PaperlayerView exact revision on arXiv

Source-linked AI summary

Practical Blind Membership Inference Attack via Differential Comparisons

Bo Hui, Yuchen Yang, Haolin Yuan, Philippe Burlina, Neil Zhenqiang Gong, Yinzhi Cao

arXiv:2101.01341v2cs.CRcs.LG

TL;DR

Membership inference attacks face privacy risks and limitations from shadow-model transferability or insufficiently labeled data in blackbox settings. BLINDMI probes the target, generates likely nonmembers, and uses differential comparisons to infer membership. It outperforms state-of-the-art attacks in reported F1-score comparisons and remains effective against tested defenses.

  • Problem

    Existing membership inference attacks are limited by shadow-model transferability or insufficient qualified samples with ground-truth membership labels in shadow-model-free blackbox settings.

  • Method

    BLINDMI probes the target model, generates likely nonmember samples, and uses differential comparisons or one-class learning to infer membership.

  • Results

    BLINDMI outperforms state-of-the-art membership inference attacks in F1-score across settings and retains over 50% F1-score at a nonmember-to-member ratio of 39 versus below 30% for prior attacks.

  • Takeaways & Limitations

    BLINDMI provides a blackbox membership inference approach that remains effective under realistic class-ratio conditions and against tested defenses.

Abstract

from arXiv · show

Membership inference (MI) attacks affect user privacy by inferring whether given data samples have been used to train a target learning model, e.g., a deep neural network. There are two types of MI attacks in the literature, i.e., these with and without shadow models. The success of the former heavily depends on the quality of the shadow model, i.e., the transferability between the shadow and the target; the latter, given only blackbox probing access to the target model, cannot make an effective inference of unknowns, compared with MI attacks using shadow models, due to the insufficient number of qualified samples labeled with ground truth membership information. In this paper, we propose an MI attack, called BlindMI, which probes the target model and extracts membership semantics via a novel approach, called differential comparison. The high-level idea is that BlindMI first generates a dataset with nonmembers via transforming existing samples into new samples, and then differentially moves samples from a target dataset to the generated, non-member set in an iterative manner. If the differential move of a sample increases the set distance, BlindMI considers the sample as non-member and vice versa. BlindMI was evaluated by comparing it with state-of-the-art MI attack algorithms. Our evaluation shows that BlindMI improves F1-score by nearly 20% when compared to state-of-the-art on some datasets, such as Purchase-50 and Birds-200, in the blind setting where the adversary does not know the target model's architecture and the target dataset's ground truth labels. We also show that BlindMI can defeat state-of-the-art defenses.

I. INTRODUCTION

Membership inference threatens privacy, while existing attacks struggle either with shadow-model transferability or with limited labeled data in shadow-model-free settings. BLINDMI addresses this gap by using generated nonmembers and differential comparisons to infer membership directly from blackbox model outputs.

  • I. INTRODUCTION: Existing shadow-model attacks depend on transferability between surrogate and target models, while shadow-model-free attacks rely on limited binary comparisons.These constraints make membership inference difficult when qualified samples with ground-truth membership labels are unavailable.
  • I. INTRODUCTION: BLINDMI infers membership directly from target-model probing instead of relying on shadow models.The attack uses generated nonmember samples and comparison-based membership semantics.
  • I. INTRODUCTION: BLINDMI generates a likely nonmember reference set, projects target and reference outputs, and differentially moves target samples to infer their membership.The differential procedure compares set distances before and after each move and iterates until convergence.
  • I. INTRODUCTION: BLINDMI outperforms state-of-the-art attacks in F1-score across settings, retaining over 50% F1-score at a nonmember-to-member ratio of 39 versus below 30% for prior attacks.The evaluation also reports reasonable F1-scores against several existing defenses.

C. Differential Comparison Intuition

Differential comparison classifies samples by measuring how moving each sample between a target set and a mostly nonmember set changes their distance. The process repeats until convergence, although inherent member–nonmember ambiguity can leave some nonmembers in the target set.

  • C. Differential Comparison Intuition: Moving a sample that is a nonmember increases the distance between the target and nonmember sets, whereas moving a member decreases it.BLINDMI therefore labels the moved sample according to the direction of the distance change.
  • C. Differential Comparison Intuition: BLINDMI repeats single-sample moves and updates the distance across iterations until no move increases the distance.A series of moves with a fixed distance is one iteration, and unchanged distance defines convergence.
  • C. Differential Comparison Intuition: Moving rather than removing a sample changes both sets’ positions, improving sensitivity to the distance change.Removal changes only the target set’s position relative to the decision boundary.
  • C. Differential Comparison Intuition: Some nonmembers may remain in the target set after convergence because their moves do not increase the distance.The paper attributes this lower-probability case to inherent ambiguity between members and nonmembers.

III. DESIGN

BLINDMI queries target and generated samples, projects their output probabilities, and applies differential comparison or one-class classification to infer membership. Its variants support different nonmember-generation capabilities and batch or incremental use.

  • A. Overall Attack Procedure: BLINDMI generates nonmembers, queries the target model, projects output probabilities, and classifies target samples with variant-specific procedures.BLINDMI-DIFF uses differential comparison, while BLINDMI-1CLASS uses one-class learning.
  • A. Overall Attack Procedure: BLINDMI-DIFF-w/ and BLINDMI-1CLASS require generated nonmembers, whereas BLINDMI-DIFF-w/o uses rough separation without that reference set.The latter variant addresses cases where effective nonmember generation is difficult or contamination is possible.
  • A. Overall Attack Procedure: Batch mode classifies groups iteratively, while incremental mode adds and classifies one sample at a time; both produce the same results for given samples.The modes target clustered-sample and individual-sample scenarios, respectively.
  • A. Overall Attack Procedure: Nonmembers can be generated by transforming existing samples or creating new samples, or approximated by clustering and probability-based separation.Sample transformation preserves some semantics and can be stealthy, while rough separation is applicable with limited probing access.

C. Probability Score Projection

BLINDMI projects output probabilities into membership-relevant features and compares sets using distances in an RKHS. Its differential-comparison variants iteratively move samples between sets, using distance changes and confidence to infer membership.

  • C. Probability Score Projection: BLINDMI ranks probability scores or selects top-k values, optionally retaining the ground-truth class score, to emphasize relative confidence over class identity.
  • C. Probability Score Projection: BLINDMI maps probability outputs into an RKHS and measures distance between set centroids rather than directly separating members from non-members.
  • D. Differential Comparison: Single-directional comparison moves samples from the target set to the non-member set and labels a sample non-member when the updated distance increases.
  • D. Differential Comparison: Bi-directional comparison moves samples in both directions and repeats the procedure until convergence, producing predicted member and non-member sets.
  • D. Differential Comparison: Because the two sets are symmetric, BLINDMI uses average prediction confidence to decide which set corresponds to members.

E. Batch Division and Size Optimization

BLINDMI divides the target dataset into batches sized to preserve sensitivity when non-member data are scarce. The procedure seeks to maximize distance changes caused by moving individual samples.

  • E. Batch Division and Size Optimization: BLINDMI starts with a batch size matching the non-member dataset and optimizes division to maximize distance changes during differential comparison.

IV. DATASETS, PRIOR ATTACKS AND IMPLEMENTATION

The evaluation spans eight datasets covering tabular, medical, location, purchase, and image-classification scenarios. It uses specified target and shadow data partitions and model settings summarized in the evaluation materials.

  • IV. DATASETS, PRIOR ATTACKS AND IMPLEMENTATION: The evaluation uses eight datasets to test BLINDMI across different application scenarios.
  • IV. DATASETS, PRIOR ATTACKS AND IMPLEMENTATION: The datasets include census, retinal, histological, location, purchase-history, hospital-stay, and image-recognition tasks.
  • IV. DATASETS, PRIOR ATTACKS AND IMPLEMENTATION: CH-MNIST uses 2,500 target members and 2,500 non-members, with overlapping target and shadow training data because of the dataset’s small size.
  • IV. DATASETS, PRIOR ATTACKS AND IMPLEMENTATION: Purchase-50 uses disjoint 10,000-sample target and shadow training sets, with a target dataset containing 10,000 members and 10,000 non-members.
  • IV. DATASETS, PRIOR ATTACKS AND IMPLEMENTATION: CIFAR-100 uses two disjoint 10,000-image training sets and a 20,000-image target dataset split evenly between members and non-members.

B. Target and Shadow Models

The evaluation compares BLINDMI with attacks implemented under different label and shadow-model requirements. It covers blind, blackbox, and graybox conditions using varied target and shadow model configurations.

  • B. Target and Shadow Models: The evaluation uses seven popular DNN architectures with preset maximum epochs and learning rates, including standard pretrained ResNet, VGG, and DenseNet models.
  • B. Target and Shadow Models: In blind and blackbox settings, shadow models are independently selected and trained according to the specified shadow-model configurations.
  • B. Target and Shadow Models: Baseline attacks are divided into methods without ground-truth labels and methods requiring ground-truth labels, which operate only in settings where those labels are available.
  • B. Target and Shadow Models: Label-free baselines include neural-network, top-three-feature, and top-one-feature threshold attacks based on shadow-model output probabilities.
  • B. Target and Shadow Models: Ground-truth-label baselines include loss-threshold and label-only attacks, while BLINDMI and prior attacks were implemented for experimental comparison.

A. Evaluation Metrics, Experimental Setting and Research Questions

The evaluation compares BLINDMI with existing membership inference attacks across settings and defenses, finding consistently strong F1-score performance and robustness to altered outputs. Results also examine the effects of labels, shadow models, attack inputs, and privacy defenses.

  • B. RQ1: Attack Performance With Different Settings: BLINDMI significantly outperforms state-of-the-art membership inference attacks under all evaluated settings in F1-score.The reported performance boost exceeds 20% on Adult and BIRDS-200 under the blind setting.
  • B. RQ1: Attack Performance With Different Settings: Ground-truth labels improve prior attacks more than BLINDMI, whose largest reported gain is 2.9% on EyePACS.For Purchase-50, the best average F1-score rises from 59.6% in the blind setting to 72.1% with ground-truth labels.
  • B. RQ1: Attack Performance With Different Settings: BLINDMI's performance is unchanged by shadow-model choice, whereas some existing attacks vary substantially with shadow-model quality.For NN on BIRDS-200, the reported average F1-score is 58.3 with a standard error of 15.0.
  • A. Evaluation Metrics, Experimental Setting and Research Questions: BLINDMI-DIFF-w/ performs best among the three BLINDMI variations, while BLINDMI-DIFF-w/o avoids additional target-model probes.BLINDMI-DIFF-w/ requires 20 additional probes to generate a non-member set.
  • C. RQ2: Defenses: BLINDMI still outperforms all existing attacks when target-model output probabilities are adversarially altered.The evaluation covers MemGuard, MMD+Mixup, and Adversarial Regularization defenses.
  • C. RQ2: Defenses: Against defenses, binary-comparison attacks perform poorly under DP-Adam, while using more probability scores generally improves performance against MMD+Mixup.Under Adversarial Regularization, attacks using ground-truth labels rank among the strongest, but performance depends on how those labels are used.

D. RQ3: Nonmember Set Quality and Size

RQ3 finds that sample transformation produces the strongest nonmember sets, while BLINDMI-DIFF remains nearly stable even with very small nonmember datasets.

  • RQ3: Nonmember Set Quality and Size: BLINDMI-DIFF’s F1-score stays nearly constant, increasing by about 1% as the nonmember set grows from 20 to 10,000 samples.BLINDMI-1CLASS instead improves by 5%–12%, except with randomly generated nonmembers.
  • RQ3: Nonmember Set Quality and Size: BLINDMI-DIFF extracts membership semantics effectively from only a few samples because it directly compares target and nonmember distributions.BLINDMI-1CLASS requires training data for its one-class SVM to learn underlying semantics.
  • RQ3: Nonmember Set Quality and Size: Sample transformation is the most effective nonmember-generation method for both BLINDMI-DIFF and BLINDMI-1CLASS.Statistical tests were used because the performance differences were relatively small.
  • RQ3: Nonmember Set Quality and Size: Random generation differs significantly from the other methods, while cross-domain selection is more similar to random perpetuation than sample transformation.
  • RQ3: Nonmember Set Quality and Size: Sample-transformed nonmembers are closest to real-world nonmembers by MMD, whereas randomly generated samples are farthest and even farther than members.A smaller MMD indicates greater closeness to real-world nonmembers.

E. RQ4: BLINDMI-DIFF with different classifiers and kernel functions

RQ4 evaluates kernel functions and initial separation classifiers, finding that Gaussian kernels and threshold-based separation provide the strongest configurations in their respective BLINDMI-DIFF variants.

  • Experimental setup: BLINDMI-DIFF’s classifier and kernel evaluations are reported in Tables XII and XIII, while Figure 3 compares MI attacks under corresponding defenses.
  • Kernel functions: The Gaussian kernel outperforms other kernels on all datasets for BLINDMI-DIFF-w/ and most datasets for BLINDMI-DIFF-w/o.The exceptions for BLINDMI-DIFF-w/o are CH-MNIST and CIFAR-100; the linear kernel performs worst.
  • Initial sample separation classifiers: The threshold classifier outperforms other initial separation classifiers for BLINDMI-DIFF-w/o after differential comparison.Although its initial F1-score is lowest, its high-quality nonmember set supports the best post-comparison performance.
  • Initial sample separation classifiers: The threshold classifier selects the 1,000 samples with the lowest probability scores as nonmembers, whereas alternatives use K-means or agglomerative clustering.

F. RQ5: Number of Moves, Iterations, and Execution Time of BLINDMI-DIFF

RQ5 shows that BLINDMI-DIFF’s computational cost depends on target-dataset size and batch size, with the bidirectional variant requiring more time and moves.

  • Differential comparison: Precision and F1-score increase across iterations while recall declines from a value near 1.Recall drops most for Adult and CH-MNIST because members are more similar to nonmembers in their target models.
  • Execution cost: Execution time, moves, and iterations increase with the size of the target dataset.Larger datasets create more moves per iteration and therefore increase total processing requirements.
  • Execution cost: BLINDMI-DIFF-w/o takes significantly longer and performs more moves than BLINDMI-DIFF-w/ because it uses bidirectional differential comparison.
  • Batch size: Batch size determines the total number of iterations: smaller batches create more batches and therefore more iterations overall.BLINDMI-DIFF-w/ with batch size 20 takes more iterations than BLINDMI-DIFF-w/o with batch size 1,000.
  • Differential comparison: The distance between the two sets increases with the number of moves per batch, and only distance-increasing moves are retained.

G. RQ6: BLINDMI with Different Configurations

RQ6 finds that BLINDMI is comparatively robust to highly skewed nonmember-to-member ratios, while all attacks improve as the target model contains more prediction classes.

  • Nonmember-to-member ratios: All MI attacks degrade as the nonmember-to-member ratio increases, but BLINDMI’s performance decreases more slowly than competing attacks.
  • Nonmember-to-member ratios: At a nonmember-to-member ratio of 39, BLINDMI reaches 57.5% F1-score, whereas existing attacks fall below 50%.The authors report this as 35% higher than the state-of-the-art and describe BLINDMI as the slowest-degrading attack as the ratio increases.
  • Prediction classes: F1-score steadily improves for all MI attacks as the number of prediction classes increases, with larger gains when the class count is small.The evaluation uses CIFAR-100 subsets with 2, 10, 50, 70, and 100 classes.
  • Prediction classes: Top1-threshold performs worst with two classes but improves as the number of classes reaches 100.The authors attribute this pattern to the increased membership information in the top probability when probability mass is distributed across more classes.

VI. A DISCUSSION ON POTENTIAL DEFENSES

The paper discusses limiting model access and improving model robustness as two defense avenues against membership inference attacks, while noting that BLINDMI remains effective against existing defenses.

  • Restricting probes slightly degrades BLINDMI-DIFF, whereas exposing only predicted labels reduces it to the label-only attack.
  • Differential privacy is identified as likely the strongest existing defense against BLINDMI.
  • Combining existing attacks may provide another defense strategy, but the paper leaves this combination for future work.
  • BLINDMI still achieves a reasonable F1-score above 60% against existing membership-inference defenses.
  • The paper positions BLINDMI as outperforming existing attacks across varied architectures and defended DNNs.
Loading 2101.01341v2…