Data and Model Dependencies of Membership Inference Attack
arXiv:2002.06856
Abstract
Machine learning (ML) models have been shown to be vulnerable to Membership Inference Attacks (MIA), which infer the membership of a given data point in the target dataset by observing the prediction output of the ML model. While the key factors for the success of MIA have not yet been fully understood, existing defense mechanisms such as using L2 regularization \cite{10shokri2017membership} and dropout layers \cite{salem2018ml} take only the model's overfitting property into consideration. In this paper, we provide an empirical analysis of the impact of both the data and ML model properties on the vulnerability of ML techniques to MIA. Our results reveal the relationship between MIA accuracy and properties of the dataset and training model in use. In particular, we show that the size of shadow dataset, the class and feature balance and the entropy of the target dataset, the configurations and fairness of the training model are the most influential factors. Based on those experimental findings, we conclude that along with model overfitting, multiple properties jointly contribute to MIA success instead of any single property. Building on our experimental findings, we propose using those data and model properties as regularizers to protect ML models against MIA. Our results show that the proposed defense mechanisms can reduce the MIA accuracy by up to 25\% without sacrificing the ML model prediction utility.
References in corpus (10)
- Fairness in Machine Learning: Lessons from Political Philosophy
- Fairness in Machine Learning
- GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models
- Algorithms that Remember: Model Inversion Attacks and Data Protection Law
- Understanding Membership Inferences on Well-Generalized Learning Models
- On Formalizing Fairness in Prediction with Machine Learning
- Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference
- AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learning
- Towards Demystifying Membership Inference Attacks
- On Inferring Training Data Attributes in Machine Learning Models