Enhanced Membership Inference Attacks against Machine Learning Models

By Jiayuan Ye, Aadyaa Maddi, S. K. Murakonda, Reza Shokri. Conference on Computer and Communications Security, 2021

381 citations recorded by the source corpus.

How much does a machine learning algorithm leak about its training data, and why? Membership inference attacks are used as an auditing tool to quantify this leakage. In this paper, we present a comprehensivehypothesis testing framework that enables us not only to formally express the prior work in a consistent way, but also to design new membership inference attacks that use reference models to achieve a significantly higher power (true positive rate) for any (false positive rate) error. More importantly, we explainwhy different attacks perform differently. We present a template for indistinguishability games, and provide an interpretation of attack success rate across different instances of the game. We discuss various uncertainties of attackers that arise from the formulation of the problem, and show how our approach tries to minimize the attack uncertainty to the one bit secret about the presence or absence of a data point in the training set. We perform adifferential analysis between all types of attacks, explain the gap between them, and show what causes data points to be vulnerable to an attack (as the reasons vary due to different granularities of memorization, from overfitting to conditional memorization). Our auditing framework is openly accessible as part of thePrivacy Meter software tool.

Subfields: Artificial Intelligence, Safety Research

View Paper: https://www.semanticscholar.org/paper/e22cc31d0cfeb3dcc12d053e991d0322cf717be6

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety Research

Citations in the corpus

Measuring Forgetting of Memorized Training Examples (2022, methodology): “Our methodology builds on state-of-the-art membership inference attacks (Carlini et al., 2021a; Ye et al., 2021), the best known method for testing whether a given point was used in training.”
Membership Inference Attacks against Language Models via Neighbourhood Comparison (2023, methodology): “…Likelihood Ratio Attacks (LiRA) , which measure the difficulty of a target point by feeding it to reference models that help provide a perspective into how likely that target point is in the given domain (Ye et al., 2022; Carlini et al., 2021a; Watson et al., 2022; Mireshghallah et al., 2022a,b).”
Extracting Training Data from Diffusion Models (2023, background): “Membership inference attacks can also be improved by reducing the variance in the loss signal [8, 79].”
Security and Privacy Challenges of Large Language Models: A Survey (2024, neutral): “In this section, we review research studies to mitigate the vulnerabilities of LLMs to defend against emerging security and privacy threats.”