Enhanced Membership Inference Attacks against Machine Learning Models

Abstract

How much does a given trained model leak about each individual data record in its training set? Membership inference attacks are used as an auditing tool to quantify the private information that a model leaks about the individual data points in its training set. The attacks are influenced by different uncertainties that an attacker has to resolve about training data, the training algorithm, and the underlying data distribution. Thus attack success rates, of many attacks in the literature, do not precisely capture the information leakage of models about their data, as they also reflect other uncertainties that the attack algorithm has. In this paper, we explain the implicit assumptions and also the simplifications made in prior work using the framework of hypothesis testing. We also derive new attack algorithms from the framework that can achieve a high AUC score while also highlighting the different factors that affect their performance. Our algorithms capture a very precise approximation of privacy loss in models, and can be used as a tool to perform an accurate and informed estimation of privacy risk in machine learning models. We provide a thorough empirical evaluation of our attack strategies on various machine learning tasks and benchmark datasets.

Parameters or Privacy: A Provable Tradeoff Between Overparameterization and Membership Inference

“…As observed by [28,13], the optimal adversary performs a hypothesis test with respect to the posterior probabilities with the two hypotheses being:…”

Membership Inference Attacks From First Principles

“…The attack fails to achieve a TPR better than random chance at any FPR below 20%-it is therefore ineffective at confidently breaching the privacy of its members. Prior papers that do report ROC curves summarize them by the AUC (Area Under the Curve) [18,38,42,55,67,68]. However, as we can see from the curves above, the AUC is not an appropriate measure of an attack's efficacy, since the AUC averages over all false-positive rates, including high error rates that are irrelevant for a practical attack.…”

“…We directly turn this observation into a membership inference attack by computing per-example hardness scores [36,54,67,68]. By training models on random samples of data from the distribution D, we obtain empirical estimates of the distributions Qin and Qout for any example (x, y).…”

Defending against Reconstruction Attacks with Rényi Differential Privacy

“…Recent works argue that a practically relevant threat model of membership inference is to confidently predict training set membership of a few samples rather than guessing well on average (Watson et al, 2021;Carlini et al, 2021a;Ye et al, 2021). Such membership inference attacks are evaluated using true and false positive rates.…”