[论文解读] Membership Inference Attacks From First Principles

Nicholas Carlini, Steve Chien+4 more|arXiv (Cornell University)|Dec 7, 2021

Adversarial Robustness in Machine Learning被引用 30

一句话总结

该论文批评在成员身份推断攻击方面的平均情况评估，并引入 LiRA，一种似然比攻击，在非常低的假阳性率下实现高达 10x 的真阳性率，并在多个数据集上得到验证。

ABSTRACT

A membership inference attack allows an adversary to query a trained machine learning model to predict whether or not a particular example was contained in the model's training dataset. These attacks are currently evaluated using average-case "accuracy" metrics that fail to characterize whether the attack can confidently identify any members of the training set. We argue that attacks should instead be evaluated by computing their true-positive rate at low (e.g., <0.1%) false-positive rates, and find most prior attacks perform poorly when evaluated in this way. To address this we develop a Likelihood Ratio Attack (LiRA) that carefully combines multiple ideas from the literature. Our attack is 10x more powerful at low false-positive rates, and also strictly dominates prior attacks on existing metrics.

研究动机与目标

• Argue that membership inference attacks should be evaluated by true-positive rate at low false-positive rates rather than average-case metrics.
• Develop a principled attack that combines per-example hardness with Gaussian likelihood estimates.
• Demonstrate that prior attacks underperform at low FPRs and show LiRA's superior performance across diverse datasets.

提出的方法

• Formalize membership inference as a hypothesis test between in-training and out-training distributions for a target example.
• Use shadow models to estimate per-example loss distributions under IN and OUT scenarios and fit Gaussians to logit-transformed confidences.
• Derive a Likelihood Ratio Test (LiRA) using the ratio of IN vs OUT likelihoods to decide membership.
• Offer online (shadow models per query) and offline (pre-trained shadow models) variants of LiRA to balance accuracy and efficiency.
• Extend LiRA to multivariate queries by using multiple augmented samples per target to form a multivariate Gaussian in logit space.
• Provide an open-source implementation for replication.

实验结果

研究问题

• RQ1 How should membership inference attacks be evaluated to reflect practical privacy risks at very low false-positive rates?
• RQ2 Can a likelihood-ratio framework leveraging per-example hardness significantly improve membership inference effectiveness over prior attacks?
• RQ3 Do shadow-model-based estimates generalize across datasets and model architectures to enable robust LiRA deployment?
• RQ4 What are the trade-offs between online and offline LiRA in terms of efficiency and accuracy?
• RQ5 How does LiRA perform across CIFAR-10, CIFAR-100, ImageNet, and WikiText-103 datasets?

主要发现

• LiRA outperforms prior attacks by roughly 10x at low false-positive rates on a CIFAR-10 model with 92% test accuracy.
• Prior attacks show limited true-positive rates at FPRs below 0.1% and often have misleading aggregate metrics such as AUC.
• Model confidences are better analyzed in logit space, allowing the Gaussian modeling of IN/OUT distributions per example.
• The attack remains effective across multiple datasets (CIFAR-10/100, ImageNet, WikiText-103) and training setups, including large-scale benchmarks.
• An offline variant of LiRA reduces computational cost while maintaining strong performance by leveraging pre-trained shadow models and one-sided likelihood testing.
• The method emphasizes the importance of per-example hardness and memorization behavior in membership inference.