Defense Against Membership Inference Attacks via Normalizing Flow-Based Adversarial Sample

Abstract

An attacker can determine if a specific input belongs to a deep learning model’s training set by analyzing the complete confidence vector output, known as a membership inference attack. To counter this type of attack, a common defense strategy is to add adversarial noise to the confidence vector to enhance the model’s resilience. However, existing research indicates that defenses against adversarial examples may introduce new security risks to membership inference defenses via adversarial examples. Against this backdrop, this paper proposes a more robust adversarial example defense strategy. By generating adversarial examples with distributions similar to normal samples, we can reduce the impact of distributional differences on the defense model’s security. Leveraging normalizing flow, adding noise to the hidden layer of a flow model trained on normal samples generates adversarial examples that resemble normal ones, enhancing defense robustness. Additionally, limiting the information accessible to the attack model further strengthens robustness. To accelerate convergence, a bidirectional mean update method is employed. The proposed strategy demonstrates effectiveness not only in defending against membership inference attacks but also in mitigating attribute inference attacks. Finally, experiments on real-world datasets validate the effectiveness of the proposed strategy.