Counterfactual Adversarial Examples for Mitigating Privacy Risk in Adversarially Robust Models
摘要
Robustness and privacy are two essential yet often conflicting properties in deep learning models. Recent studies reveal that adversarially robust models tend to be more vulnerable to membership inference attacks (MIAs), posing significant privacy risks. Addressing this challenge, we propose a novel approach, termed Counterfactual Adversarial Example Generation (CAEG), which leverages counterfactual explanations to generate a new class of adversarial examples to mitigate MIA risks in adversarially robust models. To the best of our knowledge, this is the first work that systematically explores the use of counterfactual explanations as a privacy-enhancing mechanism in adversarial training. By analyzing the semantic and geometric similarities between adversarial examples and counterfactuals, the proposed CAEG preserves model robustness while substantially reducing privacy leakage to near random-guessing levels. Extensive experiments demonstrate that our approach effectively lowers membership inference accuracy without sacrificing classification performance or adversarial robustness. Furthermore, we analyze the trade-offs between accuracy, robustness, and privacy, and identify an optimal balance achieved when approximately 95% of training data consists of the adversarial examples generated using CAEG.