于：在将输入样本馈入目标模型前，通过再生方式消除可用于实施成员攻击的成员与非成员输入差异。因此，本防御机制作用于推理阶段之前，区别于以往训练阶段（修改模型）或推理后阶段（修改模型输出）的防御方案。本方法的独特之处在于仅作用于输入样本，无需修改目标模型的训练或推理阶段，故可与其他防御机制级联使用——实验验证了这一特性。通过广泛实验表明，本方法可作为鲁棒的即插即用防御机制，在基线设置与防御设置下均能在不牺牲模型效用的前提下增强成员隐私保护。例如，该方法能增强近期最先进防御的有效性，在三个数据集上将攻击准确率平均降低5.7%至12.4%，且对模型准确率无任何影响。通过将本方法与现有防御技术集成，我们在隐私-效用权衡中实现了新的最优性能。