Understanding and Mitigating Privacy Risks in Vision and Multi-Modal Models

As deep learning is increasingly integrated into various applications, ensuring users' privacy has become critical. Training datasets often contain sensitive information prone to being leaked during inference, posing significant risks, especially for publicly accessible AI systems. For instance, large language and text-to-image diffusion models have been shown to memorize and reproduce training data during inference, including names, email addresses, and images. Despite ongoing research, these vulnerabilities persist in deployed AI systems, underscoring the urgent need for practical yet efficient privacy-preserving techniques. This thesis contributes to the understanding of these privacy risks by analyzing the challenges of training models with sensitive data and proposing defenses. Using Apple's NeuralHash, a client-side scanning system for detecting illegal images as a real-world case study, we demonstrate that even systems designed with privacy in mind can inadvertently leak sensitive information. However, privacy attacks are not limited to client-side scanning systems and also affect image classifiers such as residual networks. Membership inference attacks, which aim to determine whether a data point was used for training a model, are a well-known example. While these attacks have been considered highly effective, our findings reveal that their high false-positive rates, caused by overconfident model predictions, limit their effectiveness on ReLU networks. At the same time, we show that mitigating overconfidence to calibrate models unintentionally increases privacy risks, leading to a trade-off between privacy and model calibration. With the growing adoption of multimodal models, vision-language models like CLIP are increasingly used for image classification. Building on our insights regarding membership inference attacks on ResNet image classifiers, we introduce identity inference attacks, broadening the concept of membership inference attacks to vision-language models. Unlike traditional membership inference attacks, which target single data point instances, identity inference attacks determine whether an individual's data was generally used for training, independent of specific data samples. Not limited to single data point instances, identity inference attacks are widely applicable and, because of their very low false-positive rates, are even suited to serve as evidence for unauthorized data usage. Once it is determined that a person's data was memorized, removing this data from a trained model is a significant challenge. Therefore, this thesis introduces two novel defense mechanisms to mitigate memorization. First, we propose an efficient method to erase memorized data from vision-language models like CLIP using backdoor attacks. Our approach is the first to use security attacks for targeted unlearning of information from models and can be applied to image and text encoders. Second, we present a technique to identify neurons in text-to-image diffusion models responsible for memorization. Unlike our backdoor-based technique, which alters all model weights, we show that memorization in text-to-image diffusion models is confined to only a few neurons. Pruning these neurons effectively mitigates memorization while preserving the original model performance. Overall, the findings presented in this thesis enhance our understanding of privacy risks and contribute to the development of stronger defenses and mitigation methods, which are essential for the secure, widespread deployment of AI in real-world applications.