Key Protected Classification for GAN Attack Resilient Collaborative Learning
Large-scale publicly available datasets play a fundamental role in training deep learning models. However, large-scale datasets are difficult to collect in problems that involve processing of sensitive information. Collaborative learning techniques provide a privacy-preserving solution in such cases, by enabling training over a number of private datasets that are not shared by their owners. Existing collaborative learning techniques, combined with differential privacy, are shown to be resilient against a passive adversary which tries to infer the training data only from the model parameters. However, recently, it has been shown that the existing collaborative learning techniques are vulnerable to an active adversary that runs a GAN attack during the learning phase. In this work, we propose a novel key-based collaborative learning technique that is resilient against such GAN attacks. For this purpose, we present a collaborative learning formulation in which class scores are protected by class-specific keys, and therefore, prevents a GAN attack. We also show that very high dimensional class-specific keys can be utilized to improve robustness against attacks, without increasing the model complexity. Our experimental results on two popular datasets, MNIST and AT&T Olivetti Faces, demonstrate the effectiveness of the proposed technique against the GAN attack. To the best of our knowledge, the proposed approach is the first collaborative learning formulation that effectively tackles an active adversary, and, unlike model corruption or differential privacy formulations, our approach does not inherently feature a trade-off between model accuracy and data privacy.
 This paper is a follow-up work to the CCS*2017 paper on the GAN-based attack on collaborative learning system where multiple users contribute their private and sensitive data to joint learning tasks. In order to avoid the potential risk of adversary*s mimic based on information flow among distributed users, the authors propose to embed the class label into a multi-dimensional space, such that the joint learning is conducted over the embedding space without knowing the accurate representation of the classes. Under the assumption that the adversary can only generate fake and random class representations, they show their scheme is capable of hiding information from individual samples, especially over image data. The paper is clearly written and easy to understand. The experiments show interesting results, which are particularly impressive with the face data. However, the reviewer feels the assumption on the adversary is generally too weak, such that slightly smarter adversary could circumvent the protection scheme and remain effective on sample recovery. Basically, instead of randomly guessing the representations of the classes from other innocent users, the adversary could apply GAN to learn the representation based on the feedback from these users. This can be easily done by including the representations in the embedding space in the parameters in GAN for learning. This paper could be an interesting work, if the authors address such enhanced attacks from the adversary and present protection results over their existing experimental settings.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Key Protected Classification for GAN Attack Resilient Collaborative Learning
Large-scale publicly available datasets play a fundamental role in training deep learning models. However, large-scale datasets are difficult to collect in problems that involve processing of sensitive information. Collaborative learning techniques provide a privacy-preserving solution in such cases, by enabling training over a number of private datasets that are not shared by their owners. Existing collaborative learning techniques, combined with differential privacy, are shown to be resilient against a passive adversary which tries to infer the training data only from the model parameters. However, recently, it has been shown that the existing collaborative learning techniques are vulnerable to an active adversary that runs a GAN attack during the learning phase. In this work, we propose a novel key-based collaborative learning technique that is resilient against such GAN attacks. For this purpose, we present a collaborative learning formulation in which class scores are protected by class-specific keys, and therefore, prevents a GAN attack. We also show that very high dimensional class-specific keys can be utilized to improve robustness against attacks, without increasing the model complexity. Our experimental results on two popular datasets, MNIST and AT&T Olivetti Faces, demonstrate the effectiveness of the proposed technique against the GAN attack. To the best of our knowledge, the proposed approach is the first collaborative learning formulation that effectively tackles an active adversary, and, unlike model corruption or differential privacy formulations, our approach does not inherently feature a trade-off between model accuracy and data privacy.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



 This paper is a follow-up work to the CCS*2017 paper on the GAN-based attack on collaborative learning system where multiple users contribute their private and sensitive data to joint learning tasks. In order to avoid the potential risk of adversary*s mimic based on information flow among distributed users, the authors propose to embed the class label into a multi-dimensional space, such that the joint learning is conducted over the embedding space without knowing the accurate representation of the classes. Under the assumption that the adversary can only generate fake and random class representations, they show their scheme is capable of hiding information from individual samples, especially over image data. The paper is clearly written and easy to understand. The experiments show interesting results, which are particularly impressive with the face data. However, the reviewer feels the assumption on the adversary is generally too weak, such that slightly smarter adversary could circumvent the protection scheme and remain effective on sample recovery. Basically, instead of randomly guessing the representations of the classes from other innocent users, the adversary could apply GAN to learn the representation based on the feedback from these users. This can be easily done by including the representations in the embedding space in the parameters in GAN for learning. This paper could be an interesting work, if the authors address such enhanced attacks from the adversary and present protection results over their existing experimental settings.
assistant
 This paper is a follow-up work to the CCS*2017 paper on the GAN-based attack on collaborative learning system where multiple users contribute their private and sensitive data to joint learning tasks. In order to avoid the potential risk of adversary*s mimic based on information flow among distributed users, the authors propose to embed the class label into a multi-dimensional space, such that the joint learning is conducted over the embedding space without knowing the accurate representation of the classes. Under the assumption that the adversary can only generate fake and random class representations, they show their scheme is capable of hiding information from individual samples, especially over image data. The paper is clearly written and easy to understand. The experiments show interesting results, which are particularly impressive with the face data. However, the reviewer feels the assumption on the adversary is generally too weak, such that slightly smarter adversary could circumvent the protection scheme and remain effective on sample recovery. Basically, instead of randomly guessing the representations of the classes from other innocent users, the adversary could apply GAN to learn the representation based on the feedback from these users. This can be easily done by including the representations in the embedding space in the parameters in GAN for learning. This paper could be an interesting work, if the authors address such enhanced attacks from the adversary and present protection results over their existing experimental settings.