US 11,886,989 B2
System for measuring information leakage of deep learning models
Zhongshu Gu, Ridgewood, NJ (US); Heqing Huang, Mahwah, NJ (US); Jialong Zhang, White Plains, NY (US); Dong Su, Elmsford, NY (US); Dimitrios Pendarakis, Westport, CT (US); and Ian Michael Molloy, Westchester, NY (US)
Assigned to International Business Machines Corporation, Armonk, NY (US)
Filed by International Business Machines Corporation, Armonk, NY (US)
Filed on Sep. 10, 2018, as Appl. No. 16/125,983.
Prior Publication US 2020/0082259 A1, Mar. 12, 2020
Int. Cl. G06N 3/08 (2023.01); G06N 3/045 (2023.01)
CPC G06N 3/08 (2013.01) [G06N 3/045 (2023.01)] 15 Claims
OG exemplary drawing
 
1. A method for addressing information leakage, comprising:
generating inferencing output of a first deep learning inference system based on input information, wherein individual layers of the first deep learning inference system produce one or more associated intermediate representations to form a set of intermediate representations;
generating inferencing output of a second deep learning inference system and based on individual ones of the set of intermediate representations from the first deep learning inference system, wherein the first and second deep learning inference systems share a same network architecture, including a same plurality of layers and weights;
determining one or more similarity metrics between the input and the intermediate representations by comparing the inferencing output of the second deep learning inference system for individual ones of the intermediate representations with the inferencing output from the first deep learning inference system, wherein the one or more similarity metrics are calculated based on a divergence between the inferencing output from the first deep learning inference system and the inferencing output from the second deep learning inference system for individual ones of the intermediate representations;
determining a partitioning point in the plurality of layers of the first deep learning inference system by selecting a subset of the set of intermediate representations that are most similar to the input information based on the determined one or more similarity metrics for the individual ones of the intermediate representations, wherein the partitioning point is defined so that information leakage for the first deep learning inference system will meet a provided privacy parameter;
based on the partitioning point, partitioning the plurality of layers of the first deep learning inference system into a first partition and a second partition;
placing the first partition into an enclave to protect the input information of the first deep learning inference system in confidence and placing the second partition into a cleartext part; and
performing inferencing using the first and second partitions.