SafeNet: Mitigating Data Poisoning Attacks on Private Machine Learning
Secure multiparty computation (MPC) has been proposed to allow multiple
mutually distrustful data owners to jointly train machine learning (ML) models
on their combined data. However, the datasets used for training ML models might
be under the control of an adversary mounting a data poisoning attack, and MPC
prevents inspecting training sets to detect poisoning. We show that multiple
MPC frameworks for private ML training are susceptible to backdoor and targeted
poisoning attacks. To mitigate this, we propose SafeNet, a framework for
building ensemble models in MPC with formal guarantees of robustness to data
poisoning attacks. We extend the security definition of private ML training to
account for poisoning and prove that our SafeNet design satisfies the
definition. We demonstrate SafeNet's efficiency, accuracy, and resilience to
poisoning on several machine learning datasets and models. For instance,
SafeNet reduces backdoor attack success from 100% to 0% for a neural network
model, while achieving 39x faster training and 36x less communication than the
four-party MPC framework of Dalskov et al.