New attacks can infer model training membership using only label predictions, not confidence.
problem Inferring whether a data point was used to train a machine learning model.
method Evaluate model's predicted labels under perturbations to infer membership.
result Label-only attacks perform as well as confidence-based attacks and break defenses that rely on confidence masking.
New method bounds membership inference attack success using mutual information.
problem Vulnerability of deep neural networks to membership inference attacks.
method Extended Fano's inequality to measure mutual information between inputs and activations.
result Empirical evaluation shows strong correlation between mutual information and model susceptibility.
Paper evaluates membership inference attacks on transfer learning models.
problem Evaluating membership inference attacks on transfer learning models.
method Shadow model training strategy to derive data for membership inference classifier.
result Membership inference attacks can achieve effective performance against transfer learning models.
Membership inference attacks seek to infer the membership of individual training instances of a privately trained model. This paper presents a membership privacy analysis and evaluation system, called MPLens, with three unique contributions. First, through MPLens, we demonstrate how membership inference attack methods …
Proposes a new privacy notion for membership inference attacks on machine learning models.
problem Membership inference attacks on machine learning models.
method Introduces f-Membership Inference Privacy (f-MIP) and μ-Gaussian Membership Inference Privacy (μ-GMIP) to quantify and mitigate privacy risks. result Analyzes likelihood ratio-based attacks and derives μ-GMIP guarantees for stochastic gradient descent (SGD) models. New attacks reveal membership in label-only ML models.
problem Vulnerability of ML models to membership inference attacks.
method Developed decision-based membership inference attacks.
result Label-only exposures are vulnerable to membership leakage.
Study shows membership inference requires many more samples than training data.
problem Membership inference attacks require more reference samples than training data.
method Investigated the sample complexity for membership inference in Gaussian mean estimation.
result Ω(n + n^2 ρ^2) samples are necessary for successful membership inference attacks.
Membership inference determines, given a sample and trained parameters of a machine learning model, whether the sample was part of the training set. In this paper, we derive the optimal strategy for membership inference with a few assumptions on the distribution of the parameters. We show that optimal attacks only depe…
New method uses model's generalization gap to predict membership inference attacks.
problem Predicting membership inference attacks on machine learning models.
method Uses the model's generalization gap as a metric to estimate the vulnerability to membership inference attacks.
result Demonstrates that the model's generalization gap provides an upper bound on MIA security.
Paper defends diffusion models from membership inference attacks using Langevin dynamics.
problem Defending diffusion models against membership inference attacks.
method Uses critically-damped higher-order Langevin dynamics with auxiliary variables.
result Demonstrates improved resistance to membership inference attacks through theoretical investigation and validation.
Study membership inference under skewed priors and adaptive thresholds, improving attack accuracy.
problem Membership inference in imbalanced settings with selective thresholding.
method Developed PPV metric for skewed priors, threshold selection procedure, and a new inference attack.
result Improved inference attack accuracy in imbalanced settings.
Membership inference (MI) attacks exploit the fact that machine learning algorithms sometimes leak information about their training data through the learned model. In this work, we study membership inference in the white-box setting in order to exploit the internals of a model, which have not been effectively utilized …
In this paper we propose a new membership attack method called co-membership attacks against deep generative models including Variational Autoencoders (VAEs) and Generative Adversarial Networks (GANs). Specifically, membership attack aims to check whether a given instance x was used in the training data or not. A co-me…
Log-Loss scores expose membership privacy breaches.
problem Privacy leakage from statistical aggregates like Log-Loss scores.
method Proved that Log-Loss scores enable full accuracy membership inference in a single query.
result Complete membership privacy breach is possible with Log-Loss scores.
MI attacks often mislabel non-training samples, making them impractical.
problem MI attacks mislabel non-training samples, leading to high false positive rate.
method Analyzed new features like distance to decision boundary and gradient norms.
result MI attacks cannot achieve high accuracy and low false positive rate simultaneously.
New attack reveals memorization patterns in pre-trained LLMs.
problem Determining if a data point was part of a pre-trained LLM's training set.
method Adapts MIA statistical tests to LLM's perplexity dynamics of subsequences.
result Significantly outperforms prior approaches in membership inference attacks.
Data privacy is an important issue for "machine learning as a service" providers. We focus on the problem of membership inference attacks: given a data sample and black-box access to a model's API, determine whether the sample existed in the model's training data. Our contribution is an investigation of this problem in…
We quantitatively investigate how machine learning models leak information about the individual data records on which they were trained. We focus on the basic membership inference attack: given a data record and black-box access to a model, determine if the record was in the model's training dataset. To perform members…
Machine learning models leak information about the datasets on which they are trained. An adversary can build an algorithm to trace the individual members of a model's training dataset. As a fundamental inference attack, he aims to distinguish between data points that were part of the model's training set and any other…
Generative text classifiers are most vulnerable to membership inference attacks.
problem Privacy threat from Membership Inference Attacks on generative text classifiers.
method Comprehensive empirical evaluation of generative, discriminative, and pseudo-generative classifiers across various datasets.
result Generative classifiers explicitly modeling P(X,Y) are most vulnerable to membership leakage. New method detects if data points were used in training models with low cost and high power.
problem Detecting if a particular data point was used in training a model.
method Fine-grained modeling of null hypothesis in likelihood ratio tests, leveraging reference models and population data.
result RMIA has superior test power compared to prior methods, even at extremely low false positive rates.
Overparameterized models are more vulnerable to membership inference attacks.
problem Vulnerability of overparameterized models to membership inference attacks.
method Theoretical and empirical analysis of overparameterized linear and ridge-regularized linear regression models in the Gaussian data setting.
result Increased number of parameters and model complexity increase vulnerability to membership inference attacks.
Enhanced attacks quantify machine learning data leakage.
problem Quantifying how much machine learning models reveal about their training data.
method Hypothesis testing framework for membership inference attacks.
result New attacks achieve higher true positive rates with lower false positive rates.
Study quantized models' privacy against membership inference attacks.
problem Privacy risk in quantized machine learning models.
method Proposed a new MIS indicator for post-training quantization procedures, minimizing empirical loss.
result Demonstrated effectiveness of new MIS indicator in assessing and ranking privacy risk.
TAMIS improves MIA on synthetic data, reducing cost and requiring less knowledge.
problem Empirical assessment of privacy in machine learning algorithms.
method Improves MAMA-MIA by recovering graphical model from synthetic data and introducing a more accurate attack score.
result TAMIS achieves better or similar performance to MAMA-MIA on synthetic data challenges.
Paper introduces attacks to infer GAN training dataset properties.
problem Security and privacy risks of generative models like GANs.
method Proposes a general attack pipeline for two attack scenarios.
result Demonstrates strong performance in inferring GAN training dataset properties.
Paper explores how poisoning data can increase privacy risks in machine learning models.
problem Increasing privacy risks of benign training samples through data poisoning attacks.
method Proposes generic and optimization-based attacks to amplify membership exposure.
result Demonstrates substantial increase in membership inference precision with minimal model performance degradation.
This paper quantifies how hard it is to identify specific data points in machine learning models.
problem Quantifying the difficulty of identifying specific data points in machine learning models.
method Characterizing optimal attacks and privacy defences, deriving impacts of noise and misspecification, and proposing a new covariance attack.
result The Mahalanobis distance explains the hardness of fixed-target membership inference attacks.
Quantile regression attacks outperform shadow models in unseen class membership inference attacks.
problem Failure of shadow model attacks on unseen classes due to limited data access.
method Quantile regression attacks that learn features of member examples.
result Quantile regression attacks achieve up to 11x higher TPR than shadow model-based approaches.
The arms race between attacks and defenses for machine learning models has come to a forefront in recent years, in both the security community and the privacy community. However, one big limitation of previous research is that the security domain and the privacy domain have typically been considered separately. It is t…
A new, low-cost method speeds up membership inference attacks on large language models.
problem Membership inference attacks on large language models.
method An ensemble of small quantile regression models to determine model training set membership.
result Comparable or improved accuracy with significantly reduced computational cost.
Deep neural networks are susceptible to various inference attacks as they remember information about their training data. We design white-box inference attacks to perform a comprehensive privacy analysis of deep learning models. We measure the privacy leakage through parameters of fully trained models as well as the pa…
Pruning improves DNNs against MIA while reducing model size and computation.
problem Vulnerability of DNNs to membership inference attacks (MIA).
method Proposes a pruning algorithm to reduce model size and computational operations.
result Pruned subnetwork prevents privacy leakage from MIA with competitive accuracy.
This paper analyzes privacy risks in neural network pruning and proposes a defense mechanism.
problem Privacy risks in neural network pruning due to membership inference attacks.
method Investigates the impact of pruning on prediction divergence and proposes a self-attention membership inference attack.
result Proposed defense mechanism mitigates privacy risks while maintaining sparsity and accuracy.
Machine learning algorithms, when applied to sensitive data, pose a distinct threat to privacy. A growing body of prior work demonstrates that models produced by these algorithms may leak specific private information in the training data to an attacker, either through the models' structure or their observable behavior.…
Study compares federated learning and coreset approaches for privacy in distributed machine learning.
problem Measuring privacy in distributed machine learning approaches.
method Comparison of federated learning and coreset approaches using membership inference attack.
result Federated learning offers better privacy than coreset, but with higher communication cost.
New research limits how well attackers can guess if data points were in a model's training set.
problem Revealing membership of data points in machine learning models.
method Theoretical analysis of statistical limits for membership inference attacks.
result The effectiveness of membership inference attacks is limited by a constant that quantifies data distribution diversity.
Regularization may not fully protect against membership inference attacks.
problem Mitigating membership inference attacks in deep learning models.
method Evaluation of 8 regularization mechanisms on three image classification tasks.
result Certain regularization mechanisms can inadvertently help membership inference attacks.
This paper analyzes how data and model properties affect membership inference attacks.
problem Understanding and mitigating the vulnerability of machine learning models to membership inference attacks.
method Empirical analysis of data and model properties on MIA success.
result Data and model properties, not just model overfitting, influence MIA success.
New bounds on machine learning data leakage identified.
problem Machine Learning models can leak sensitive information.
method Formalized attack setups, derived universal bounds, studied mutual information.
result Connected attack success rate to generalization gap and mutual information.
Poisoning datasets can reveal private details of other users' training points.
problem Integrity and privacy of machine learning training data.
method Active inference attacks that poison a small fraction of the training dataset.
result Poisoning as little as 0.1% of the training dataset can significantly boost inference attacks.
New method improves privacy risk evaluation of machine learning models.
problem Machine learning models can be vulnerable to membership inference attacks.
method Proposed new inference attack method based on prediction entropy, and introduced privacy risk score metric.
result Existing defense approaches are not as effective as previously reported.
New attacks show data augmentation may not improve privacy.
problem Measuring privacy risk in models trained with data augmentation.
method Formulated membership inference as a set classification problem, designed input permutation invariant features.
result Proposed approach universally outperforms original methods on models trained with data augmentation.
Machine learning models have been shown to be vulnerable to membership inference attacks, i.e., inferring whether individuals' data have been used for training models. The lack of understanding about factors contributing success of these attacks motivates the need for modelling membership information leakage using info…
Paper tackles MIAs vulnerability by controlling FDR, providing guarantees on false discoveries.
problem Vulnerability of deep learning models to membership inference attacks (MIAs).
method Designs a novel membership inference attack method that provides FDR guarantees.
result Demonstrates the effectiveness of the method in various settings.
Paper assesses holistic risks of inference attacks on ML models.
problem Lack of comprehensive risk assessment of inference attacks on ML models.
method Presented a threat model taxonomy for four inference attacks on five model architectures and four image datasets.
result Complexity of training dataset influences attack performance; model stealing and membership inference attacks are negatively correlated.
New MCMC method estimates differential privacy from multiple MIAs without worst-case assumptions.
problem Bayesian estimation of differential privacy from membership inference attacks.
method Bayesian estimation via MCMC algorithm (MCMC-DP-Est).
result More cautious privacy analysis with joint estimation of MIA strengths and privacy parameter.
Machine unlearning can compromise privacy, study shows.
problem Machine unlearning may leave data imprints in ML models, risking privacy.
method Proposed a membership inference attack to detect leakage.
result Machine unlearning can lead to unintended privacy risks.