SaTC: CORE: Medium: Privacy for All: Ensuring Fair Privacy Protection in Machine Learning

人工智能和机器学习领域的进步导致了用于改善网络安全的算法和技术。然而，机器学习也容易受到新颖而复杂的隐私攻击，这些攻击会泄露用于学习和预测的数据的信息。例如，通过访问发现特定疾病遗传基础的机器学习模型的预测结果，隐私攻击可以推断是否使用特定患者的临床记录来训练该模型。隐私攻击可以是歧视性的，因为它对于某些人口统计群体(例如，女性)具有比其他群体(例如，男性)更高的成功率。然而，现有的针对这些攻击的防御机制都没有考虑到这种不同的漏洞，因此在不同的组中执行不同的工作。这引发了人们对公平隐私的严重关注，即如何确保所有群体和个人得到公平保护？本项目将从技术和社会两个角度解决公平隐私的核心问题。该项目有五个研究方向：(1)定量地形式化公平隐私的概念；(2)揭示对两种研究较多的机器学习使能隐私攻击--成员关系推理攻击(MIA)和属性推理攻击(AIA)--存在不同的脆弱性，并调查这种脆弱性不公平性的根本原因；(3)检查现有针对MIA和AIA的防御机制的公平性，并研究这些防御机制如何影响脆弱性不公平性；(4)设计有效的缓解机制，使防御机制能够针对MIA和AIA提供公平的保护；进行广泛的社会研究，探索与公平隐私相关的重要社会问题，并利用社会科学塑造公平隐私的研究。将通过为STEM和社会科学课程开发新课程，让学生通过各种活动和学生社团参与研究，从而广泛传播研究成果。STEM和文科两个学科不同水平的学生将接触到安全、隐私和机器学习方面的尖端研究。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Advances in the field of artificial intelligence and machine learning have resulted in algorithms and technologies for improving cybersecurity. However, machine learning is also vulnerable to novel and sophisticated privacy attacks that leak information about the data used for learning and prediction. For example, by accessing the prediction results of a machine learning model that discovers the genetic basis of a particular disease, the privacy attack can infer if a certain patient's clinical record was used to train this model. The privacy attack can be discriminatory in the sense that it has a higher successful rate for certain demographic groups (e.g., females) than the other groups (e.g., males). However, none of the existing defense mechanisms against these attacks consider such disparate vulnerability and thus perform disparate efforts across different groups. This raises the serious concern of fair privacy, i.e., how to ensure all groups and individuals are protected equitably?This project will address the core issues of fair privacy from both technical and social perspectives. The project has five research thrusts: (1) formalizing the concept of fair privacy quantitatively; (2) unveiling the existence of disparate vulnerability to two popularly-studied, machine learning enabled privacy attacks, namely membership inference attack (MIA) and attribute inference attack (AIA), and investigating the underlying causes of such vulnerability unfairness; (3) examining the fairness of the existing defense mechanisms against MIA and AIA, and studying how these defense mechanisms affect vulnerability unfairness; (4) designing effective mitigation mechanisms that enable the defense mechanisms to provide equitable protection against MIA and AIA; and (5) performing extensive social studies to explore important social issues related to fair privacy, and utilizing social science to shape the research of fair privacy. The research outcomes will be disseminated broadly through the development of new courses for both STEM and social sciences curricula, involving students into research through various events and student societies. Students at different levels in both disciplines of STEM and liberal arts will be exposed to cutting-edge research in security, privacy, and machine learning.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.