ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models

Abstract

Inference attacks against Machine Learning (ML) models allow adversaries to learn sensitive information about training data, model parameters, etc. While researchers have studied, in depth, several kinds of attacks, they have done so in isolation. As a result, we lack a comprehensive picture of the risks caused by the attacks, e.g., the different scenarios they can be applied to, the common factors that influence their performance, the relationship among them, or the effectiveness of possible defenses. In this paper, we fill this gap by presenting a first-of-its-kind holistic risk assessment of different inference attacks against machine learning models. We concentrate on four attacks -- namely, membership inference, model inversion, attribute inference, and model stealing -- and establish a threat model taxonomy. Our extensive experimental evaluation, run on five model architectures and four image datasets, shows that the complexity of the training dataset plays an important role with respect to the attack's performance, while the effectiveness of model stealing and membership inference attacks are negatively correlated. We also show that defenses like DP-SGD and Knowledge Distillation can only mitigate some of the inference attacks. Our analysis relies on a modular re-usable software, ML-Doctor, which enables ML model owners to assess the risks of deploying their models, and equally serves as a benchmark tool for researchers and practitioners.

References in corpus (15)

• Distilling the Knowledge in a Neural Network
• Deep Learning with Differential Privacy
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models
• Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data
• White-box vs Black-box: Bayes Optimal Strategies for Membership Inference
• Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference
• Thieves on Sesame Street! Model Extraction of BERT-based APIs
• Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
• Overlearning Reveals Sensitive Attributes
• ML Privacy Meter: Aiding Regulatory Compliance by Quantifying the Privacy Risks of Machine Learning
• An Overview of Privacy in Machine Learning
• Membership Privacy for Machine Learning Models Through Knowledge Transfer

Cited by in corpus (7)

• A Survey of Privacy Attacks in Machine Learning
• When Machine Unlearning Jeopardizes Privacy
• Honest-but-Curious Nets: Sensitive Attributes of Private Inputs Can Be Secretly Coded into the Classifiers' Outputs
• Membership Inference Attacks and Generalization: A Causal Perspective
• ORL-AUDITOR: Dataset Auditing in Offline Deep Reinforcement Learning
• On the Privacy Risks of Cell-Based NAS Architectures
• Noiseless Privacy-Preserving Decentralized Learning