Membership Leakage in Label-Only Exposures

By Zheng Li, Yang Zhang. Conference on Computer and Communications Security, 2020

315 citations recorded by the source corpus.

Machine learning (ML) has been widely adopted in various privacy-critical applications, e.g., face recognition and medical image analysis. However, recent research has shown that ML models are vulnerable to attacks against their training data. Membership inference is one major attack in this domain: Given a data sample and model, an adversary aims to determine whether the sample is part of the model's training set. Existing membership inference attacks leverage the confidence scores returned by the model as their inputs (score-based attacks). However, these attacks can be easily mitigated if the model only exposes the predicted label, i.e., the final model decision. In this paper, we propose decision-based membership inference attacks and demonstrate that label-only exposures are also vulnerable to membership leakage. In particular, we develop two types of decision-based attacks, namely transfer attack and boundary attack. Empirical evaluation shows that our decision-based attacks can achieve remarkable performance, and even outperform the previous score-based attacks in some cases. We further present new insights on the success of membership inference based on quantitative and qualitative analysis, i.e., member samples of a model are more distant to the model's decision boundary than non-member samples. Finally, we evaluate multiple defense mechanisms against our decision-based attacks and show that our two types of attacks can bypass most of these defenses.

Subfields: Artificial Intelligence, Health Informatics

View Paper: https://www.semanticscholar.org/paper/3ccf68128d78cb98d638b5b882d1be0fa3d8cb49

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Health Informatics

Citations in the corpus

Enhanced Membership Inference Attacks against Machine Learning Models (2021, background): “A substantial body of literature followed this work extending the shadow model attacks to different setting such as white box analysis [15, 23, 26], label-only access [5, 16], and federated learning [20, 23].”
Membership Inference Attacks From First Principles (2021, background): “, labelonly attacks [6, 34, 54]) may or may not achieve high success rate at low false-positive rates; algorithms previously seen as “private” because they resist prior attacks might be vulnerable to our new attack; and old defenses dismissed as ineffective might be able to defend against these new ”
Membership Inference Attacks against Language Models via Neighbourhood Comparison (2023, background): “Finally, some researchers have also attempted to perform membership inference attacks given only hard labels without confidence scores (Li and Zhang, 2021; Choquette-Choo et al., 2021).”
Membership Inference Attacks on Machine Learning: A Survey (2021, methodology): “Li and Zhang [112], and Choquette et al.”
A Survey of Privacy Attacks in Machine Learning (2020, background): “A common design pattern for a lot of supervised learning attacks is the use of shadow models and meta-models or attack-models [3, 18, 29, 40, 46, 51, 68, 97, 106, 108, 110, 116, 125].”