PaperlayerView exact revision on arXiv

Source-linked AI summary

Membership Inference Attacks by Exploiting Loss Trajectory

Yiyong Liu, Zhengyu Zhao, Michael Backes, Yang Zhang

arXiv:2208.14933v1cs.CRcs.LG

TL;DR

Existing membership inference attacks struggle when members and non-members have similarly small losses. TRAJECTORYMIA uses knowledge distillation to exploit loss trajectories from intermediate models in the black-box setting, achieving stronger attack performance, especially at low false-positive rates.

  • Problem

    Existing attacks mainly use losses from the final target model and cannot reliably distinguish members from non-members with similarly small losses.

  • Method

    TRAJECTORYMIA uses knowledge distillation to obtain intermediate models and combines their loss trajectory with losses from the original models for black-box membership inference.

  • Results

    TRAJECTORYMIA consistently outperforms advanced attack methods, including in stricter scenarios with relaxed assumptions.

  • Takeaways & Limitations

    Loss trajectories provide membership information beyond the final model loss and improve attack performance at low false-positive rates.

  • Takeaways & Limitations

    Differential privacy can strongly protect against membership inference attacks but may severely degrade classification accuracy, limiting its practical feasibility.

Abstract

from arXiv · show

Machine learning models are vulnerable to membership inference attacks in which an adversary aims to predict whether or not a particular sample was contained in the target model's training dataset. Existing attack methods have commonly exploited the output information (mostly, losses) solely from the given target model. As a result, in practical scenarios where both the member and non-member samples yield similarly small losses, these methods are naturally unable to differentiate between them. To address this limitation, in this paper, we propose a new attack method, called \system, which can exploit the membership information from the whole training process of the target model for improving the attack performance. To mount the attack in the common black-box setting, we leverage knowledge distillation, and represent the membership information by the losses evaluated on a sequence of intermediate models at different distillation epochs, namely \emph{distilled loss trajectory}, together with the loss from the given target model. Experimental results over different datasets and model architectures demonstrate the great advantage of our attack in terms of different metrics. For example, on CINIC-10, our attack achieves at least 6$\times$ higher true-positive rate at a low false-positive rate of 0.1\% than existing methods. Further analysis demonstrates the general effectiveness of our attack in more strict scenarios.

1 Introduction

Membership inference attacks typically use losses from the final target model, but struggle when members and non-members have similarly small losses. TRAJECTORYMIA addresses this by using loss trajectories recovered through knowledge distillation, with experiments showing stronger performance across ordinary and stricter settings.

  • Motivation: Membership inference attacks assess whether a target sample was used to train a specific model, an important privacy risk for models trained on sensitive data.Membership inference attacks are described as the de facto standard for evaluating machine-learning privacy risks.
  • Motivation: Existing attacks commonly use target-model losses or posteriors and cannot reliably distinguish members from non-members with similarly small losses.This limitation contributes to relatively high false-positive rates and motivates reducing false positives.
  • Motivation: Members and non-members with similarly small final losses can exhibit substantially different loss trajectories across training epochs.The paper attributes this pattern to easy non-members versus members that are gradually learned throughout training.
  • Method: TRAJECTORYMIA uses knowledge distillation to obtain intermediate distilled models and classifies membership from the resulting loss trajectory together with the original target-model loss.The adversary distills the target model once, preserves intermediate versions, and reuses them for target samples at inference time.
  • Results: 5.3% TPR at 0.1% FPR on CINIC-10 was at least 6× better than other considered advanced attacks.The evaluation also examines balanced accuracy, ROC-AUC, varied target-sample loss groups, and factors affecting attack success.
  • Results: TRAJECTORYMIA consistently outperformed advanced attack methods in common scenarios and stricter scenarios with relaxed assumptions.The paper also analyzes the effects of its components and other factors on attack performance.

2 Preliminary

This section introduces classification models, loss-based training, membership inference attacks, knowledge distillation, and common threat and defense settings. Membership inference identifies whether a sample was used to train a model using available model outputs and auxiliary knowledge.

  • Machine Learning: A classification model maps each sample to prediction posteriors, while a loss function measures the error between predictions and the corresponding label.
  • Machine Learning: Cross-entropy is a common classification loss, and training minimizes empirical loss through stochastic gradient descent over multiple epochs.Intermediate models may be preserved at different epochs.
  • Membership Inference Attacks: Membership inference attacks determine whether a target sample belongs to a model’s training set, commonly using a binary classifier.
  • Membership Inference Attacks: In the standard black-box setting, the adversary observes target-model posteriors, uses same-distribution auxiliary data to train a shadow model, and trains an attack classifier.
  • Membership Inference Attacks: White-box attacks assume access to model architecture and parameters, whereas label-only attacks use only hard predictions and perturbations.
  • Membership Inference Attacks: Regularization, knowledge distillation, output obfuscation, and differential privacy can defend against membership inference, but DP-SGD may severely reduce task accuracy.
  • Knowledge Distillation: Knowledge distillation trains a student to match a teacher’s outputs, using softened posteriors and a loss combining classification and distillation objectives.The distillation loss compares softened teacher and student posteriors using Kullback–Leibler divergence; this paper sets α = 0 and τ = 1.

3 Attack Methodology

TRAJECTORYMIA exploits loss trajectories rather than only final-model losses. In black-box settings, knowledge distillation produces intermediate target and shadow models whose losses, together with original-model losses, become attack inputs.

  • Threat Model: The methodology targets black-box attacks where the adversary observes posterior outputs and has an auxiliary dataset from the target training distribution.
  • Design Intuition: Final-model loss attacks can fail when members and non-members have similarly small losses, motivating analysis of their changing losses across training.
  • Design Intuition: Members and non-members can exhibit different loss trajectories because members participate in training; the paper links this difference to sample hardness.Reported hardness values are 35.4 versus 26.1 for one metric and 0.006 versus 0.005 for another, for members versus non-members.
  • Attack Method: TRAJECTORYMIA distills the target and shadow models, preserves intermediate distilled models, and feeds their losses together with original-model loss to the attack model.
  • Attack Method: The pipeline has four stages: shadow-model training, model distillation, attack-model training, and membership inference.Model distillation is the newly introduced stage, while the other stages follow the common membership-inference pipeline with different attack inputs.
  • Attack Method: A split auxiliary dataset supplies shadow-model data and a distillation dataset used to obtain intermediate shadow and target models.
  • Attack Method: The attack model uses concatenated losses from all distilled shadow models and the original shadow model, then evaluates target samples using N + 1 target models.
  • Attack Method: For label-only attacks, hard predicted labels replace posteriors during distillation, while the target-model loss is replaced by HopSkipJump boundary distance.

4 Evaluation

The evaluation tests TRAJECTORYMIA across datasets, architectures, metrics, black-box and label-only settings, and differential-privacy defenses. It consistently performs strongly, especially in low-FPR membership inference, while DP improves defense at a substantial accuracy cost.

  • Metrics: TPR at 0.1% FPR measures attack performance at a single low false-positive rate, while balanced accuracy and AUC provide average-case comparisons.The evaluation also uses log-scale ROC curves to emphasize the low-FPR regime.
  • Black-box Attacks: TRAJECTORYMIA consistently achieves the best low-FPR performance and strictly dominates the baselines in balanced accuracy and AUC.This conclusion is reported for attacks in the black-box scenario across the evaluated datasets and architectures.
  • Fine-grained Evaluation: Across small, medium, and large target-model loss ranges, TRAJECTORYMIA outperforms all other baselines at 0.1% FPR.The loss ranges are [0.0,0.02), [0.02,0.2), and [0.2,+∞]; similar patterns hold across additional architectures and datasets.
  • Comparison with LiRA: TRAJECTORYMIA achieves comparable but slightly higher attack performance than LiRA without requiring inference-time shadow-model training.LiRA requires 256 shadow models for each target sample at inference time, whereas TRAJECTORYMIA only queries the loss trajectory.
  • Differential Privacy: Under DP-SGD, all attacks are strongly weakened, but TRAJECTORYMIA remains superior across privacy budgets.The defense also heavily reduces classification accuracy, including when C = 10, σ = 0.0, and ε = ∞.

5 Ablation Study

The ablations show that attack performance depends on the knowledge-distillation dataset and training duration, while overfitting increases vulnerability. Larger distillation sets are especially effective, and excessive epochs can reduce efficiency or performance.

  • Distillation Dataset Size: Increasing the knowledge-distillation dataset size improves TPR at 0.1% FPR and balanced accuracy while leaving distilled-model classification accuracy similar.The explored dataset size varies from 20000 to 220000 samples, suggesting membership information is not directly tied to distilled-model functionality.
  • Distillation Epochs: More distillation epochs increase low-FPR attack TPR but have little effect on attack accuracy across datasets and architectures.The marginal benefit decreases as the number of epochs grows.
  • Distillation Epochs: Stopping distillation when the distilled model reaches functionality comparable to the target can save computation while preserving considerable attack performance.On GTSRB, continuing for too many epochs after this point can degrade attack performance.
  • Distillation Trade-offs: Using 220000 distillation samples for 1 epoch can achieve comparable TPR at 0.1% FPR to using 20000 samples for 100 epochs.The reported comparison indicates distillation-set size has a more significant effect than additional epochs in this setting.

(a) TPR at 0.1% FPR

The analysis examines how attack performance changes with overfitting, auxiliary-data distribution, and model-architecture assumptions. Performance remains strong for a well-generalized target but generally declines under distribution shift.

  • Overfitting: A training set size of 30000 still yields 2.8% TPR at 0.1% FPR, although greater overfitting makes the target model more vulnerable.Increasing training-set size lowers the training-testing accuracy gap, representing reduced overfitting.
  • Distribution Shift: When target and auxiliary data come from different distributions, attack performance decreases in most cases.The shifted setting trains the target on CINIC-10’s CIFAR-10 portion while the adversary accesses its ImageNet portion.
  • Distribution Shift: Distribution shift can alter shadow-model functionality and make the distilled loss trajectory differ more from the target model’s actual trajectory.Both effects are identified as explanations for the observed performance decrease.
  • Architecture Assumptions: The attack performs best when the shadow and distilled models use the same architecture, even as target-model architecture assumptions are varied.The shadow and distilled architectures remain under the adversary’s local control in this analysis.

6 Discussion

The discussion analyzes how trajectory components and model choices affect TRAJECTORYMIA, showing that distilled trajectories and original-model losses jointly improve low-FPR attack performance.

  • Distilled Loss Trajectory: Using the distilled loss trajectory achieves more than 10× TPR at 0.1% FPR compared with using only the last distilled model.The attack also consistently achieves the best TPR across the full FPR range.
  • Loss from Original Models: Adding the original-model loss increases TPR at 0.1% FPR from 1.7% to 5.3%.Removing the original-model loss from the comparison method decreases TPR at 0.1% FPR from 1.2% to 0.1%.
  • Distilled Shadow Models: The attack uses distilled shadow models despite access to the actual locally trained shadow-model trajectory.This design follows the evidence that distilled trajectories better match the target-side trajectory used by the attack.
  • Distilled Shadow Models: The distilled loss trajectory yields about 2× higher TPR at 0.1% FPR than the shadow model’s actual loss trajectory.The actual trajectory is less aligned with the target model’s distilled trajectory because distillation and original training can reach similar accuracy at different epochs.

7 Related Work

Related work covers black-box membership inference, methods targeting high false-positive rates, knowledge distillation, and the distinction between prior distillation goals and this paper’s membership-information objective.

  • Membership Inference Attacks: Early black-box MIAs trained shadow models to mimic the target model and used their posteriors to train attack models.This line of work established shadow-model-based membership inference in black-box settings.
  • Membership Inference Attacks: Recent MIAs address high false-positive rates using knowledge distillation, calibration with models trained with and without the sample, or reference-model hardness.These approaches use additional model outputs or loss differences to improve membership inference.
  • Knowledge Distillation: Knowledge distillation research develops teacher-to-student transfer methods and applies them across architectures and domains.The cited literature includes thinner, deeper student models and attention-based distillation.
  • Knowledge Distillation: Unlike self-distillation, this work uses knowledge distillation to extract membership information from loss trajectories rather than primarily improve student-model performance.The teacher and student in self-distillation have identical architectures, whereas this paper prioritizes membership information over general model performance.

8 Conclusion

The conclusion presents TRAJECTORYMIA as a black-box attack that extracts membership information from target-model training through knowledge distillation and evaluates its effectiveness across settings.

  • 8 Conclusion: TRAJECTORYMIA uses knowledge distillation to extract target-model loss trajectories with only black-box access.The trajectory consists of losses evaluated at different target-model training epochs.
  • 8 Conclusion: Experiments show state-of-the-art performance, especially for true-positive rate at low false-positive rates, across different target-sample loss groups.Additional analyses examine the importance of each attack component.
  • 8 Conclusion: Future work could model loss trajectories more finely instead of using the whole trajectory directly as the input feature.This is identified as a promising direction for extending the attack.

A.1 Data Splits on Different Datasets

The evaluation uses specified data splits across different datasets.

  • A.1 Data Splits on Different Datasets: Table 11 reports the data splits used for the evaluation on different datasets.The passage identifies the table’s purpose but does not provide the individual split values.

A.2 Additional Results on Different Models

This section reports additional attack-performance results across MobileNetV2, VGG-16, WideResNet-32, and MLP models using tables, ROC curves, and loss-range analyses.

  • Convolutional models: Tables 12–14 report attack performance across four datasets for MobileNetV2, VGG-16, and WideResNet-32 models.These tables cover the three listed convolutional model architectures.
  • Loss-range analyses: Figures 15–17 compare TPR at 0.1% FPR across attacks and three target-model loss ranges for MobileNetV2, VGG-16, and WideResNet-32.The ranges are small [0.0,0.02), medium [0.02,0.2), and large [0.2,+∞].
  • MLP model: Table 15 reports attack performance for an MLP trained on Purchase, Location, and News.
  • ROC analysis: Figure 18 provides ROC curves for attacks against an MLP on Purchase, Location, and News.
  • Loss-range analyses: Figure 19 presents the same TPR-at-0.1%-FPR loss-range analysis for an MLP trained on Purchase, Location, and News.It uses the small, medium, and large target-model loss ranges.
Loading 2208.14933v1…