4-8 bit quantized DNNs stay exposed to membership inference
Original title: Revisiting Privacy Risks in Quantized Deep Neural Networks
Eight attacks across six quantization methods find privacy gains mainly at 2 bits, with large utility loss.
A study measures membership-inference risk in quantized deep neural networks using eight attacks and six quantization methods. Practical 4-8 bit models remain about as vulnerable as full-precision counterparts. Two-bit quantization can reduce risk but substantially hurts utility. Full-precision privacy defenses add little protection on quantized models and further degrade accuracy. Code and datasets are public.
- Eight state-of-the-art membership-inference attacks were evaluated.
- Six representative quantization methods were included.
- Two-bit quantization is the setting that showed meaningful privacy gains.
- Existing full-precision defenses give limited extra protection on quantized models.
From the original article
1 min read at arxiv.orgModel quantization has become a fundamental technique for enabling the efficient deployment of large-scale deep neural networks (DNNs) in data-intensive applications by reducing model size. Despite its widespread adoption, the impact of quantization on training data privacy --- particularly vulnerability to membership inference attacks (MIAs) --- remains largely unexplored.
By Jie Fu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.