Label-Only Membership Inference Attacks

By Christopher A. Choquette-Choo, Florian Tramèr, Nicholas Carlini, Nicolas Papernot. International Conference on Machine Learning, 2020

649 citations recorded by the source corpus.

Membership inference attacks are one of the simplest forms of privacy leakage for machine learning models: given a data point and model, determine whether the point was used to train the model. Existing membership inference attacks exploit models' abnormal confidence when queried on their training data. These attacks do not apply if the adversary only gets access to models' predicted labels, without a confidence measure. In this paper, we introduce label-only membership inference attacks. Instead of relying on confidence scores, our attacks evaluate the robustness of a model's predicted labels under perturbations to obtain a fine-grained membership signal. These perturbations include common data augmentations or adversarial examples. We empirically show that our label-only membership inference attacks perform on par with prior attacks that required access to model confidences. We further demonstrate that label-only attacks break multiple defenses against membership inference attacks that (implicitly or explicitly) rely on a phenomenon we call confidence masking. These defenses modify a model's confidence scores in order to thwart attacks, but leave the model's predicted labels unchanged. Our label-only attacks demonstrate that confidence-masking is not a viable defense strategy against membership inference. Finally, we investigate worst-case label-only attacks, that infer membership for a small number of outlier data points. We show that label-only attacks also match confidence-based attacks in this setting. We find that training models with differential privacy and (strong) L2 regularization are the only known defense strategies that successfully prevents all attacks. This remains true even when the differential privacy budget is too high to offer meaningful provable guarantees.

Subfields: Artificial Intelligence

View Paper: https://www.semanticscholar.org/paper/a14d6a842ac94cc561f39a5cab6ec133862d5f42

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Membership Inference Attacks on Machine Learning: A Survey (2021, background): “[30] further investigate the membership privacy risks when an attacker gets access only to the target classifiers’ predicted labels.”
Membership Inference Attacks From First Principles (2021, methodology): “[6] suggest an alternate technique to increase attack accuracy when models are trained with data augmentations.”
Membership Leakage in Label-Only Exposures (2020, result): “We also acknowledge that a concurrent work [13] proposes an approach similar to our boundary attack.”
A Survey of Privacy Attacks in Machine Learning (2020, background): “A common design pattern for a lot of supervised learning attacks is the use of shadow models and meta-models or attack-models [3, 18, 29, 40, 46, 51, 68, 97, 106, 108, 110, 116, 125].”
Bag of Tricks for Training Data Extraction from Language Models (2023, methodology): “Several defense methods based on differential privacy (Leino & Fredrikson, 2020; Naseri et al., 2020; Choquette-Choo et al., 2021), data pruning (Wang et al., 2021), data augmentation (Kaya & Dumitras, 2021) and causal inference (Tople et al., 2020) have been proposed to mitigate this vulnerability.”
Unlocking High-Accuracy Differentially Private Image Classification through Scale (2022, result): “Alongside other results (Carlini et al., 2021a; Choquette-Choo et al., 2021; Liu et al., 2021), these studies demonstrate that models trained on sensitive datasets present a significant privacy risk.”
On the Importance of Difficulty Calibration in Membership Inference Attacks (2021, methodology): “The membership score can be computed using the loss (Yeom et al., 2018), the gradient norm (GN) (Nasr et al., 2019) or the con-ﬁdence of the model’s prediction (Salem et al., 2018), often yielding state-of-the-art results (Salem et al., 2018; Choquette-Choo et al., 2021).”
Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning (2021, background): “Previous works [48, 45, 39, 9] showed that if an instance is”
A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly (2023, background): “These studies have explored various membership inference attacks by analyzing the label [42], determining the threshold [115, 28, 95], developing a generalized formulation [269], among other methods.”
Dataset Inference: Ownership Resolution in Machine Learning (2021, background): “Choo et al. (2020) show that MI can succeed even in scenarios when the victim only provides labels.”
Membership Inference Attacks against Language Models via Neighbourhood Comparison (2023, background): “Notably, the attack proposed by Choquette-Choo et al. (2021) is probably closest to our work as it tries to obtain information about a sample’s membership by flipping its predicted labels through small data augmentations such as rotations to image data.”