Machine learning system, method, inference apparatus and computer-readable storage medium for resisting membership inference attacks

Abstract

A machine learning method including a first learning phase for training parameters θ of a learning model f by performing machine learning using a first dataset as a training data with a correct answer label; and a second learning phase for training parameters τ of a defender u and parameters ω of identifier h by performing machine learning using member data contained in the first dataset and non-member data contained in a second dataset. The second learning phase alternately performs, a first step for updating the parameters ω of the identifier h using the identification result when the first input result and the second input result are input to the identifier h; and a second step for updating the parameters τ of the defender u using the first output result, the second output result and the identification result.