White-box vs Black-box: Bayes Optimal Strategies for Membership Inference

Abstract

Membership inference determines, given a sample and trained parameters of a machine learning model, whether the sample was part of the training set. In this paper, we derive the optimal strategy for membership inference with a few assumptions on the distribution of the parameters. We show that optimal attacks only depend on the loss function, and thus black-box attacks are as good as white-box attacks. As the optimal strategy is not tractable, we provide approximations of it leading to several inference methods, and show that existing membership inference methods are coarser approximations of this optimal strategy. Our membership attacks outperform the state of the art in various settings, ranging from a simple logistic regression to more complex architectures and datasets, such as ResNet-101 and Imagenet.

Cited by in corpus (27)

• GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models
• A Survey of Privacy Attacks in Machine Learning
• How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy
• Practical Blind Membership Inference Attack via Differential Comparisons
• ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models
• PPFL: Privacy-preserving Federated Learning with Trusted Execution Environments
• Data Privacy and Trustworthy Machine Learning
• Training Data Leakage Analysis in Language Models
• Membership Inference Attacks and Generalization: A Causal Perspective
• Knowledge Cross-Distillation for Membership Privacy
• Differentially Private Federated Learning for Cancer Prediction
• Membership Leakage in Label-Only Exposures
• This Person (Probably) Exists. Identity Membership Attacks Against GAN Generated Faces
• Large Scale Private Learning via Low-rank Reparametrization
• Towards Security Threats of Deep Learning Systems: A Survey
• SoK: Machine Learning Governance
• Segmentations-Leak: Membership Inference Attacks and Defenses in Semantic Image Segmentation
• TEE-based decentralized recommender systems: The raw data sharing redemption
• Sharing Models or Coresets: A Study based on Membership Inference Attack
• Differentially Private Federated Learning with Laplacian Smoothing
• Membership Inference Attacks Against Recommender Systems
• MACE: A Flexible Framework for Membership Privacy Estimation in Generative Models
• On the Privacy Risks of Algorithmic Fairness
• On the Importance of Difficulty Calibration in Membership Inference Attacks
• On the Privacy Risks of Deploying Recurrent Neural Networks in Machine Learning Models
• Fundamental Limits of Membership Inference Attacks on Machine Learning Models
• On Inductive Biases for Machine Learning in Data Constrained Settings