AI Research Portal

This paper introduces Iterations for Membership Inference Attack (IMIA), a novel method for evaluating the privacy risks of machine learning models. IMIA infers whether a specific sample was part of a model's training set by analyzing the number of iterations required to generate its adversarial sample. The core idea is that member samples generally require more iterations to generate adversarial examples than non-member samples. The paper empirically claims that IMIA achieves strong performance in both black-box and white-box attack scenarios across multiple models and datasets, providing a universal and adaptable approach for privacy leakage assessment.

Traditional Membership Inference Attack (MIA) methods face several limitations:

Resource-intensive for distribution-based MIA: These methods exploit distributional differences between training and test data but typically require large datasets and shadow models, making them resource-intensive.
Limited to soft outputs for metric-based MIA: Metric-based MIA methods, such as Softmax Response, infer membership from model outputs like confidence scores. However, they are effective only when the target model exposes soft outputs (e.g., probabilities) and fail when only hard labels are available.

A novel member inference attack method, IMIA, is proposed to infer data membership by analyzing the number of iterations required to generate adversarial samples, focusing on the internal operation of the model rather than posterior output.
IMIA does not require any training data or shadow models, operating solely with the target sample, making it lightweight and broadly applicable.
The proposed IMIA method is highly adaptable and universal, capable of being exploited in various settings (black-box and white-box) where previous methods might be limited to specific situations.
Experimental results demonstrate that IMIA effectively evaluates the privacy leakage risk of models under both black-box and white-box settings across multiple models, datasets, network architectures, and data distributions.

IMIA leverages the observation that member samples generally require more iterations to generate adversarial examples than non-member samples. The method involves generating an adversarial sample for a given target sample and then using the number of iterations taken for this generation as a feature to infer membership.

Method Flow:

Input: A target model fo, a target sample (xt, yt), an adversarial strategy S, and a threshold T.
Adversarial Sample Generation: The adversarial strategy S is used to generate a successful adversarial example from the target sample (xt, yt). The number of iterations (Tt) required for this process is recorded.
Membership Inference:
- If Tt > T, the target sample is classified as a member.
- If Tt ≤ T, the target sample is classified as a non-member.

Adversarial Strategies:

Score-based black-box attacks: For scenarios where the adversary can obtain the full probability output, SimBA (Guo et al. 2019) is chosen. Its optimization goal is to minimize the probability on the true label y of the target sample x: min Pfo (y|x + δ) subject to: ||δ||2 < d, queries < M where δ represents perturbations and M is the budget for the number of queries.
Decision-based black-box attacks: For scenarios where the adversary can only obtain the hard label of the target input, HopSkipJumpAttack (Chen, Jordan, and Wainwright 2020) is chosen. This method starts from a randomly chosen point not classified to label y and walks along the decision boundary to minimize the distance between the original image x and its adversarial image x'.
White-box attacks: For white-box settings where the adversary has access to internal model parameters, Projected Gradient Descent (PGD) (Madry et al. 2018) is chosen.

Target Model Architectures: ResNet50, VGG19, ResNeXt29_2x64d, and DenseNet121.
Training: Each target model is trained for 100 epochs on every dataset to ensure sufficient training.
Adversarial Attack Strategies:
- Score-based black-box MIA: SimBA (Guo et al. 2019) is used.
- Decision-based black-box MIA (hard labels): HopSkipJumpAttack (Chen, Jordan, and Wainwright 2020) is used.
- White-box MIA: Projected Gradient Descent (PGD) (Madry et al. 2018) is used.
PGD Adversarial Sample Generation: Xadv = Clipx, (xadv + α sign (∇xJ(x,y)))
Evaluation Set: Composed of 3k samples from the training set (members) and 3k samples from the test set (non-members) of the target model. This procedure is repeated 20 times.
Baselines:
- Score-based setting: Softmax Response, Prediction Entropy, and Modified Entropy.
- Decision-based setting: "Boundary" method (Choquette-Choo et al. 2021).
- White-box setting: "Loss" method (Yeom et al. 2018) and "Boundary" method.

Datasets: CIFAR10, CIFAR100, and STL10.
Metrics: Inference accuracy (%) and Area Under the Receiver Operating Characteristic Curve (AUROC) (%).
Baselines: Softmax Response, Entropy, Mentr. (Modified Entropy), Boundary, Loss.
Numeric Results (IMIA vs. Baselines):
- CIFAR100, Score-based (SimBA):
  - ResNet: IMIA(ours) AUROC 89.11±0.29, Accuracy 83.62±0.29. Mentr. AUROC 89.24±0.15, Accuracy 85.43±0.16.
  - ResNeXt: IMIA(ours) AUROC 68.93±0.58, Accuracy 64.82±0.55. Mentr. AUROC 68.42±0.10, Accuracy 64.48±0.12.
  - VGG: IMIA(ours) AUROC 67.36±0.64, Accuracy 64.68±0.55. Mentr. AUROC 69.61±0.14, Accuracy 65.41±0.13.
  - DenseNet: IMIA(ours) AUROC 73.80±0.48, Accuracy 68.91±0.40. Mentr. AUROC 73.19±0.12, Accuracy 67.90±0.18.
- CIFAR10, Score-based (SimBA):
  - DenseNet: IMIA(ours) AUROC 75.20±0.09, Accuracy 68.97±0.15. Softmax AUROC 69.21±0.15, Accuracy 64.17±0.14.
- STL10, Score-based (SimBA):
  - DenseNet: IMIA(ours) AUROC 81.18±0.12, Accuracy 75.41±0.11. Mentr. AUROC 78.41±0.11, Accuracy 73.97±0.09.
- STL10, Decision-based (HopSkipJumpAttack):
  - DenseNet: IMIA(ours) AUROC 83.36±0.19, Accuracy 76.57±0.21. Boundary AUROC 82.42±0.13, Accuracy 75.29±0.17.
- CIFAR10, White-box (PGD):
  - DenseNet: IMIA(ours) AUROC 76.29±0.33, Accuracy 70.15±0.31. Loss AUROC 73.31±0.43, Accuracy 68.42±0.46.
Runtime/Training Cost: Not stated in the paper.

No explicit paper-reported limitations were found.

Method evidence: "We propose to infer the member properties of the target sample using the number of iterations required to generate its adversarial sample." (section: Abstract)
Result evidence: "For example, for our proposed attack against CIFAR10 DenseNet classifier, the membership inference AUROC is increased from 69.21 to 75.20 on average and the accuracy is increased from 64.17 to 68.97." (section: Results)
Limitation evidence: Not stated in the paper.

Privacy Leaks by Adversaries: Adversarial Iterations for Membership Inference Attack

Summary

Problem

Key Contributions

Method

Technical Details

Results

Weaknesses / Limitations

Evidence

Additional Figures