Enhanced Membership Inference Attacks against Machine Learning Models
Jiayuan Ye National University of Singapore , Aadyaa Maddi National University of Singapore , Sasi Kumar Murakonda Privitar Labs , Vincent Bindschaedler University of Florida and Reza Shokri National University of Singapore
Abstract
How much does a machine learning algorithm leak about its training data, and why? Membership inference attacks are used as an auditing tool to quantify this leakage. In this paper, we present a comprehensive hypothesis testing framework that enables us not only to formally express the prior work in a consistent way, but also to design new membership inference attacks that use reference models to achieve a significantly higher power (true positive rate) for any (false positive rate) error. More importantly, we explain why different attacks perform differently. We present a template for indistinguishability games, and provide an interpretation of attack success rate across different instances of the game. We discuss various uncertainties of attackers that arise from the formulation of the problem, and show how our approach tries to minimize the attack uncertainty to the one bit secret about the presence or absence of a data point in the training set. We perform a differential analysis between all types of attacks, explain the gap between them, and show what causes data points to be vulnerable to an attack (as the reasons vary due to different granularities of memorization, from overf
中文速览
机器学习模型会从训练数据中泄露多少隐私、又为何泄露，是隐私审计领域亟待回答的核心问题。这篇论文构建了一套统一的假设检验框架，将现有的成员推断攻击（membership inference attack）纳入同一体系加以比较和解释，同时设计了基于参考模型（reference model）和自蒸馏（self-distillation）的新型攻击方法，在相同误报率下显著提升了真正例率，最强攻击在最脆弱样本上的 AUC 高达 0.984。更重要的是，论文通过"不可区分博弈"模板系统分析了不同攻击之间的性能差距，揭示了数据点遭受攻击的根本原因——从过拟合到条件记忆化，粒度各异的记忆化机制共同决定了某个样本的脆弱程度。这一工作为机器学习系统的隐私风险量化提供了可解释、可比较的理论基础，相关代码已集成到开源工具 Privacy Meter 中，对监管合规与差分隐私审计均有直接实用价值。
原文 arXiv:2111.09679;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2111.09679v4