NEXUS: Neuron Activation Scores Exploits for Unveiling Sensitive Attributes
摘要
Neural network models have been widely used to make critical decisions across diverse applications. However, these models are susceptible to inference attacks that can expose sensitive information such as gender, race, and other personal attributes from the private data used during training. We focus on a particular variant of this attack, known as sensitive value inference, where the adversary aims to reliably pinpoint records within a candidate pool that possess a specific value for the sensitive attribute. We exploit neuron activation values to frame this attack, to infer sensitive attributes. The attack is based on the observation that some neurons are strongly correlated with specific sensitive attribute values in the input. After identifying the most important neurons, the attacker selects the top-k and uses their activation values to train an attack model that can predict the sensitive attribute. We construct the attack based on two distinct threat scenarios: (a) where the model creator incorporates sensitive attributes in both the training data and model inputs, and (b) where these sensitive attributes are intentionally excluded from both the training data and input to censor them. We evaluated our attack on the COMPAS, CENSUS, and Texas-100x, and UCI credit card datasets. It is observed that the proposed attack achieves an inference precision of \(72\%\) when the sensitive attribute is omitted from the training data, and this precision increases to \(93\%\) when the sensitive attribute is included during training.