Membership Leakage in Label-Only Exposures
Zheng Li and Yang Zhang CISPA Helmholtz Center for Information Security
Abstract
Machine learning (ML) has been widely adopted in various privacy-critical applications, e.g., face recognition and medical image analysis. However, recent research has shown that ML models are vulnerable to attacks against their training data. Membership inference is one major attack in this domain: Given a data sample and model, an adversary aims to determine whether the sample is part of the model’s training set. Existing membership inference attacks leverage the confidence scores returned by the model as their inputs (score-based attacks). However, these attacks can be easily mitigated if the model only exposes the predicted label, i.e., the final model decision.
中文速览
机器学习模型在只返回预测标签（而非置信度分数）时是否仍会泄露训练数据隐私，是一个此前被忽视的安全问题。针对这一问题，研究者提出了两种仅依赖模型最终决策标签的成员推断攻击（decision-based membership inference attack）：一是迁移攻击（transfer attack），利用影子数据集让本地影子模型模拟目标模型的行为，再在本地发起攻击；二是边界攻击（boundary attack），无需任何额外数据，通过测量对样本施加扰动使其跨越决策边界所需的最小幅度来区分训练成员与非成员，核心洞察是训练成员距决策边界更远、更难被扰动变类。实验结果表明，这两种攻击均表现出色，边界攻击在部分场景下甚至超过了现有的基于置信度分数的攻击，且能绕过大多数已知防御手段（除非施加严重损害模型精度的强正则化）。这一发现揭示了"隐藏置信度分数"并不能真正保护模型隐私，对现实中部署的机器学习系统的隐私安全评估具有重要警示意义。
原文 arXiv:2007.15528;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2007.15528v3