[Paper Review] Membership Inference Attacks on Machine Learning: A Survey

Hongsheng Hu, Zoran Salčić+4 more|arXiv (Cornell University)|Mar 14, 2021

Adversarial Robustness in Machine Learning31 citations

TL;DR

This paper presents the first comprehensive survey of membership inference attacks (MIAs) and defenses for ML models, with taxonomies, datasets, metrics, and open resources.

ABSTRACT

Machine learning (ML) models have been widely applied to various applications, including image classification, text generation, audio recognition, and graph data analysis. However, recent studies have shown that ML models are vulnerable to membership inference attacks (MIAs), which aim to infer whether a data record was used to train a target model or not. MIAs on ML models can directly lead to a privacy breach. For example, via identifying the fact that a clinical record that has been used to train a model associated with a certain disease, an attacker can infer that the owner of the clinical record has the disease with a high chance. In recent years, MIAs have been shown to be effective on various ML models, e.g., classification models and generative models. Meanwhile, many defense methods have been proposed to mitigate MIAs. Although MIAs on ML models form a newly emerging and rapidly growing research area, there has been no systematic survey on this topic yet. In this paper, we conduct the first comprehensive survey on membership inference attacks and defenses. We provide the taxonomies for both attacks and defenses, based on their characterizations, and discuss their pros and cons. Based on the limitations and gaps identified in this survey, we point out several promising future research directions to inspire the researchers who wish to follow this area. This survey not only serves as a reference for the research community but also provides a clear description for researchers outside this research domain. To further help the researchers, we have created an online resource repository, which we will keep updated with future relevant work. Interested readers can find the repository at https://github.com/HongshengHu/membership-inference-machine-learning-literature.

Motivation & Objective

• Provide a comprehensive review of membership inference attacks and defenses on ML models.
• Develop taxonomies for MIAs and defenses based on attacker knowledge, target models, and methodologies.
• Summarize datasets, metrics, and open-source resources to support empirical research and benchmarking.

Proposed method

• Classify MIAs into binary classifier-based and metric-based approaches, detailing white-box and black-box settings.
• Describe shadow training as a method to construct training data for attack models.
• Explain binary classifier attack models in both white-box and black-box scenarios with input representations.
• Outline metric-based MIAs using prediction correctness, loss, confidence, and entropy metrics.

Experimental results

Research questions

• RQ1 What are the main categories and mechanisms of membership inference attacks on ML models?
• RQ2 How can attackers construct effective MIAs under white-box and black-box access?
• RQ3 What defenses and datasets/metrics exist to study MIAs, and what are future directions?
• RQ4 What open resources exist to facilitate benchmarking and replication of MIAs and defenses?

Key findings

• MIAs exploit differences in model behavior between training members and non-members to infer membership.
• Shadow training enables effective binary classifier-based MIAs by creating shadow models and labeled member/non-member data.
• White-box MIAs provide more information than black-box MIAs, but black-box MIAs can be highly dangerous with limited knowledge.
• Metric-based MIAs use prediction correctness, loss, confidence, or entropy to decide membership with thresholding.