Double-Dip: Thwarting Label-Only Membership Inference Attacks with Transfer Learning and Randomization

Transfer learning (TL) has been demonstrated to improve DNN model performance when faced with a scarcity of training samples. However, the suitability of TL as a solution to reduce vulnerability of overfitted DNNs to privacy attacks is unexplored. A class of privacy attacks called membership inference attacks (MIAs) aim to determine whether a given sample belongs to the training dataset (member) or not (nonmember). We introduce Double-Dip, a systematic empirical study investigating the use of TL (Stage-1) combined with randomization …

aim attacks called class cs.ai cs.cr cs.lg performance privacy randomization scarcity solution training transfer vulnerability