Student Parroting: Membership Inference Attacks Against Model Distillation
Students Parrot Their Teachers: Membership Inference on Model Distillation
Translation in progress — untranslated text is omitted.
The researchers design membership inference attacks against model distillation, showing that knowledge distillation alone provides only limited privacy protection, a conclusion that holds across multiple domains. Such attacks succeed even without ever querying any real training point, by querying only inputs whose predictions are heavily influenced by the training data; the attacks are strongest when the student and teacher training sets are similar, or when the attacker can poison the teacher set. Model distillation is often proposed to reduce privacy leakage in machine learning, on the basis that the student model only comes into contact with the training data indirectly through the teacher model.
- Knowledge distillation is often regarded as a privacy protection measure, with the intuition that the student model only indirectly accesses the teacher's training data. However, distillation has no strict privacy guarantee, and there is a lack of systematic evaluation of how much empirical privacy it actually provides for the teacher and student training sets.
- The authors adapt LiRA to the distillation setting, proposing Transfer LiRA, End-to-End LiRA, and an indirect attack using only student queries; they perform membership inference under three threat models—Private Teacher, Private Student, and Self-Distillation—and examine factors such as deduplication, poisoning, and temperature.
- The authors report that distillation provides only limited privacy: on CIFAR-10 the vulnerability of 5% of teacher samples drops by less than 8 percentage points; teacher membership can also be inferred using only student queries; duplication between teacher and student data and teacher-set poisoning amplify the risk; the student set receives almost no protection.
- The authors note that the attack requires training many shadow models (Section 3.2), that the code cannot be released due to organizational restrictions (Appendix A), and that they did not attack more complex combined schemes such as PATE (Section 2.2). The experiments cover 4 datasets; the student-query attack was not run on WikiText103.