System for measuring information leakage of deep learning models

An apparatus for addressing information leakage, comprising:

• memory having computer program code;
• and
• one or more processors, wherein the one or more processors, in response to retrieval and execution of the computer program code, cause the apparatus to perform operations comprising:
• generating inferencing output of a first deep learning inference system based on input information, wherein individual layers of the first deep learning inference system produce one or more associated intermediate representations to form a set of intermediate representations;
• generating inferencing output of a second deep learning inference system and based on individual ones of the set of intermediate representations from the first deep learning inference system, wherein the first and second deep learning inference systems share a same network architecture, including a same plurality of layers and weights;
• determining one or more similarity metrics between the input and the intermediate representations by comparing the inferencing output of the second deep learning inference system for individual ones of the intermediate representations with the inf erencing output from the first deep learning inference system, wherein the one or more similarity metrics are calculated based on a divergence between the inferencing output from the first deep learning inference system and the inferencing output from the second deep learning inference system for individual ones of the intermediate representations;
• determining a partitioning point in the plurality of layers of the first deep learning inference system by selecting a subset of the set of intermediate representations that are most similar to the input information based on the determined one or more similarity metrics for the individual ones of the intermediate representations, where the partitioning point is defined so that information leakage for the first deep learning inference system will meet a provided privacy parameter
• based on the partitioning point, partitioning the plurality of layers of the first deep learning inference system into a first partition and a second partitions;
• placing the first partition into an enclave to protect the input information of the first deep learning inference system in confidence and placing the second partition into a cleartext part;
• and
• performing inferencing using the first and second partitions.

A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by an apparatus to cause the apparatus to perform operations comprising:

• generating inferencing output of a first deep learning inference system based on input information, wherein individual layers of the first deep learning inference system produce one or more associated intermediate representations to form a set of intermediate representations;
• generating inferencing output of a second deep learning inference system and based on individual ones of the set of intermediate representations from the first deep learning inference system, wherein the first and second deep learning inference systems share a same network architecture, including a same plurality of layers and weights;
• determining one or more similarity metrics between the input and the intermediate representations by comparing the inferencing output of the second deep learning inference system for individual ones of the intermediate representations with the inferencing output from the first deep learning inference system, wherein the one or more similarity metrics are calculated based on a divergence between the inferencing output from the first deep learning inference system and the inferencing output from the second deep learning inference system for individual ones of the intermediate representations;
• determining a partitioning point in the plurality of layers of the first deep learning inference system by selecting a subset of the set of intermediate representations that are most similar to the input information based on the determined one or more similarity metrics for the individual ones of the intermediate representations, wherein the partitioning point is defined so that information leakage for the first deep learning inference system will meet a provided privacy parameter;
• based on the partitioning point, partitioning the plurality of layers of the first deep learning inference system into a first partition and a second partition;
• placing the first partition into an enclave to protect the input information of the first deep learning inference system in confidence, and placing the second partition into a cleartext part;
• and
• performing inferencing using the first and second partitions.