VPP: privacy preserving machine learning via undervolting

Md Shohidul Islam, Behnam Omidi, Ihsen Alouani, Khaled N. Khasawneh

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)
29 Downloads (Pure)


Machine Learning (ML) systems are susceptible to membership inference attacks (MIAs), which leak private information from the training data. Specifically, MIAs are able to infer whether a target sample has been used in the training data of a given model. Such privacy breaching concern motivated several defenses against MIAs. However, most of the state-of-theart defenses such as Differential Privacy (DP) come at the cost of lower utility (i.e, classification accuracy). In this work, we propose Privacy Preserving Volt $(V_{PP})$, a new lightweight inference-time approach that leverages undervolting for privacy-preserving ML. Unlike related work, V PP maintains protected models’ utility without requiring re-training. The key insight of our method is to blur the MIA differential analysis outcome by comprehensively garbling the model features using random noise. Unlike DP, which injects noise within the gradient at training time, V PP injects computational randomness in a set of layers’ during inference through carefully designed undervolting Specifically, we propose a bi-objective optimization approach to identify the noise characteristics that yield privacypreserving properties while maintaining the protected model’s utility. Extensive experimental results demonstrate that V PP yields a significantly more interesting utility/privacy tradeoff compared to prior defenses. For example, with comparable privacy protection on CIFAR-10 benchmark, V PP improves the utility by 32.93% over DP-SGD. Besides, while related noisebased defenses are defeated by label-only attacks, V PP shows high resilience to such adaptive MLA. More over, V PP comes with a by-product inference power gain of up to 61%. Finally, for a comprehensive analysis, we propose a new adaptive attacks that operate on the expectation over the stochastic model behavior. We believe that V PP represents a significant step towards practical privacy preserving techniques and considerably improves the state-of-the-art.

Original languageEnglish
Title of host publicationProceedings of the IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2023
EditorsRo Cammarota, Vincent Mooney, Farimah Farahmandi, Sheng Wei, Mehran Mozaffari Kermani
PublisherInstitute of Electrical and Electronics Engineers Inc.
Number of pages11
ISBN (Electronic)9798350300628
ISBN (Print)9798350300635
Publication statusPublished - 25 May 2023
EventIEEE International Symposium on Hardware Oriented Security and Trust 2023 - San Jose, United States
Duration: 01 May 202304 May 2023

Publication series

NameInternational Workshop on Hardware-Oriented Security and Trust: Proceedings
ISSN (Print)2835-5709
ISSN (Electronic)2765-8406


ConferenceIEEE International Symposium on Hardware Oriented Security and Trust 2023
Abbreviated titleHOST 2023
Country/TerritoryUnited States
CitySan Jose


Dive into the research topics of 'VPP: privacy preserving machine learning via undervolting'. Together they form a unique fingerprint.

Cite this