Ensemble Partitioning: A Defense Mechanism Against Membership Inference Attacks in ML Models

The risk of privacy leakage has emerged as a critical concern as machine learning models continue to achieve impressive results across various domains. Membership Inference Attacks (MIAs) pose a significant threat by enabling adversaries to determine whether specific samples were part of a model’s training data, leading to potential exposure of sensitive information. Existing defense mechanisms often struggle with the trade-off between preserving model accuracy and ensuring privacy. To address this issue, we propose a novel defense method, Ensemble Partitioning Defense (EPD), inspired by ensemble learning. EPD mitigates the risk of MIAs by partitioning the training data across multiple sub-models, reducing each model’s exposure to sensitive data. During inference, EPD combines the predictions of these sub-models and a master model, applying a uniform confidence mapping function to standardize confidence scores, thus preventing adversaries from exploiting differences in confidence vectors. Our experiments, conducted on multiple datasets, demonstrate that EPD not only effectively defends against various MIAs but also maintains high classification performance. Compared to existing defense methods, EPD offers a superior balance between privacy protection and model utility, making it a robust solution to the MIA problem.