White-box Membership Attack Against Machine Learning Based Retinopathy Classification
The advances in machine learning (ML) have greatly improved AI-based
diagnosis aid systems in medical imaging. However, being based on collecting
medical data specific to individuals induces several security issues,
especially in terms of privacy. Even though the owner of the images like a
hospital put in place strict privacy protection provisions at the level of its
information system, the model trained over his images still holds disclosure
potential. The trained model may be accessible to an attacker as: 1) White-box:
accessing to the model architecture and parameters; 2) Black box: where he can
only query the model with his own inputs through an appropriate interface.
Existing attack methods include: feature estimation attacks (FEA), membership
inference attack (MIA), model memorization attack (MMA) and identification
attacks (IA). In this work we focus on MIA against a model that has been
trained to detect diabetic retinopathy from retinal images. Diabetic
retinopathy is a condition that can cause vision loss and blindness in the
people who have diabetes. MIA is the process of determining whether a data
sample comes from the training data set of a trained ML model or not. From a
privacy perspective in our use case where a diabetic retinopathy classification
model is given to partners that have at their disposal images along with
patients' identifiers, inferring the membership status of a data sample can
help to state if a patient has contributed or not to the training of the model.