Membership inference attacks using only predicted labels

1. 01What problem does this paper attempt to solve?

   The authors propose a membership inference attack that requires only hard labels, and test whether confidence masking defenses are effective.

   Core question: under a query interface where the model returns only the predicted label (label-only) and does not give confidence scores, can a membership inference (MI) attack be launched that is as effective as attacks that rely on confidence.

   • Problem setting and importance: ML models are often trained on sensitive data such as medical records, conversations, and financial information; MI attacks can infer whether an individual's data was in the training set, thereby leaking individual privacy (e.g., inferring that someone has cancer). The authors argue that models deployed to users typically do not expose confidence, so label-only is a more realistic threat model.
   • Shortcomings of existing methods: The authors state that all existing MI attacks require access to the model's confidence scores; the only prior label-only attack is the gap attack of Yeom et al. (2018) (which classifies misclassified points as non-members) and can only exploit the train-test gap.
   • Core observation: The authors hypothesize that the distance from a point to the decision boundary can serve as a proxy for confidence—for linear models the two have a monotonic relationship, and they conjecture that this relationship still holds for deep nonlinear models; training points are more robust and farther from the boundary.
   • Paper proposes: Three types of label-only attacks (data augmentation, decision boundary distance, noise robustness) and a combined attack; an evaluation against confidence masking defenses (MemGuard, adversarial regularization); and outlier MI, a stronger defense target aimed at worst-case inputs.
   • Threat model:
     • Goal: Determine whether a candidate data point was used to train the target model.
     • Knowledge: Knows the task, the target model architecture and training setup, a disjoint same-distribution data partition, and the true labels of target points (Appendix B/C).
     • Capability: Black-box queries; the interface returns only hard labels, no confidence; can query multiple times.
     • Victim system: Any queryable ML classifier.

   Collapse this answer

2. 02What related research exists?

   Related work falls into three categories: confidence-based MI attacks, label-only baselines, and MI defenses; this paper positions itself as the first category of pure label-only attacks.

   Confidence-based MI attacks

   • Shokri et al. (2016)—proposed membership inference attacks, training an attack classifier with shadow models, assuming the attacker obtains the full confidence vector.
   • Salem et al. (2018)—showed that same-distribution data and even shadow models are unnecessary; thresholding the maximum confidence suffices.
   • Sablayrolles et al. (2019)—showed that black-box attacks can approximate white-box attacks by estimating the sample loss.

   Label-only and indirect MI

   • Yeom et al. (2018)—proposed the gap attack: classifying misclassified points as non-members; it is the only prior attack using only predicted labels, and this paper uses it as a baseline.
   • Long et al. (2018)—performs indirect MI by querying inputs related to x (rather than x itself); the paper notes that it still assumes access to confidence, unlike this paper.
   • Song et al. (2019)—performs MI on adversarially robust models using adversarial examples; the paper notes that it uses confidence and its attack method differs.

   MI defenses

   • Overfitting-reduction type: regularization, adding training data (Shokri et al., 2016; Salem et al., 2018; Truex et al., 2018).
   • Prediction-perturbation type (which the authors call confidence masking): MemGuard (Jia et al., 2019) adds noise to confidence but keeps predicted labels unchanged; prediction purification (Yang et al., 2020); adversarial regularization (Nasr et al., 2018a) uses min-max training to defend the classifier. The paper notes that these defenses only mask the signal in confidence and cannot prevent label-only attacks.

   Baselines and benchmarks: The baseline attacks are the gap attack and the confidence-vector attack (Shokri et al., 2016-style attack classifier); the benchmarks are the 8 datasets used by Shokri et al. (2016) (MNIST, CIFAR-10, CIFAR-100, Adult, Texas-100, Purchase-100, Locations, etc.).

   The authors position this paper as the first MI attack that does not rely on confidence and can match or even outperform confidence attacks, and use it to examine the effectiveness of confidence masking defenses.

   Collapse this answer

3. 03How does the paper address this problem?

   Using label robustness under input perturbations as a confidence proxy: three types of attacks—data augmentation, decision boundary distance, and noise robustness.

   Overall approach: treat the model's (hard label) robustness to perturbed inputs as a proxy signal for confidence, and use multiple queries to extract fine-grained MI signals. The authors propose three types of label-only attacks and their combination.

   Problem setting and baseline

   • The attacker queries the target model h and obtains only the predicted label argmax h(x); after tuning the attack classifier f on a shadow model ĥ, it is transferred to the black-box target model.
   • Gap attack baseline (Yeom et al., 2018): classifies misclassified points as non-members, with accuracy 1/2 + (acc_train − acc_test)/2, i.e., directly reflecting the train-test gap; any label-only attack must make additional queries to surpass it.

   Data augmentation attack

   • Generate N augmented samples for the target point x (rotation ±r°, r ∈ [1,15], N=3; translation satisfying |i|+|j|=d, N=4d+1), query to obtain the label sequence, record with indicator variables b_i whether the prediction is still correct, then feed into f to decide membership.
   • Intuition: models trained with augmentation overfit to augmentation; for models not trained with augmentation, their robustness can serve as a confidence proxy.

   Decision boundary distance attack

   • Prediction rule: estimate the l2 distance dist_h(x,y) from x to the decision boundary; if greater than threshold τ, classify as member; the distance of misclassified points is recorded as 0; τ is tuned on the shadow model.
   • White-box upper bound: use the Carlini & Wagner attack to generate the nearest adversarial example to estimate distance (not label-only, for comparison only).
   • Label-only version: use HopSkipJump (Chen et al., 2019), a decision-based adversarial attack, starting from a misclassified point and approaching x along the boundary.

   Noise robustness attack

   • Add Gaussian noise x̂ = x + N(0, σ²·I) to continuous features, flip binary features with probability p, and use the accuracy over N perturbed points as a distance proxy; σ and p are tuned on the shadow model.
   • Combined attack: also evaluate dist_h(x,y) on augmented points; due to high query cost, used only in some experiments.

   Success determination

   • Draw balanced samples from the task distribution (half are training set members), with MI accuracy as the main metric; the authors state that F1 is approximately consistent with it and recall is close to 100% (Appendix B.2); outlier MI uses precision as the metric.

   Collapse this answer

4. 04What experiments did the paper conduct?

   On 8 datasets, label-only attacks match confidence attacks; the combined attack at 89.2% exceeds all attacks and breaks MemGuard.

   Experimental Setup

   • Models evaluated: 4-layer CNN (1.2M parameters) and ResNet-28 (1.4M parameters) on CIFAR-10/100 and MNIST; single-hidden-layer fully connected network on Purchase-100; two-hidden-layer fully connected network on Texas-100, Adult, and Locations.
   • Datasets: the 8 datasets of Shokri et al. (2016); CIFAR-100 uses 30,000 training points, MNIST uses 1,000, CIFAR-10 mostly 2,500, Texas/Purchase/Adult use 10,000, Location uses 1,600.
   • Baselines: gap attack, confidence-vector attack (Shokri et al., 2016 style), white-box Carlini-Wagner boundary distance attack (upper-bound comparison).
   • Metrics: MI accuracy on balanced samples; precision for outlier MI.
   • Evaluation method: attack classifiers are shallow neural networks (two-layer 10-neuron LeakyReLU for augmentation attacks; single-hidden-layer 64-neuron for confidence attacks), trained on shadow models; no LLM review.
   • Number of repetitions: not reported in the paper.

   Main Results

   According to Table 1 (CIFAR-100 uses 30,000 training points, MNIST uses 1,000; Combined means boundary + translation):

   Swipe horizontally to read the table

   Attack	CIFAR-100 no defense	CIFAR-100 + MemGuard	MNIST no defense	MNIST + MemGuard
   Gap attack	83.5	83.5	53.2	53.2
   Confidence-vector	88.1	50.0	55.7	50.0
   Data augmentation	84.6	84.6	53.9	53.9
   Boundary distance	88.0	88.0	57.8	57.8
   Combined	89.2	89.2	58.7	58.7

   • The authors state that the label-only boundary distance attack is on par with the confidence-vector attack, and the combined attack exceeds all other attacks.
   • The authors state that MemGuard reduces the confidence-vector attack to random level (50.0%) but has no effect on label-only attacks, and conclude that confidence masking is not a viable defense strategy.
   • The authors suggest using the gap attack as an indicator of confidence masking: confidence attacks should not be significantly below the gap attack.

   Non-image Datasets

   • According to Table 2, the noise robustness attack (10,000 queries) achieves 80.3% on Texas (confidence attack 84.0%), 87.4% on Purchase (86.1%), 89.2% on Location (92.6%), and 58.7% on Adult (59.9%).
   • The authors state that it is at most 4 percentage points worse than confidence attacks; under MemGuard all confidence attacks drop to 50.0%, while the noise robustness attack is unchanged.

   Defense Evaluation: Regularization and DP

   • According to Figure 6 (CIFAR-10, 2,500 training points), the authors state that most regularization methods cannot even prevent the gap attack from reaching over 60% accuracy; only strong L2 regularization (λ ≥ 1) and DP training consistently reduce MI.
   • According to Figure 5, the authors state that these two defenses come at the cost of reduced test accuracy; DP combined with transfer learning achieves the best privacy-utility trade-off; without transfer learning, dropout performs better.
   • Adversarial regularization (Nasr et al., 2018a): according to Figure 9, the authors state that it can reduce confidence attacks to within 3 percentage points of random level, but label-only attacks still exceed it, and test accuracy is below 35% when λ ≥ 3.

   Data Augmentation and Transfer Learning

   • According to Figure 3 (CIFAR-10, 2,500 points): with translation augmentation d=5 during training, test accuracy rises from 49.7% to 58.7%, and confidence and boundary distance attack accuracy decrease, but the data augmentation attack success rate rises and exceeds the confidence attack on the model without augmentation; the authors state that augmentation causes the model to overfit to the augmentation, leaking more membership information.
   • According to Figure 4 (ResNet-28 trained with the FixMatch pipeline, 96% accuracy setting): the authors state that the data augmentation attack is on par with or better than the confidence attack.
   • According to Figure 10: last layer fine-tuning reduces all attacks to the generalization gap level; full fine-tuning leaks more but has higher test accuracy.

   Other Ablations and Analysis

   • Query complexity (Figure 2, CIFAR-10, 2,500 points): rotation exceeds the baseline for 1 ≤ r ≤ 8 and translation for 1 ≤ d ≤ 2; the optimal parameters exceed the baseline by 3–4 percentage points.
   • The boundary distance attack matches the white-box upper bound (about 2,000 queries) at about 2,500 queries; the combined attack exceeds all attacks at about 12,500 queries.
   • With fewer than 100 queries the attack still exceeds the gap attack by 4 percentage points; with fewer than 300 queries the noise robustness attack outperforms other label-only attacks.
   • The number of shadow models (Figure 7, 1–5) has no significant effect on attack accuracy.
   • Outlier MI (Figure 11, β=2% outliers): targeting outliers always improves precision, but strong L2 regularization and DP training can prevent it.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors state that fine-grained analysis under reduced attacker knowledge and candidate point discovery are left for future work; experiments cover 8 datasets.

   Limitations and future directions noted by the authors

   • The authors state that they follow the threat model of Shokri et al. (2016) and leave fine-grained analysis of label-only attacks under reduced attacker knowledge (less data, unknown model architecture) for future work (§ 8 Conclusion).
   • The authors state that efficiently discovering candidate samples on high-dimensional data using a label-only interface is left for future work (Appendix B.1).
   • The authors state that extending MI attacks (whether confidence-based or label-only) to larger training datasets is an important future direction (§ 4.1).
   • The authors state that when DP training reaches test accuracy comparable to an undefended model, the formal privacy guarantee becomes essentially meaningless (ε > 100) (§ 6.2).

   Scope of experiments

   • The models tested are a 4-layer CNN, ResNet-28, and two fully connected networks, 4 architecture types in total (Appendix B.1).
   • The datasets are 8, including MNIST, CIFAR-10, CIFAR-100, Adult, Texas-100, Purchase-100, Locations, etc.; training set sizes range from 100 to 30,000 (§ 4.1, Figure 1).
   • Defense evaluations include MemGuard, adversarial regularization, prediction purification (discussed), data augmentation, transfer learning, dropout, L1/L2 regularization, and DP-SGD (§ 5, § 6).
   • The attacks assume the attacker knows the target model architecture, training setup, same-distribution data partition, and true labels (Appendix B/C).
   • The paper does not report the number of experimental repetitions or confidence intervals.

   Collapse this answer

6. 06Summarize the main content of the paper

   The authors propose label-only membership inference attacks that match confidence attacks and break confidence masking defenses; DP and strong L2 regularization are the most effective.

   A paper on membership inference (MI) privacy attacks, examining whether attacks remain feasible when the model returns only hard labels and no confidence.

   • Problem: All existing MI attacks rely on confidence scores; the authors argue that deployed models often expose only predicted labels, so privacy leakage under this more restricted interface needs to be examined.
   • Method: Use label robustness under input perturbations as a confidence proxy—three types of attacks: data augmentation (rotation, translation), decision boundary distance (HopSkipJump), and random noise, with parameters tuned on a shadow model and then transferred; and systematically evaluate defenses.
   • Result 1: On CIFAR-100 (30,000 training points), the label-only combined attack reaches 89.2% accuracy, exceeding the confidence-vector attack's 88.1% (Table 1a).
   • Result 2: MemGuard reduces the confidence-vector attack to 50.0%, but label-only attacks are completely unaffected (still 89.2% on CIFAR-100, Table 1b); the authors accordingly state that confidence masking is not a viable defense strategy.
   • Result 3: Using data augmentation during training actually exacerbates leakage—under d=5 translation augmentation, test accuracy rises to 58.7%, but the success rate of the data augmentation attack rises (Figure 3).
   • Result 4: Only strong L2 regularization (λ ≥ 1) and DP training consistently reduce MI, and at the cost of lower test accuracy; DP combined with transfer learning achieves the best trade-off (Figures 5, 6).
   • Conclusion: The authors argue that any MI defense must narrow the train-test gap, and that post-processing confidence vectors alone will necessarily remain threatened by label-only attacks; DP (combined with transfer learning) is the strongest defense in both average and worst cases.

   Collapse this answer

Related papers