Skip to content
Original

Membership inference attacks from first principles

Membership Inference Attacks From First Principles

arXiv· arXiv:2112.03570· S&P 2022· Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, Florian TramerGoogle Research; University of Massachusetts AmherstIndexed by this site · 16 days ago· Originally publishedSelected AttacksSelectedAttention42

Translation in progress — untranslated text is omitted.

Quick read

Attacks

Based on the paper PDF (AI-generated); refer to the original

AI summaryResearchers from Google Research and the University of Massachusetts Amherst proposed LiRA, a likelihood-ratio-based membership inference attack, saying its success rate at low false positive rates is 10 times higher than prior attacks. The authors argue that membership inference should be evaluated by the true positive rate at a low false positive rate, rather than by average accuracy or AUC, and give the example that the loss attack of Yeom et al. has an average accuracy of 59.5% but a true positive rate of 0 at a 0.1% false positive rate. LiRA uses shadow models to estimate two Gaussian distributions of logit confidence for a target sample when inside and outside the training set, then performs a likelihood ratio test; the online version achieves true positive rates of 0.1% to 10% on CIFAR-10, CIFAR-100, ImageNet and WikiText-103 at a 0.001% false positive rate. The offline variant requires no training of a new model after receiving a query, and its true positive rate at a 0.1% false positive rate is at most 20% lower than the online version; the code has been open-sourced in the TensorFlow Privacy repository.

Questions
Membership inference attacks are used to audit training data privacy, but prior work mostly evaluated them with average metrics such as balanced accuracy and AUC; the authors argue this cannot characterize an attack's ability to reliably identify a small number of members at low false positive rates, whereas privacy leakage is precisely a worst-case problem.
Methods
The authors advocate evaluating attacks with log-scale ROC curves and TPR at low FPR (e.g., 0.1%, 0.001%), and propose LiRA: train IN/OUT shadow models, apply logit scaling to the target sample's confidence, fit the loss distribution with a Gaussian, then perform a likelihood ratio test; there is also an offline variant using only OUT models.
Experiments and results
Evaluated on CIFAR-10, CIFAR-100, ImageNet, and WikiText-103. At 0.1% FPR, the TPR of online LiRA is 8.4%, 27.6%, and 1.4%, respectively (Table I); the authors claim it is 10 times stronger than prior attacks at low FPR; ablations show that logit scaling and Gaussian likelihood must be used together.
Limitations and future work
The authors point out that per-example attacks require learning additional hyperparameters from data and are computationally expensive, and hope future work improves efficiency; they also raise several questions to be revisited (the performance of old defenses, DP, and label-only attacks at low FPR). Experiments cover 4 main datasets; ImageNet is attacked only once, and the rest are repeated 10 times.
Why it was selectedThe paper points out that average accuracy masks privacy leakage at low false positive rates; LiRA's true positive rate at a 0.1% false positive rate is about 10 times higher than prior attacks, and it can be used to review a model's privacy audit.

The paper points out that average accuracy masks privacy leakage at low false positive rates; LiRA's true positive rate at a 0.1% false positive rate is about 10 times higher than prior attacks, and it can be used to review a model's privacy audit.

Related events and news

1 events · 2 news mentions

News that mentions this paper

Mindgard发布成员推理攻击技术指南

Related papers

Both use: CINIC-10
Both use: Purchase
Both use: WikiText-103
Show 3 more papers
Both use: WikiText-103
Both use: CIFAR-100
Read originalS&P 2022