Serialize only assigned audit examples, not the full parent dataset

オープン
  • 何か問題がありますか？
#329 コメント 4 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@0xzoz がすでに取り組んでいます。

2026年11月12日 から。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
48/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
python, pytorch
領域
machine-learning, security

調査の方向性

Start with the subset and save code at cache_model_1/services/modelowner.py lines 237–241 and the equivalent in cache_model_0/services/modelowner.py; then inspect related partition writers for the same pattern. Add regression coverage for both services using the synthetic sentinel example and verify after serialization and encryption round trips that only assigned inputs and labels are recoverable while sampling remains deterministic. Done means the saved assignment contains no unselected parent data and its size scales with the assignment.

索引モデルが issue の本文から書いたものです。

説明

Approved

Observed against ed175d0deceddfa2e63175ec7752c800b31c1fbf during the November 10 Fashion-MNIST local test investigation. The subsequent full round with three notebooks and a Raspberry Pi used recorded workarounds; its success does not establish that this upstream defect is fixed. Related: #276 and #40.

Problem and evidence

Both reference model-owner services create a torch.utils.data.Subset(test_data, random_indices) and save that object. A Subset holds its parent dataset; torch.save serializes that parent too. Encryption protects the resulting archive in transit but does not remove unassigned examples from it.

An independent synthetic round-trip reproduced a saved assignment with length 500 whose loaded .dataset still had all 10,000 examples. Example 9,999 was accessible despite being outside the chosen assignment. Our completed round used materialized TensorDataset objects to avoid this behavior; its success therefore does not validate the original serializer.

This is more than a large-file problem. A recipient can inspect examples beyond its assigned shard, undermining the intended restricted audit distribution/resampling boundary for non-public data. The ordinary evaluator still iterates the assigned 500 rows. This finding does not establish that evaluation scored all 10,000 examples or that the observed scores were invalid.

Proposed scope

Materialize the selected examples into a standalone dataset before hashing, encryption and upload. Apply the fix to both reference models and inspect related partition writers for the same serialization pattern. Preserve sampling seeds, selected indices, labels and existing evaluation behavior. Do not combine this with a new sampling-policy design.

Acceptance criteria
  • A synthetic parent has recognizable sentinel examples outside the assigned indices.
  • After save/load (and the encryption/decryption round trip), only assigned examples are recoverable; no parent dataset or unselected tensor storage remains embedded.
  • Exact assigned inputs/labels and deterministic indices match the previous sampling logic.
  • File size scales with the assignment, not the parent dataset.
  • Both reference services have regression coverage.
Minimal synthetic reproduction
import io
import torch
from torch.utils.data import TensorDataset, Subset

parent = TensorDataset(torch.arange(10_000))
assigned = Subset(parent, list(range(500)))
buf = io.BytesIO()
torch.save(assigned, buf)
buf.seek(0)
# Only load this locally generated synthetic object.
loaded = torch.load(buf, weights_only=False)
print(len(loaded), len(loaded.dataset), loaded.dataset[9999][0].item())
# 500 10000 9999
Full-round test report

See Discussion #331 — Fashion-MNIST with three notebooks and a Raspberry Pi for the setup diagram, completed protocol roles, results and experiment adaptations.

主要言語
Python
スター
4
フォーク
7
平均マージ
5日 15時間
マージ済み PR（30日）
43

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

InfiniteZeroFoundation/DevNet のほかの issue

InfiniteZeroFoundation/DevNet の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。