Membership Leakage in Label-Only Exposures

Abstract

Machine learning (ML) has been widely adopted in various privacy-critical applications, e.g., face recognition and medical image analysis. However, recent research has shown that ML models are vulnerable to attacks against their training data. Membership inference is one major attack in this domain: Given a data sample and model, an adversary aims to determine whether the sample is part of the model's training set. Existing membership inference attacks leverage the confidence scores returned by the model as their inputs (score-based attacks). However, these attacks can be easily mitigated if the model only exposes the predicted label, i.e., the final model decision. In this paper, we propose decision-based membership inference attacks and demonstrate that label-only exposures are also vulnerable to membership leakage. In particular, we develop two types of decision-based attacks, namely transfer attack, and boundary attack. Empirical evaluation shows that our decision-based attacks can achieve remarkable performance, and even outperform the previous score-based attacks in some cases. We further present new insights on the success of membership inference based on quantitative and qualitative analysis, i.e., member samples of a model are more distant to the model's decision boundary than non-member samples. Finally, we evaluate multiple defense mechanisms against our decision-based attacks and show that our two types of attacks can bypass most of these defenses.

arXiv commentTo Appear in 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS '21), November 15--19, 2021, Virtual Event, Republic of Korea

References in corpus (21)

• Deep Learning with Differential Privacy
• Ensemble Adversarial Training: Attacks and Defenses
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Certified Adversarial Robustness via Randomized Smoothing
• The Space of Transferable Adversarial Examples
• Cross-Age LFW: A Database for Studying Cross-Age Face Recognition in Unconstrained Environments
• Understanding Membership Inferences on Well-Generalized Learning Models
• Towards Fast Computation of Certified Robustness for ReLU Networks
• White-box vs Black-box: Bayes Optimal Strategies for Membership Inference
• Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference
• Label-Only Membership Inference Attacks
• Practical Blind Membership Inference Attack via Differential Comparisons
• Towards Demystifying Membership Inference Attacks
• DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models
• Cross-Domain Transferability of Adversarial Perturbations
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• Towards Measuring Membership Privacy
• Defending Model Inversion and Membership Inference Attacks via Prediction Purification

Cited by in corpus (5)

• When Machine Unlearning Jeopardizes Privacy
• Membership Inference on Word Embedding and Beyond
• On the Privacy Risks of Cell-Based NAS Architectures
• TableGAN-MCA: Evaluating Membership Collisions of GAN-Synthesized Tabular Data Releasing
• Membership Inference Attacks on Lottery Ticket Networks