PaperlayerView exact revision on arXiv

Source-linked AI summary

Membership Inference Attacks against Machine Learning Models

Reza Shokri, Marco Stronati, Congzheng Song, Vitaly Shmatikov

arXiv:1610.05820v2cs.CRcs.LGstat.ML

TL;DR

Machine-learning models may reveal whether specific records were included in their training data, creating a membership-privacy risk. The paper develops black-box shadow-model attacks, evaluates them across realistic tasks and commercial services, and finds substantial leakage, including for sensitive health data.

  • Problem

    The paper asks whether an adversary with a record and black-box model access can determine whether that record was used for training, because membership can reveal sensitive information.

  • Method

    The authors train attack classifiers on differences between target-model outputs for members and non-members, using shadow models with known training membership.

  • Results

    Membership inference reaches median accuracy of 94% against Google and 74% against Amazon on retail datasets, exceeds 70% on the Texas hospital discharge dataset, and reaches 90% against Google with synthetic shadow data.

  • Takeaways & Limitations

    The demonstrated leakage makes membership inference a quantitative metric for evaluating model or machine-learning-service choices, while overfitting is associated with greater leakage.

Abstract

from arXiv · show

We quantitatively investigate how machine learning models leak information about the individual data records on which they were trained. We focus on the basic membership inference attack: given a data record and black-box access to a model, determine if the record was in the model's training dataset. To perform membership inference against a target model, we make adversarial use of machine learning and train our own inference model to recognize differences in the target model's predictions on the inputs that it trained on versus the inputs that it did not train on. We empirically evaluate our inference techniques on classification models trained by commercial "machine learning as a service" providers such as Google and Amazon. Using realistic datasets and classification tasks, including a hospital discharge dataset whose membership is sensitive from the privacy perspective, we show that these models can be vulnerable to membership inference attacks. We then investigate the factors that influence this leakage and evaluate mitigation strategies.

I. INTRODUCTION

The paper studies whether black-box machine-learning models reveal membership in their training datasets, develops shadow-model attacks, and evaluates leakage, overfitting, and mitigations.

  • Membership inference asks whether a given record was used to train a model, using only black-box access in the paper’s setting.
  • The attack trains an inference classifier to distinguish target-model behavior on training records from behavior on unseen records.The approach converts membership inference into a classification problem.
  • Shadow models provide labeled member and non-member outputs for training the attack model when the target model’s parameters and training data are unknown.The shadow models imitate the target while exposing known membership ground truth.
  • The authors evaluate generic attacks on neural networks and commercial Amazon ML and Google Prediction API models without knowing the providers’ learning algorithms or architectures.Evaluation uses realistic classification tasks and standard training procedures.
  • The paper quantifies how attack success relates to classification tasks and overfitting, and compares prediction limiting, reduced precision, increased entropy, and regularization as mitigations.
  • 94% and 74% median attack accuracy are achieved against Google and Amazon models, respectively, on 10,000-record retail transaction datasets.Using fully synthetic shadow data still yields 90% accuracy against Google-trained models; the Texas hospital discharge dataset exceeds 70% accuracy.

III. PRIVACY IN MACHINE LEARNING

The paper distinguishes membership privacy from broader population-level privacy notions and focuses on information revealed about individuals whose records trained the model.

  • The paper frames privacy around what a model reveals about inputs beyond what would otherwise be known, while noting that perfect non-disclosure is incompatible with useful models.
  • Model inversion infers sensitive attributes or class features, whereas membership inference determines whether a specific record was in the training dataset.
  • Population-level correlations can affect people whose records were never used for training, so the paper narrows its focus to privacy risks for training-data individuals.
  • Membership knowledge can directly reveal sensitive facts, such as a patient’s disease when a clinical record trained a disease-associated model.
  • The attack is studied in a black-box scenario where an adversary supplies inputs and receives model outputs, potentially through an application’s interface.

IV. PROBLEM STATEMENT

The problem is to infer whether a known labeled record belongs to a model’s training set from black-box outputs, using prediction confidence patterns to train a binary attack classifier.

  • For each input, the target model returns a probability vector with one value per class, whose largest value determines the predicted label.
  • The attacker knows input-output formats and can query prediction vectors, while potentially possessing population samples or marginal feature statistics.
  • The attacker receives a record and black-box query access, then determines whether that record was part of the target model’s training dataset.Precision and recall are the standard attack-accuracy metrics.
  • The attack exploits different model behavior on training records versus records encountered for the first time, often associated with overfitting but not limited to it.
  • Separate attack models are used for each target output class because confidence distributions vary with the input’s true class.
  • The attack model receives a correctly labeled record and target prediction vector, then performs binary classification into “in” and “out.”
  • Shadow-model outputs with known membership labels enable supervised training of the attack model despite unknown target parameters.

B. Shadow models

Shadow models approximate the target using similarly formatted data and the same platform, allowing supervised attack training; synthetic-data generation can operate without target-distribution knowledge.

  • B. Shadow models: The attacker creates multiple shadow models trained on datasets matching the target’s format and distribution as closely as possible.
  • B. Shadow models: Shadow training datasets are disjoint from the target dataset, although overlap among shadow datasets is allowed and can improve attack performance.
  • B. Shadow models: The synthesis algorithm queries the target model, accepts records meeting a class-confidence condition, samples accepted records, and randomizes features to continue searching.
  • B. Shadow models: The shadow models must be trained similarly to the target, and the same commercial platform can be used when the target’s model type and structure are hidden.
  • B. Shadow models: More shadow models provide more training data for recognizing member-versus-non-member behavior and generally improve attack accuracy.

C. Generating training data for shadow models

The attacker's shadow-model training data can be generated from population statistics, noisy related data, or the target model itself. Model-based synthesis searches for high-confidence inputs, but depends on efficiently exploring the input space.

  • Shadow models require training data distributed similarly to the target model’s data, generated through several synthesis strategies.The paper considers statistics-based, noisy-real-data, and model-based approaches.
  • Model-based synthesis searches for high-confidence target-model inputs, then samples synthetic records from the discovered inputs.The process uses hill climbing followed by confidence-weighted sampling until the shadow datasets are full.
  • The model-based procedure may fail for high-resolution images and complex classification tasks because the input space is difficult to explore efficiently.
  • Statistics-based synthesis independently samples features from known marginal distributions to create effective shadow-model training records.
  • Noisy-real-data synthesis flips 10% or 20% of randomly selected binary features before training the shadow models.This models target and shadow data drawn from different populations or sampled non-uniformly.

D. Training the attack model

The attack model learns membership from labeled shadow-model outputs. Separate class-specific classifiers distinguish “in” from “out” behavior, while model-based synthesis prevents a trivial confidence-only rule.

  • Shadow training converts membership inference into binary classification using labeled outputs from models with known membership ground truth.Similar models trained on relatively similar data are assumed to behave similarly enough for this transfer.
  • Each shadow model is queried on its training set and a disjoint test set, labeling outputs “in” and “out,” respectively.
  • The attack dataset stores each record, its shadow-model output, and the corresponding membership label.
  • The attack dataset is partitioned by target output class, and a separate model predicts membership status for each class.
  • With model-based synthesis, both member and non-member records are high-confidence inputs, so the attack model must learn subtler output differences than confidence alone.

VI. EVALUATION

The evaluation spans image, demographic, purchase, location, hospital-stay, and handwritten-digit tasks using local neural networks and black-box commercial services. The experiments measure membership leakage with precision and recall across varied settings.

  • The evaluation covers CIFAR, Adult, purchase, location, Texas hospital-stay, and MNIST datasets with diverse classification tasks.
  • The Texas hospital-stay dataset contains 67,330 records and 6,170 binary features for predicting one of 100 frequent procedures.
  • The attacks treat local and cloud-trained target models as black boxes, without access to cloud model types, structures, or training hyperparameters.
  • Amazon ML is evaluated in configurations (10, 1e −6) and (100, 1e −4), varying training passes and L2 regularization.
  • On CIFAR-10, median precision ranges from 0.78 to 0.71, while on CIFAR-100 it ranges from 1 to 0.97; recall is almost 1 for both.
  • For 10,000 purchase records, Google reaches 50-, 75-, and 90-percentile precision values of 0.94, 0.97, and 1, with recall close to 1.

C. Experimental setup

The experiments use disjoint target and shadow data, varied training sizes, multiple platforms, and class-balanced attack evaluation. Results show substantial leakage across datasets, with particularly high vulnerability for Google-trained models and overfit neural networks.

  • Experimental setup: Target and shadow training/test sets are randomly selected, equal-sized, disjoint, and non-overlapping across target and shadow models.Different shadow-model datasets may overlap with one another.
  • Experimental setup: CIFAR training sizes vary across four settings, while other datasets use fixed target training sizes and cloud platforms with limited training-process visibility.
  • Results: On Texas hospital stays, precision is mostly above 0.6, exceeds 0.7 for half the classes, and exceeds 0.85 for more than 20 classes.
  • Experimental setup: The purchase dataset enables direct leakage comparison across Google, Amazon, and local neural-network models trained on the same data.
  • Experimental setup: Using 100 CIFAR shadow models and fewer models elsewhere balances attack accuracy against computational cost.
  • Experimental setup: Attack evaluation uses equal numbers of members and non-members, making random-guessing accuracy 0.5, with precision and recall reported mostly per class.
  • Results: CIFAR target models are heavily overfitted, and membership attacks perform well above baseline, especially on CIFAR-100.Their largest-training-set test accuracies are 0.6 for CIFAR-10 and 0.2 for CIFAR-100.
  • Results: Google-trained models exhibit the biggest leakage in the cross-platform purchase comparison.

E. Effect of the shadow training data

Shadow-model training remains effective with noisy or synthetic data, though attack precision varies by data-generation method and underrepresented classes.

  • Precision drops as shadow-training noise increases, but 10% feature noise still matches the original attack and outperforms the baseline.The authors describe this as robustness to inaccurate assumptions about the target data distribution.
  • 0.935 overall precision on real data exceeds 0.795 for marginal-based synthetics and 0.895 for model-based synthetics.Model-based synthetic data performs near real-data training for most classes but poorly for a few.
  • Marginal-based synthetic data reduces attack precision versus real data but remains very high for most classes.The experiment generated synthetic purchase records from individual-feature marginal distributions and trained shadow models on them.
  • Model-based synthetic shadow data produces precision below 0.1 for a few classes despite high precision for most classes.Those low-precision classes are underrepresented in the target training set, often contributing under 0.6% of records.
  • Low precision on rare classes reflects difficulty synthesizing representative records when the target classifier has seen too few examples.Some affected classes have fewer than 30 training records out of 10,000.
  • The attack can achieve high precision using only black-box access when the attacker can efficiently generate high-confidence inputs.This setting does not require prior knowledge of the target training-data distribution.

F. Effect of the number of classes and training data per class

Attack leakage depends on class count, per-class representation, overfitting, model structure, and member–non-member differences in prediction outputs.

  • Effect of the number of classes: More output classes generally increase leakage because they provide more signals about the model’s internal state.On the purchase dataset, models with fewer classes leaked less information about their training inputs.
  • Training data per class: Attack precision generally decreases as the amount of training data associated with a class increases.The relationship is described as more complex than a simple monotonic rule.
  • Effect of overfitting: Greater overfitting increases leakage for models of the same type, but overfitting alone does not determine vulnerability.Model structure and type also contribute to different leakage levels.
  • Why attacks work: Per-class train–test accuracy gaps quantify overfitting, while class prevalence measures how much training data belongs to each class.Figure 11 relates both quantities to per-class membership-inference precision.
  • Why attacks work: Successful attacks exploit observable differences in target-model accuracy and prediction uncertainty between members and non-members.Figure 12 visualizes these output distributions for sample classes.
  • Why attacks work: Membership-inference success is directly related to target-model generalizability and training-data diversity.The paper identifies information leakage as an additional harm of overfitting beyond reduced predictive power.

VIII. MITIGATION

The paper examines how model design and training choices affect membership-information leakage and evaluates several mitigation strategies. Regularization is emphasized because it can reduce leakage while preserving or improving predictive performance, whereas some output restrictions may limit utility or remain insufficient.

  • Overfitting is an important, but not exclusive, reason that models leak information about their training datasets.
  • Well-regularized models should leak little training information, and the attack can quantify leakage from a specific model.
  • Differentially private models are secure against these membership attacks because the attacks use only model outputs without auxiliary information.
  • Services should consider training-data leakage alongside accuracy, warn customers about the risk, and expose ways to reduce it.
  • The study quantitatively evaluates several defenses against membership inference.
  • Top-k filtering, probability rounding, entropy increase, and L2 regularization are evaluated as defenses against membership inference.

B. Evaluation of mitigation strategies

The evaluation finds that membership inference remains effective under several prediction-output restrictions, while regularization is more promising but requires careful deployment. The related-work comparison distinguishes this attack from model inversion, extraction, and attacks based on explicit statistics.

  • B. Evaluation of mitigation strategies: The mitigation experiments compare attack degradation while preserving target-model accuracy; regularization increased target-model accuracy as expected.
  • B. Evaluation of mitigation strategies: Restricting outputs to the top 1 or 3 classes, or even a single label, does not fully prevent membership inference.
  • B. Evaluation of mitigation strategies: Regularization appears useful because it can improve generalization and reduce training-data leakage, but it must be applied without damaging test performance.
  • IX. RELATED WORK: The paper’s attack differs from prior work by inferring membership of specific records through black-box model outputs rather than extracting parameters or explicit statistics.
  • IX. RELATED WORK: Model inversion produces class-level averages rather than specific training records, especially when class images are diverse.
  • IX. RELATED WORK: Prior KLR extraction work quantified leakage mainly through visual similarity on MNIST, where within-class similarity complicates membership interpretation.

X. CONCLUSIONS

The paper presents a general quantitative membership-inference attack for black-box machine-learning models, including cloud services. Its results have practical privacy implications because membership in hospital-stay and other healthcare datasets is sensitive.

  • The attack is designed and evaluated for black-box models, including models trained through Google Prediction API and Amazon ML.
  • Shadow training distinguishes target-model outputs on training-set members from outputs on non-members.
  • Membership in hospital-stay and other healthcare datasets is privacy-sensitive, giving the findings substantial practical implications.
Loading 1610.05820v2…