Practical Blind Membership Inference Attack via Differential Comparisons

Abstract

Membership inference (MI) attacks affect user privacy by inferring whether given data samples have been used to train a target learning model, e.g., a deep neural network. There are two types of MI attacks in the literature, i.e., these with and without shadow models. The success of the former heavily depends on the quality of the shadow model, i.e., the transferability between the shadow and the target; the latter, given only blackbox probing access to the target model, cannot make an effective inference of unknowns, compared with MI attacks using shadow models, due to the insufficient number of qualified samples labeled with ground truth membership information. In this paper, we propose an MI attack, called BlindMI, which probes the target model and extracts membership semantics via a novel approach, called differential comparison. The high-level idea is that BlindMI first generates a dataset with nonmembers via transforming existing samples into new samples, and then differentially moves samples from a target dataset to the generated, non-member set in an iterative manner. If the differential move of a sample increases the set distance, BlindMI considers the sample as non-member and vice versa. BlindMI was evaluated by comparing it with state-of-the-art MI attack algorithms. Our evaluation shows that BlindMI improves F1-score by nearly 20% when compared to state-of-the-art on some datasets, such as Purchase-50 and Birds-200, in the blind setting where the adversary does not know the target model's architecture and the target dataset's ground truth labels. We also show that BlindMI can defeat state-of-the-art defenses.

References in corpus (17)

• Distilling the Knowledge in a Neural Network
• Explaining and Harnessing Adversarial Examples
• Deep Learning with Differential Privacy
• How transferable are features in deep neural networks?
• End to End Learning for Self-Driving Cars
• Ensemble Adversarial Training: Attacks and Defenses
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Stealing Machine Learning Models via Prediction APIs
• Differentially Private Empirical Risk Minimization
• BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehension
• Understanding Membership Inferences on Well-Generalized Learning Models
• Net2Net: Accelerating Learning via Knowledge Transfer
• White-box vs Black-box: Bayes Optimal Strategies for Membership Inference
• Towards Measuring Membership Privacy
• Stealing Hyperparameters in Machine Learning
• MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples

Cited by in corpus (12)

• The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscape
• Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture
• Membership Inference Attacks and Generalization: A Causal Perspective
• Knowledge Cross-Distillation for Membership Privacy
• Membership Leakage in Label-Only Exposures
• NeuGuard: Lightweight Neuron-Guided Defense against Membership Inference Attacks
• Trained Without My Consent: Detecting Code Inclusion In Language Models Trained on Code
• Federated Unlearning
• EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learning
• 10 Security and Privacy Problems in Large Foundation Models
• Data Poisoning and Leakage Analysis in Federated Learning
• Adaptation and Generalization for Unknown Sensitive Factors of Variations