Conflicting Interactions Among Protections Mechanisms for Machine Learning Models
Nowadays, systems based on machine learning (ML) are widely used in different
domains. Given their popularity, ML models have become targets for various
attacks. As a result, research at the intersection of security and privacy, and
ML has flourished.
  The research community has been exploring the attack vectors and potential
mitigations separately. However, practitioners will likely need to deploy
defences against several threats simultaneously. A solution that is optimal for
a specific concern may interact negatively with solutions intended to address
other concerns.
  In this work, we explore the potential for conflicting interactions between
different solutions that enhance the security/privacy of ML-base systems. We
focus on model and data ownership; exploring how ownership verification
techniques interact with other ML security/privacy techniques like
differentially private training, and robustness against model evasion. We
provide a framework, and conduct systematic analysis of pairwise interactions.
  We show that many pairs are incompatible. Where possible, we provide
relaxations to the hyperparameters or the techniques themselves that allow for
the simultaneous deployment. Lastly, we discuss the implications and provide
guidelines for future work.