New co-membership attack method for deep generative models.
problem Check if instances were used in training data.
method Optimize attacker network to reproduce instances and use reconstruction error.
result Co-membership attacks are more powerful than single attacks.
New attacks can infer model training membership using only label predictions, not confidence.
problem Inferring whether a data point was used to train a machine learning model.
method Evaluate model's predicted labels under perturbations to infer membership.
result Label-only attacks perform as well as confidence-based attacks and break defenses that rely on confidence masking.
New attacks reveal membership in label-only ML models.
problem Vulnerability of ML models to membership inference attacks.
method Developed decision-based membership inference attacks.
result Label-only exposures are vulnerable to membership leakage.
This paper analyzes how differential privacy and data skewness affect membership inference attacks.
problem Membership inference attacks on privately trained models.
method Developed MPLens system to evaluate membership inference vulnerability.
result Membership inference risk is higher with skewed training data and differential privacy has trade-offs.
New method bounds membership inference attack success using mutual information.
problem Vulnerability of deep neural networks to membership inference attacks.
method Extended Fano's inequality to measure mutual information between inputs and activations.
result Empirical evaluation shows strong correlation between mutual information and model susceptibility.
Paper evaluates membership inference attacks on transfer learning models.
problem Evaluating membership inference attacks on transfer learning models.
method Shadow model training strategy to derive data for membership inference classifier.
result Membership inference attacks can achieve effective performance against transfer learning models.
Proposes a new privacy notion for membership inference attacks on machine learning models.
problem Membership inference attacks on machine learning models.
method Introduces f-Membership Inference Privacy (f-MIP) and μ-Gaussian Membership Inference Privacy (μ-GMIP) to quantify and mitigate privacy risks. result Analyzes likelihood ratio-based attacks and derives μ-GMIP guarantees for stochastic gradient descent (SGD) models. Paper finds optimal membership inference strategies for machine learning models.
problem Determining if a sample was part of the training set of a machine learning model.
method Derives optimal strategies for membership inference with assumptions on parameter distribution, showing that black-box attacks are as good as white-box attacks.
result Optimal strategies are not tractable, leading to approximations that outperform existing methods.
Study shows membership inference requires many more samples than training data.
problem Membership inference attacks require more reference samples than training data.
method Investigated the sample complexity for membership inference in Gaussian mean estimation.
result Ω(n + n^2 ρ^2) samples are necessary for successful membership inference attacks.
New method calibrates white-box MI attacks, outperforming previous black-box methods.
problem Calibrating membership inference attacks on white-box models.
method Leveraging model memorization and overfitting features.
result Calibrated attack provides high precision in membership inference.
Paper defends diffusion models from membership inference attacks using Langevin dynamics.
problem Defending diffusion models against membership inference attacks.
method Uses critically-damped higher-order Langevin dynamics with auxiliary variables.
result Demonstrates improved resistance to membership inference attacks through theoretical investigation and validation.
New method uses model's generalization gap to predict membership inference attacks.
problem Predicting membership inference attacks on machine learning models.
method Uses the model's generalization gap as a metric to estimate the vulnerability to membership inference attacks.
result Demonstrates that the model's generalization gap provides an upper bound on MIA security.
Paper introduces privacy mechanism for machine learning models to prevent tracing attacks.
problem Preventing adversaries from identifying which data points were part of a model's training set.
method Introduces adversarial regularization to train models that are robust against membership inference attacks.
result Models trained with this method are indistinguishable from those trained on other data points, achieving both high utility and high privacy.
Paper explores how poisoning data can increase privacy risks in machine learning models.
problem Increasing privacy risks of benign training samples through data poisoning attacks.
method Proposes generic and optimization-based attacks to amplify membership exposure.
result Demonstrates substantial increase in membership inference precision with minimal model performance degradation.
MI attacks often mislabel non-training samples, making them impractical.
problem MI attacks mislabel non-training samples, leading to high false positive rate.
method Analyzed new features like distance to decision boundary and gradient norms.
result MI attacks cannot achieve high accuracy and low false positive rate simultaneously.
Log-Loss scores expose membership privacy breaches.
problem Privacy leakage from statistical aggregates like Log-Loss scores.
method Proved that Log-Loss scores enable full accuracy membership inference in a single query.
result Complete membership privacy breach is possible with Log-Loss scores.
New attack reveals memorization patterns in pre-trained LLMs.
problem Determining if a data point was part of a pre-trained LLM's training set.
method Adapts MIA statistical tests to LLM's perplexity dynamics of subsequences.
result Significantly outperforms prior approaches in membership inference attacks.
New research shows adversarial defenses increase risk of membership inference attacks.
problem Combining security and privacy domains to measure adversarial defenses' impact on membership inference attacks.
method Measuring the success of membership inference attacks against six state-of-the-art adversarial defense methods.
result Adversarial defense methods can increase the risk of membership inference attacks.
Study membership inference under skewed priors and adaptive thresholds, improving attack accuracy.
problem Membership inference in imbalanced settings with selective thresholding.
method Developed PPV metric for skewed priors, threshold selection procedure, and a new inference attack.
result Improved inference attack accuracy in imbalanced settings.
Enhanced attacks quantify machine learning data leakage.
problem Quantifying how much machine learning models reveal about their training data.
method Hypothesis testing framework for membership inference attacks.
result New attacks achieve higher true positive rates with lower false positive rates.
PASE method protects machine learning models from membership inference attacks without significant accuracy loss.
problem Membership inference attacks on machine learning models.
method Switching ensembles approach to mitigate privacy leakage.
result PASE method provides effective privacy protection with minimal accuracy penalty.
This paper quantifies how hard it is to identify specific data points in machine learning models.
problem Quantifying the difficulty of identifying specific data points in machine learning models.
method Characterizing optimal attacks and privacy defences, deriving impacts of noise and misspecification, and proposing a new covariance attack.
result The Mahalanobis distance explains the hardness of fixed-target membership inference attacks.
Study reveals how machine translation models can leak data privacy.
problem Detecting if a specific data sample was used to train machine translation models.
method Defined membership inference problem for sequence-to-sequence models, tested on machine translation models.
result Machine translation models can leak private information about training data.
New method detects if data points were used in training models with low cost and high power.
problem Detecting if a particular data point was used in training a model.
method Fine-grained modeling of null hypothesis in likelihood ratio tests, leveraging reference models and population data.
result RMIA has superior test power compared to prior methods, even at extremely low false positive rates.
TAMIS improves MIA on synthetic data, reducing cost and requiring less knowledge.
problem Empirical assessment of privacy in machine learning algorithms.
method Improves MAMA-MIA by recovering graphical model from synthetic data and introducing a more accurate attack score.
result TAMIS achieves better or similar performance to MAMA-MIA on synthetic data challenges.
Study shows unequal success of membership inference attacks across different groups.
problem Unequal success of membership inference attacks across different groups.
method Established conditions for preventing MIAs and derived connections to fairness and differential privacy.
result Estimating disparate vulnerability to MIAs can lead to overestimation; suitable attacks and statistical framework provided.
Generative text classifiers are most vulnerable to membership inference attacks.
problem Privacy threat from Membership Inference Attacks on generative text classifiers.
method Comprehensive empirical evaluation of generative, discriminative, and pseudo-generative classifiers across various datasets.
result Generative classifiers explicitly modeling P(X,Y) are most vulnerable to membership leakage. We quantitatively investigate how machine learning models leak information about the individual data records on which they were trained. We focus on the basic membership inference attack: given a data record and black-box access to a model, determine if the record was in the model's training dataset. To perform members…
Quantile regression attacks outperform shadow models in unseen class membership inference attacks.
problem Failure of shadow model attacks on unseen classes due to limited data access.
method Quantile regression attacks that learn features of member examples.
result Quantile regression attacks achieve up to 11x higher TPR than shadow model-based approaches.
White-box attacks reveal deep learning model training data records.
problem Privacy leakage in deep learning models.
method Design of white-box inference attacks for both centralized and federated learning.
result Deep models, even well-generalized ones, are susceptible to white-box membership inference attacks.
privGAN protects synthetic data from membership inference attacks.
problem Membership inference attacks on synthetic data generated by GANs.
method Developed a new GAN architecture (privGAN) that not only generates synthetic data but also defends against membership inference attacks.
result privGAN provides protection against membership inference attacks without significantly compromising downstream performance.
Overparameterized models are more vulnerable to membership inference attacks.
problem Vulnerability of overparameterized models to membership inference attacks.
method Theoretical and empirical analysis of overparameterized linear and ridge-regularized linear regression models in the Gaussian data setting.
result Increased number of parameters and model complexity increase vulnerability to membership inference attacks.
Paper presents membership encoding for deep learning models to protect training data.
problem Protecting training data from inference attacks and ensuring copyright.
method Membership encoding algorithm for deep neural networks.
result Membership information can be encoded for a subset of training data, robust to model compression and fine-tuning.
Study quantized models' privacy against membership inference attacks.
problem Privacy risk in quantized machine learning models.
method Proposed a new MIS indicator for post-training quantization procedures, minimizing empirical loss.
result Demonstrated effectiveness of new MIS indicator in assessing and ranking privacy risk.
Causal models offer stronger privacy guarantees and better generalization than associational models in machine learning.
problem Privacy attacks on machine learning models, especially membership inference attacks.
method Demonstrated the benefit of causal learning in machine learning models, showing better generalization and stronger privacy guarantees.
result Causal models provide stronger differential privacy guarantees and are more robust to membership inference attacks compared to associational models.
Pruning improves DNNs against MIA while reducing model size and computation.
problem Vulnerability of DNNs to membership inference attacks (MIA).
method Proposes a pruning algorithm to reduce model size and computational operations.
result Pruned subnetwork prevents privacy leakage from MIA with competitive accuracy.
A new, low-cost method speeds up membership inference attacks on large language models.
problem Membership inference attacks on large language models.
method An ensemble of small quantile regression models to determine model training set membership.
result Comparable or improved accuracy with significantly reduced computational cost.
This paper analyzes privacy risks in neural network pruning and proposes a defense mechanism.
problem Privacy risks in neural network pruning due to membership inference attacks.
method Investigates the impact of pruning on prediction divergence and proposes a self-attention membership inference attack.
result Proposed defense mechanism mitigates privacy risks while maintaining sparsity and accuracy.
New research limits how well attackers can guess if data points were in a model's training set.
problem Revealing membership of data points in machine learning models.
method Theoretical analysis of statistical limits for membership inference attacks.
result The effectiveness of membership inference attacks is limited by a constant that quantifies data distribution diversity.
SGLD protects membership privacy in Bayesian deep learning.
problem Preventing membership attack in Bayesian deep learning.
method Theoretical framework based on information leakage analysis.
result SGLD prevents information leakage to a certain extent.
Paper evaluates and mitigates privacy risks in deep learning models.
problem Quantifying and defending against privacy attacks in deep learning.
method Quantitative evaluation of trade-offs, reformulating attacks, and proposing a novel SPN.
result Model accuracy improved by 5-20% while maintaining data privacy.
Regularization may not fully protect against membership inference attacks.
problem Mitigating membership inference attacks in deep learning models.
method Evaluation of 8 regularization mechanisms on three image classification tasks.
result Certain regularization mechanisms can inadvertently help membership inference attacks.
Study compares federated learning and coreset approaches for privacy in distributed machine learning.
problem Measuring privacy in distributed machine learning approaches.
method Comparison of federated learning and coreset approaches using membership inference attack.
result Federated learning offers better privacy than coreset, but with higher communication cost.
New attacks show data augmentation may not improve privacy.
problem Measuring privacy risk in models trained with data augmentation.
method Formulated membership inference as a set classification problem, designed input permutation invariant features.
result Proposed approach universally outperforms original methods on models trained with data augmentation.
Paper introduces attacks to infer GAN training dataset properties.
problem Security and privacy risks of generative models like GANs.
method Proposes a general attack pipeline for two attack scenarios.
result Demonstrates strong performance in inferring GAN training dataset properties.
New model quantifies how much machine learning models can reveal about individual data usage.
problem Measuring and reducing the leakage of membership information from machine learning models.
method Using information theory, conditional mutual information leakage, and Kullback-Leibler divergence to quantify and bound the leakage.
result The amount of membership information leakage is reduced by adding Gaussian (ε,δ)-differentially-private additive noises. Machine learning algorithms, when applied to sensitive data, pose a distinct threat to privacy. A growing body of prior work demonstrates that models produced by these algorithms may leak specific private information in the training data to an attacker, either through the models' structure or their observable behavior.…
This paper analyzes how data and model properties affect membership inference attacks.
problem Understanding and mitigating the vulnerability of machine learning models to membership inference attacks.
method Empirical analysis of data and model properties on MIA success.
result Data and model properties, not just model overfitting, influence MIA success.