Lion Cipher Lab
Defend a model against membership inference with DP-SGD
- AI Security
- Advanced
- ~2.5 hours
- Free · no account required
Why it matters
Part 1 left you able to prove a model leaks its training set, and pointed at differential privacy as the defence with an actual guarantee. Pointing is not doing. In this lab you build that defence and pay for it in your own numbers. You train a target that overfits, run the real Shokri-et-al shadow-model attack against it — not a single hand-tuned threshold this time, but many shadow models feeding a trained attack classifier scored by AUC — and watch it succeed. Then you retrain the identical model with DP-SGD using Opacus at a chosen epsilon, rerun the exact same attack, and watch its AUC…
What you'll learn
- shadow-model membership inference (the full Shokri et al. attack classifier, not a single threshold)
- training an attack model on shadow confidence vectors
- measuring privacy leak as attack AUC before and after a defence
- DP-SGD: per-sample gradient clipping plus calibrated Gaussian noise
- using Opacus PrivacyEngine.make_private_with_epsilon and get_epsilon
- reading and choosing (epsilon, delta) as a privacy budget
- quantifying the privacy/utility trade-off in your own numbers
- why overfitting is the root cause, and regularisation / early stopping as cheaper partial defences
- the honest limits of differential privacy (worst-case guarantee, large epsilon buys little)
- PyTorch basics for a small MLP on a CPU
Steps in this lab
- Where Part 1 left you, and what you build here
- The four ideas you need: DP, epsilon, delta, and DP-SGD
- Set up: install PyTorch and Opacus
- Build the shared code and an overfitting target
- The real attack: many shadow models plus a trained attack classifier
- The defence: retrain with DP-SGD in Opacus at a chosen epsilon
- The judgement: when DP-SGD is worth it, and its honest limits
- What you just did, and where to push it