Demystifying Membership Inference Attacks in Machine Learning as a Service
Stacey Truex, Ling Liu, Mehmet Emre Gursoy, Lei Yu, and Wenqi Wei S.Truex, L. Liu, M.E. Gursoy, L. Yu, and W. Wei are with the School of Computer Science, Georgia Institute of Technology, Atlanta, GA, 30332. Email: {staceytruex, memregursoy, leiyu, received X; revised Y.
Abstract
Membership inference attacks seek to infer membership of individual training instances of a model to which an adversary has black-box access through a machine learning-as-a-service API. In providing an in-depth characterization of membership privacy risks against machine learning models, this paper presents a comprehensive study towards demystifying membership inference attacks from two complimentary perspectives. First, we provide a generalized formulation of the development of a black-box membership inference attack model. Second, we characterize the importance of model choice on model vulnerability through a systematic evaluation of a variety of machine learning models and model combinations using multiple datasets. Through formal analysis and empirical evidence from extensive experimentation, we characterize under what conditions a model may be vulnerable to such black-box membership inference attacks. We show that membership inference vulnerability is data-driven and corresponding attack models are largely transferable. Though different model types display different vulnerabilities to membership inference, so do different datasets. Our empirical results additionally show that
中文速览
机器学习模型在提供预测服务时，会泄露训练数据的"成员信息"——攻击者只需反复查询黑盒API，就能推断出某条记录是否曾出现在训练集里，这就是成员推断攻击（membership inference attack），严重威胁患者隐私和企业数据安全。本文从攻击模型的通用构建框架出发，系统评估了多种机器学习模型、数据集及模型组合在黑盒场景下的脆弱性，通过大量实验揭示了"哪类模型、哪类数据更容易被攻击"的规律。研究发现，成员推断的脆弱性本质上由数据分布驱动、攻击模型可广泛迁移，且联邦学习（federated learning）中的参与方也可对其他成员发起内部推断攻击。这些结论不仅厘清了成员隐私风险的边界，也为设计有效的防御和缓解策略提供了系统性依据。
原文 arXiv:1807.09173;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1807.09173v2