Derin Öğrenme Modellerinde Mahremiyet ve Güvenlik Üzerine Bir Derleme Çalışması

Abstract

Son dönemlerde derin öğrenmedeki devrim niteliğindeki gelişmeler ile birlikte yapay zekaya yönelik beklentiler gün geçtikçe artmaktadır. Konuşma tanıma, doğal dil işleme (NLP), görüntü işleme gibi birçok alanda etkin bir şekilde uygulanabilen bir araştırma alanı olan derin öğrenme klasik makine öğrenmesi ile karşılaştırıldığında daha yüksek başarı göstermektedir. Derin öğrenme ile geliştirilen modellerde eğitim ve tahminleme sırasında büyük miktarda veri kullanılmakta ve kullanılan veriler kişisel verilerden oluşabilmektedir. Bu verilerin işlenmesi sırasında kişisel verilerin korunması kanununa (KVKK) aykırı olmaması oldukça önemlidir. Bu nedenle verilerin gizliliği ve güvenliğinin sağlanması oldukça önemli bir husustur. Bu çalışmada, derin öğrenme modelleri geliştirilirken yaygın kullanılan mimariler verilmiştir. Verilerin gizliliği ve güvenliğini artırmak için literatürde yaygın olarak karşılaşılan güvenli çok partili hesaplama, diferansiyel mahremiyet, garbled devre protokolü ve homomorfik şifreleme araçları özetlenmiştir. Çeşitli sistem tasarımlarında kullanılan bu araçların yer aldığı güncel çalışmalar taranmıştır. Bu çalışmalar, derin öğrenme modelinin eğitim ve tahminleme aşamasında olmak üzere iki kategoride incelenmiştir. Literatürdeki çeşitli modeller üzerinde uygulanabilen güncel saldırılar ve bu saldırılardan korunmak amacıyla geliştirilen yöntemler verilmiştir. Ayrıca, güncel araştırma alanları belirlenmiştir. Buna göre, gelecekteki araştırma yönü kriptografik temelli yöntemlerin karmaşıklığının azaltılması ve geliştirilen modelin güvenilirliğini belirlemek için çeşitli ölçme ve değerlendirme yöntemlerinin geliştirilmesi yönünde olabilir.

Keywords

• Derin Öğrenme
• Güvenli Çok Partili Hesaplama
• Diferansiyel Mahremiyet
• Homomorfik Şifreleme
• Garbled Devreler Protokolü

A Review Study on Privacy and Security in Deep Learning Models

Abstract

With the advanced progress in deep learning in recent times, expectations of artificial intelligence are increasing day by day. Deep Learning, a research area, applied effectively in many areas such as speech recognition, Natural Language Processing (NLP), and image processing, shows higher success than classical machine learning algorithms. Large amounts of data are employed during the training and prediction stages of deep learning models, in which the data may consist of the user's sensitive data. Therefore, it mustn't contradict the principle of protecting personal data while training and predicting. Consequently, it is crucial to ensure the privacy and security of data. In this study, various deep learning architectures are described. The widely used cryptographic tools applied to preserve the privacy and security of data are summarized. These are homomorphic encryption, differential privacy, secure multi-party computation, and garbled circuits. Recent works considering the privacy and security of deep learning models are examined under two different categories: train stage and prediction stage. In addition, the attacks against deep learning models and techniques for protection against these attacks are reviewed. Finally, open research areas are determined. Reducing the complexity of cryptographic-based models and developing evaluation methods to determine the model's privacy and security stand out as future research areas.

Keywords

• Deep learning
• Secure multiparty computation
• Differential privacy
• Homomorphic encryption
• Garbled circuits protocol

References

1. [1] Y. Kim, “Convolutional neural networks for sentence classification,” Conference on Empirical Methods in Natural Language Processing, Proceedings of the Conference, 2014, ss.1746–1751.
2. [2] O. Ronneberger, P. Fischer ve T. Brox, “U-net: Convolutional networks for biomedical image segmentation,” International Conference on Medical Image Computing And Computer-Assisted Intervention, 2015, ss. 234-241.
3. [3] P. Pan, Z. Xu, Y. Yang, F. Wu ve Y. Zhuang, “Hierarchical recurrent neural encoder for video representation with application to captioning,” Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2016, ss. 1029-1038.
4. [4] G. Parascandolo, H. Huttunen, ve T. Virtanen, “Recurrent neural networks for polyphonic sound event detection in real life recordings,”, IEEE International Conference on Acoustics, Speech and Signal Processing - Proceedings, 2016, ss. 6440-6444.
5. [5] Z. Cai, Q. Fan, R. S. Feris, ve N. Vasconcelos, “A unified multi-scale deep concutional neural network for fast object detection,” n European conference on computer vision, 2016, ss. 354-370.
6. [6] S. E. Kahou, V. Michalski, K. Konda, R. Memisevic, ve C. Pal, “Recurrent neural networks for emotion recognition in video”, Proceedings of the 2015 ACM International Conference on Multimodal Interaction, 2015, ss. 467-474.
7. [7] T. Hughes ve K. Mierle, “Recurrent neural networks for voice activity detection”, IEEE International Conference on Acoustics, Speech and Signal Processing, 2013, ss. 7378-7382.
8. [8] B. Alipanahi, A. Delong, M. T. Weirauch ve B. J. Frey, “Predicting the sequence specificities of DNA- and RNA-binding proteins by deep learning,” Nature Biotechnology, c. 33, s. 8, ss. 831-838, 2015.

9. [9] R. Xu, D. C. Wunsch ve R. L. Frank, “Inference of genetic regulatory networks with recurrent neural network models using particle swarm optimization,” IEEE/ACM Transactions on Computational Biology and Bioinformatics, c. 4, s. 4, ss. 681-692, 2007.
10. [10] M. Auli, M. Galley, C. Quirk, ve G. Zweig, “Joint language and translation modeling with recurrent neural networks” Conference on Empirical Methods in Natural Language Processing, 2013, ss.1044-1054.
11. [11] S. Lai, L. Xu, K. Liu ve J. Zhao, “Recurrent concutional neural networks for text classification,” Proceedings of the AAAI Conference on Artificial Intelligence, c. 29, s. 1, ss. 2267–2273, 2015.
12. [12] S. Hochreiter ve J. Schmidhuber, “Long Short-Term Memory,” Neural Computation, c. 9, s. 8, ss. 1735-1780, 1997.
13. [13] I. J. Goodfellow, J.P. Abadie, M. Mirza, B. Xu, D.W.Farley, S. Ozair, A. Courville ve Y. Bengio., “Generative adversarial nets,” Advances in Neural Information Processing Systems, 2014, ss. 2672– 2680.
14. [14] Y. Choi, M. Choi, M. Kim, J. W. Ha, S. Kim, ve J. Choo, “StarGAN: Unified Generative Adversarial Networks for Multi-domain Image-to-Image Translation,” Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2018, ss. 8789-8797.
15. [15] A. Ghosh, V. Kulharia, V. Namboodiri, P. H. S. Torr, ve P. K. Dokania, “Multi-agent Diverse Generative Adversarial Networks,” Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2018, ss. 8513-8521.
16. [16] A. Gupta, J. Johnson, L. Fei-Fei, S. Savarese, ve A. Alahi, “Social GAN: Socially Acceptable Trajectories with Generative Adversarial Networks,” Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2018, ss. 2255-2264.
17. [17] F. Lau, T. Hendriks, J. Lieman-Sifry, B. Norman, S. Sall, ve D. Golden, “ScarGAN: Chained generative adversarial networks to simulate pathological tissue on cardiovascular MR scans,” Deep Learning In Medical Image Analysis And Multimodal Learning For Clinical Decision Support, ss. 343-350, 2018.
18. [18] A. Beers, J. Brown, K. Chang, J. P. Campbell, S. Ostmo, M. F. Chiang ve J. Kalpathy-Cramer, “High-resolution medical image synthesis using progressively grown generative adversarial networks,” arXiv: 1805.03144, 2018.
19. [19] M. O. Rabin, “How to exchange secrets with oblivious transfer”, IACR Cryptol. ePrint Arch., c. 2005, s. 187, 2005.
20. [20] F. Bruekers, S. Katzenbeisser, K. Kursawe, ve P. Tuyls, “Privacy-Preserving Matching of DNA Profiles.,” IACR Cryptol. ePrint Arch., c. 2008, s. 203, 2008. [21] A. C. C. Yao, “How to Generate and Exchange Secrets.,” Annual Symposium on Foundations of Computer Science, 1986, ss. 162-167.
21. [22] V. Kolesnikov, A. R. Sadeghi, ve T. Schneider, “Improved garbled circuit building blocks and applications to auctions and computing minima,”, International Conference on Cryptology and Network Security, Berlin, Heidelberg, 2009, ss. 1-20.
22. [23] S. Jarecki ve V. Shmatikov, “Efficient two-party secure computation on committed inputs,” Annual International Conference on the Theory and Applications of Cryptographic Techniques, Berlin, Heidelberg, 2007, ss. 97-114.
23. [24] A. C. Yao, “Protocols for secure computations”, 23rd Annual Symposium on Foundations of Computer Science, 1982, ss. 160-164.
24. [25] R. Shokri ve V. Shmatikov, “Privacy-preserving deep learning,” Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, 2015, ss. 1310-1321.
25. [26] M. Chase, R. Gilad-Bachrach, K. Laine, K. Lauter ve P. Rindal, “Private collaborative neural network learning,” IACR Cryptol. ePrint Arch., c. 2017, s. 762, 2017.
26. [27] M. Gong, J. Feng ve Y. Xie, “Privacy-enhanced multi-party deep learning,” Neural Networks, c. 121, ss. 484-496, 2020.
27. [28] Y. Lindell, “Secure multiparty computation for privacy preserving data mining,” Encyclopedia of Data Warehousing and Mining, ss. 1005-1009, 2011.
28. [29] M. Ben-Or, S. Goldwasser ve A. Wigderson, “Completeness theorems for non-cryptographic fault-tolerant distributed computation,” Proceedings of the Annual ACM Symposium on Theory of Computing, ss. 351-371, 1988.
29. [30] C. Dwork, “Differential privacy: A survey of results,” International conference on theory and applications of models of computation, Berlin, Heidelberg, 2006, ss. 1-19.
30. [31] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar ve L. Zhang “Deep learning with differential privacy,” Proceedings of SIGSAC conference on computer and communications security, ss. 308-318, 2016.
31. [32] C. Dwork, K. Talwar, A. Thakurta ve L. Zhang, “Analyze Gauss: Optimal bounds for privacy-preserving principal component analysis,” Proceedings of the forty-sixth annual ACM symposium on Theory of computing, ss. 11-20, 2014.
32. [33] B. K. Beaulieu-Jones, Z. S. Wu, C. Williams, R. Lee, S. P. Bhavnani, J. B. Byrd ve C. S. Greene, “Privacy-preserving generative deep neural networks support clinical data sharing,” Circulation: Cardiovascular Quality and Outcomes, c. 12, s. 7, 2019.
33. [34] K. Chaudhuri, C. Monteleoni, ve A. D. Sarwate, “Differentially private empirical risk minimization,” Journal of Machine Learning Research, c. 12, s. 3, 2011.
34. [35] C. Boura, N. Gama, M. Georgieva, ve D. Jetchev, “Simulating homomorphic evaluation of deep learning predictions”, International Symposium on Cyber Security Cryptography and Machine Learning, Cham, 2019, ss. 212-230.
35. [36] K. Nandakumar, N. Ratha, S. Pankanti, ve S. Halevi, “Towards deep neural network training on encrypted data,” IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2019.
36. [37] A. Tran, T. Luong, J. Karnjana ve V. Huynh, “Neurocomputing An efficient assroach for privacy preserving decentralized deep learning models based on secure multi-party computation,” Neurocomputing, c. 422, ss. 245-262, 2021.
37. [38] D. Syed ve S. S. Refaat, “Privacy Preservation of Data-Driven Models in Smart Grids Using Homomorphic Encryption”, Information, c. 11, s. 7, ss. 1–17, 2020.
38. [39] B. D. Rouhani, M. S. Riazi ve F. Koushanfar, “DeepSecure: Scalable provably-secure deep learning,” Proceedings of the 55th Annual Design Automation Conference, 2018, ss. 1-6.
39. [40] N. Dowlin, R. Gilad-Bachrach, K. Laine, K. Lauter, M. Naehrig ve J. Wernsing, “Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy,”, 33rd International Conference on Machine Learning, ICML, 2016, ss. 201-210.
40. [41] P. Xie, B. Wu ve G. Sun, “Bayhenn: Combining Bayesian deep learning and homomorphic encryption for secure DNN inference,”, IJCAI International Joint Conference on Artificial Intelligence, 2019.
41. [42] M. S. Riazi, M. Samragh, H. Chen, K. Laine, K. Lauter ve F. Koushanfar, “XONN: XNOR-based oblivious deep neural network inference,”28th {USENIX} Security Symposium ({USENIX} Security 19), 2019, ss. 1501-1518.
42. [43] K. Bittner, M. De Cock ve R. Dowsley, “Private Speech Characterization with Secure Multiparty Computation,” arXiv:2007.00253, ss. 1–40, 2020.
43. [44] C. Orlandi, A. Piva ve M. Barni “Oblivious neural network computing via homomorphic encryption”, EURASIP Journal on Information Security, ss. 1-11, 2007.
44. [45] A. Shafahi, W.R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras ve T. Goldstein, “Poison frogs! Targeted clean-label poisoning attacks on neural networks,” Advances in Neural Information Processing Systems, 2018.
45. [46] S. Baluja ve I. Fischer, “Adversarial transformation networks: Learning to generate adversarial examples,” arXiv: 1703.09387, 2017.
46. [47] D. Gragnaniello, F. Marra, G. Poggi ve L. Verdoliva, “Perceptual quality-preserving black-box attack against deep learning image classifiers,” arXiv: 1902.07776, 2019.
47. [48] Y. Li, L. Li, L. Wang, T. Zhang ve B. Gong, “N Attack: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks,” 36th International Conference on Machine Learning, 2019, ss. 3866-3876.
48. [49] J. Steinhardt, P. W. Koh ve P. Liang, “Certified defenses for data poisoning attacks” Advances in Neural Information Processing Systems, 2017.
49. [50] A. Paudice, L. Muñoz-González, A. György ve E. C. Lupu, “Detection of adversarial training examples in poisoning attacks through anomaly detection,” arXiv: 1802.03041, 2018.
50. [51] F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh ve P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” arXiv: 1705.07204, 2017.
51. [52] J. Buckman, A. Roy, C. Raffel ve I. Goodfellow, “Thermometer encoding: One hot way to resist adversarial examples,” 6th International Conference on Learning Representations, 2018.