Work

NeuraCrypt is not private

Year: 2021

Type: preprint

Abstract: NeuraCrypt (Yara et al. arXiv 2021) is an algorithm that converts a sensitive dataset to an encoded dataset so that (1) it is still possible to train machine learning models on the encoded data, but (2) an adversary who has access only to the encoded dataset can not learn much about the original sensitive dataset. We break NeuraCrypt privacy claims, by perfectly solving the authors' public challenge, and by showing that NeuraCrypt does not satisfy the formal privacy definitions posed in the original paper. Our attack consists of a series of boosting steps that, coupled with various design flaws, turns a 1% attack advantage into a 100% complete break of the scheme.

Source: arXiv (Cornell University)

DOI: 10.48550/arxiv.2108.07256

Authors: Carlini, Nicholas, Garg, Sanjam, Jha, Somesh, Mahloujifar, Saeed, Mahmoody, Mohammad, Tramer, Florian

Institutions: NTT (Japan), University of California, Berkeley, University of Wisconsin System, Princeton University, University of Virginia, Stanford University

Language: English

Topic: Privacy-Preserving Technologies in Data

Subfield: Artificial Intelligence

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

OpenAlex ID: W3193889786

Cites: 7

Cited by:

Related to: 20