Membership Inference Attacks From First Principles
Nicholas Carlini∗1 Steve Chien1 Milad Nasr1,2 Shuang Song1 Andreas Terzis1 Florian Tramèr1 1 Google Research 2 University of Massachusetts Amherst
Abstract
A membership inference attack allows an adversary to query a trained machine learning model to predict whether or not a particular example was contained in the model’s training dataset. These attacks are currently evaluated using average-case “accuracy” metrics that fail to characterize whether the attack can confidently identify any members of the training set. We argue that attacks should instead be evaluated by computing their true-positive rate at low (e.g., $\leq 0.1\%$ ) false-positive rates, and find most prior attacks perform poorly when evaluated in this way. To address this we develop a Likelihood Ratio Attack (LiRA) that carefully combines multiple ideas from the literature. Our attack is 10 $\times$ more powerful at low false-positive rates, and also strictly dominates prior attacks on existing metrics.
中文速览
训练好的机器学习模型会不会"记住"训练数据里的某个具体样本？成员推断攻击（membership inference attack）就是用来回答这个问题的——攻击者向模型发起查询，试图判断某条数据是否曾出现在训练集中。过去的研究习惯用平均准确率或AUC来衡量攻击效果，但这类指标掩盖了一个关键问题：攻击能否以极低的误报率（false-positive rate）可靠地"点名"少数真实成员。本文提出应当用"低误报率下的真正例率"作为核心评价标准，并在此基础上设计了一种似然比攻击（Likelihood Ratio Attack，LiRA），将样本难度建模与高斯似然估计相结合，在误报率不超过0.1%的严苛条件下，攻击成功率比现有方法高出10倍，同时在传统指标上也全面领先。这一工作揭示了大量"看似安全"的模型其实存在真实隐私风险，也提示学界需要用更严格的标准重新审视已有的隐私保护方案和防御机制。
原文 arXiv:2112.03570;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2112.03570v2