Regularization Mixup Adversarial Training: A Defense Strategy for Membership Privacy with Model Availability Assurance

Neural network models face two highly destructive threats in real-world applications: membership inference attacks (MIAs) and adversarial attacks (AAs). One compromises the model's confidentiality, leading to membership privacy breaches, while the other disrupts the model's availability, rendering it dysfunctional. Recent work has shown that adversarial examples can pose dual threats to neural network models, both MIAs and AAs, so that these two different types of attacks have a certain degree of intersection. However, existing defense methods typically focus on defending against one of the two attacks and cannot simultaneously address both. To address the above issues, we propose a defense method called regularization mixup adversarial training (RMAT), aiming to protect model membership privacy while ensuring model availability. The core idea of RMAT is to use a continuous augmentation strategy during training to generate mixup adversarial examples, weakening attackers' understanding of membership data, and updating the model with a new membership-weighted loss strategy to improve its generalization ability for handling unknown samples. This approach can further protect the model's membership privacy and ensure model availability. Experimental results demonstrate that compared to single defense strategies, RMAT can simultaneously protect the model's membership privacy and availability.