Black-Box Attribute Inference Protection With Adversarial Reprogramming

With the popularity of machine learning in image processing on the rise, privacy concerns have become a major interest in deploying and using ML services. Despite the advances in ML, existing approaches for providing privacy protection often require training from scratch or fine-tuning large portions of the model to work. Because of this, providing privacy can be computationally expensive, time-consuming, and limited for use with white-box models. As a result, smaller organizations find it increasingly difficult to provide secure machine learning services that comply with data privacy laws. In this paper, we investigate the use of model reprogramming as a technique for providing attribute privacy protection for pre-trained models. Specifically, we adapt model reprogramming in an adversarial min-max framework to hide sensitive information from feature outputs without modifying the pre-trained model. We demonstrate the effectiveness of our method by experiments on CelebA dataset and show it can achieve state-of-the-art performance with significantly lower computational complexity and cost.