On the Importance of Difficulty Calibration in Membership Inference Attacks
arXiv:2111.08440
Abstract
The vulnerability of machine learning models to membership inference attacks has received much attention in recent years. However, existing attacks mostly remain impractical due to having high false positive rates, where non-member samples are often erroneously predicted as members. This type of error makes the predicted membership signal unreliable, especially since most samples are non-members in real world applications. In this work, we argue that membership inference attacks can benefit drastically from \emph{difficulty calibration}, where an attack's predicted membership score is adjusted to the difficulty of correctly classifying the target sample. We show that difficulty calibration can significantly reduce the false positive rate of a variety of existing attacks without a loss in accuracy.
arXiv comment16 pages
References in corpus (13)
- Overcoming catastrophic forgetting in neural networks
- Deep Learning with Differential Privacy
- Language Models are Few-Shot Learners
- Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
- Renyi Differential Privacy
- An Empirical Investigation of Catastrophic Forgetting in Gradient-Based Neural Networks
- The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
- Understanding Membership Inferences on Well-Generalized Learning Models
- White-box vs Black-box: Bayes Optimal Strategies for Membership Inference
- Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference
- An Empirical Study of Example Forgetting during Deep Neural Network Learning
- Rényi Differential Privacy of the Sampled Gaussian Mechanism
- Auditing Differentially Private Machine Learning: How Private is Private SGD?