Deep ensemble learning aims to improve the classification accuracy by training several neural networks and fusing their outputs. It has been widely shown to improve accuracy. At the same time, ensemble learning has also been proposed to mitigate privacy leakage in terms of membership inference (MI), where the goal of an attacker is to infer whether a particular data sample has been used to train a target model . In this paper, we show that these two goals of ensemble learning, namely improving accuracy and privacy , directly conflict with each other . Using a wide range of datasets and model architectures, we empirically demonstrate the trade-off between privacy and accuracy in deep ensemble learning. We find that ensembling can improve either privacy or accuracy, but not both simultaneously -- when ensembling improves the classification accuracy, the effectiveness of the MI attack also increases. We analyze various factors that contribute to such privacy leakage in ensembling such as prediction confidence and agreement between models that constitute the ensemble. Our evaluation of defenses against MI attacks , such as regularization and differential privacy , shows that they can mitigate the effectiveness of the MI attackbut simultaneously degrade ensemble accuracy. The source code is available at URL
Deep ensemble learning has been shown to improve accuracy by training multiple neural networks and fusing their outputs. Ensemble learning has also been used to defend against membership inference attacks that undermine privacy . In this paper, we empirically demonstrate a trade-off between these two goals , namely accuracy and privacy (in terms of membership inference attacks), in deep ensembles . Using a wide range of datasets and model architectures, we show that the effectiveness of membership inference attacks also increases when ensembling improves accuracy. To better understand this trade-off, we study the impact of various factors such as prediction confidence and agreement between models that constitute the ensemble. Finally, we evaluate defenses against membership inference attacks based on regularization and differential privacy . We show that while these defenses can mitigate the effectiveness of the membership inference attack, they simultaneously degrade ensemble accuracy. The source code is available at URL
R
aims to improve the classification
has been shown to improve
R
several
multiple
R
It has been widely shown to improve accuracy. At the same time, ensemble
Ensemble
R
proposed to mitigate privacy leakage in terms of membership inference (MI), where the goal of an attacker is to infer whether a particular data sample has been used to train a target model
used to defend against membership inference attacks that undermine privacy
R
show that
empirically demonstrate a trade-off between
R
of ensemble learning, namely improving
, namely
R
, directly conflict with each other
(in terms of membership inference attacks), in deep ensembles
R
empirically demonstrate the trade-off between privacy and accuracy in deep ensemble learning. We find that ensembling can improve either privacy or accuracy, but not both simultaneously --
show that the effectiveness of membership inference attacks also increases
R
the classification accuracy, the effectiveness of the MI attack also increases. We analyze various factors that contribute to such privacy leakage in ensembling such
accuracy. To better understand this trade-off, we study the impact of various factors such
R
Our evaluation of defenses against MI attacks , such as
Finally, we evaluate defenses against membership inference attacks based on
R
, shows that they
. We show that while these defenses
R
MI attackbut
membership inference attack, they