Source-linked AI summary
Rethinking Membership Inference Attacks Against Transfer Learning
Cong Wu, Jing Chen, Qianru Fang, Kun He, Ziming Zhao, Hao Ren, Guowen Xu, Yang Liu, Yang Xiang
TL;DR
Transfer learning exposes an underexplored membership-inference risk involving the relationship between teacher and student models. The paper proposes a white-box attack that analyzes student and shadow-model representations, finding that teacher-training data remains susceptible to inference even when only the student model is accessible.
Problem
Membership inference in transfer learning has limited evidence about whether teacher-model training data can be exposed through the student model, despite sensitive data sharing across organizations.
Method
The attack uses white-box access to the student model, differential hidden-representation analysis against a shadow student, adaptive thresholds, and a ternary decision framework.
Results
Across four datasets and diverse transfer-learning tasks, the attack achieves high accuracy and exposes teacher-model membership privacy more effectively than previous black-box MIAs.
Takeaways & Limitations
Teacher–student interactions and transferred representations should be considered when assessing and strengthening privacy protections for transfer-learning systems.
Takeaways & Limitations
The study evaluates only image-classification tasks and typical parameter-based transfer learning, excluding other domains and transfer-learning types.
Abstract
from arXiv · showhide
Transfer learning, successful in knowledge translation across related tasks, faces a substantial privacy threat from membership inference attacks (MIAs). These attacks, despite posing significant risk to ML model's training data, remain limited-explored in transfer learning. The interaction between teacher and student models in transfer learning has not been thoroughly explored in MIAs, potentially resulting in an under-examined aspect of privacy vulnerabilities within transfer learning. In this paper, we propose a new MIA vector against transfer learning, to determine whether a specific data point was used to train the teacher model while only accessing the student model in a white-box setting. Our method delves into the intricate relationship between teacher and student models, analyzing the discrepancies in hidden layer representations between the student model and its shadow counterpart. These identified differences are then adeptly utilized to refine the shadow model's training process and to inform membership inference decisions effectively. Our method, evaluated across four datasets in diverse transfer learning tasks, reveals that even when an attacker only has access to the student model, the teacher model's training data remains susceptible to MIAs. We believe our work unveils the unexplored risk of membership inference in transfer learning.
I. INTRODUCTION
Transfer learning broadens access to models and knowledge but creates privacy concerns because sensitive data can cross organizational boundaries. This paper introduces a white-box MIA targeting teacher-model membership through student-model representations and evaluates it across diverse settings.
- Transfer learning adapts models developed with extensive data for smaller entities without requiring substantial labeled data.
- Sensitive data sharing across organizations increases privacy concerns surrounding membership inference attacks in transfer learning.
- Prior transfer-learning MIA studies used black-box approaches but did not fully examine the teacher–student relationship in a white-box setting.
- The proposed attack infers teacher-training membership from student-model access by analyzing differences between actual and shadow student representations.
- The method combines differential representation analysis, adaptive threshold selection, and a ternary decision framework for teacher–student privacy analysis.
- Evaluations span four datasets, diverse settings, and transfer-learning tasks, with comparisons against state-of-the-art methods and related attack scenarios.
B. Membership Inference Attack
Membership inference attacks determine whether a data record belonged to a model’s training set using accessible model information. In transfer learning, this paper frames the threat around inferring teacher-model membership from intermediate outputs of a student model.
- A membership inference attack classifies whether a target record originated from a model’s training data.
- Black-box attacks expose only model outputs, whereas white-box attacks can expose weights, architecture, and sometimes gradients.
- Teacher models may contain proprietary data from sensitive applications such as fraud detection, medical imaging, or biometric recognition.
- In transfer learning, attackers analyze student-model intermediate outputs because the student retains information transferred from the teacher.
- Shadow models can mimic student behavior, enabling attackers to compare feature representations and estimate whether data belonged to the teacher’s training set.
B. Threat Model
The threat model examines three white-box membership-inference settings, emphasizing teacher-data inference through student-model access. It formalizes the proposed three-class attack and grounds it in differences between student and shadow-student representations.
- The study considers teacher-membership inference through student access, direct teacher-model inference, and direct student-model inference.
- In At.T & Ac.S, the attacker accesses the student model and its training-data distribution but lacks knowledge of the teacher model.
- Teacher and student attacks differ in complexity because teacher training generally uses more data, whereas students are fine-tuned on smaller datasets.
- White-box access intentionally represents an upper-bound attacker capability for stringent security evaluation and worst-case preparedness.
- For At.T & Ac.S, the attack model is a three-class classifier labeling teacher members, student members, and non-members as 1, 2, and 0, respectively.
- The proposed intuition is that data-dependent representation differences between student and shadow-student models can reveal traces of teacher-training membership.
IV. ATTACK DESIGN
The attack design trains an inference model from student and shadow-student intermediate representations, their differences, and synthetic non-member examples. This produces labeled examples for distinguishing teacher members, student members, and non-members.
- The At.T & Ac.S workflow splits shadow-student data into member and non-member subsets, trains a shadow student, and queries both student models for intermediate representations.
- The design also contrasts direct teacher and student attacks, whose workflows query the corresponding shadow model using data used in shadow training.
- The attacker computes L2 distances between actual and shadow-student representations to represent possible teacher-membership signals.
- Random noisy images provide non-semantic queries whose student-model representations are labeled as non-member examples.
- The attack model is trained on three classes: teacher-member, student-member, and non-member.
- The training data assign label 2 to shadow-student members, label 1 to representation differences for teacher members, and label 0 to noisy-image examples.
B. Attack Strategy
During inference, the attack compares a target’s student representation with shadow-member representations using distance thresholds. Intermediate distances trigger a second comparison against teacher-member difference representations.
- The attacker extracts the target record’s intermediate student representation and compares it with labeled training representations using L2 distance.
- A target within the student-member distance region is classified as a student member with attack result 2.
- For intermediate distances, the attack performs a second comparison against labeled teacher-member representations.
- If the second distance is below σ3, the target is classified as a teacher member; otherwise it is classified as a non-member.
- Targets beyond σ2 are assigned attack result 1 because their representations differ from shadow-model member representations.
- The distance thresholds categorize alignment with known representations to distinguish membership status.
C. Threshold Selection
Threshold selection uses medians of distances derived from student-shadow members, actual student outputs, noisy-image queries, and representation differences. These thresholds define the three-stage decision process.
- σ1 is selected from distances between shadow-student and actual-student representations for shadow-member data.
- σ2 is the median distance between noisy-image queries through the student model and shadow-model member representations.
- σ3 is selected by comparing noisy-image representations with student–shadow representation differences.
- Threshold selection outputs σ1, σ2, and σ3 for the attack procedure.
V. OTHER TWO TYPICAL ATTACKS
The paper describes two white-box transfer-learning MIA baselines: attacks using teacher-model representations and attacks using student-model representations. Shadow-model intermediate features are labeled by membership status and used to train attack classifiers.
- Comparison: These two white-box attacks are presented as typical transfer-learning MIA methods for comparison.The schemes rely on access to intermediate-layer outputs rather than only final predictions.
- At.T & Ac.T: The At.T & Ac.T attack trains an attack model to distinguish member and non-member records from shadow teacher-model intermediate representations.Member examples receive label 1, while non-member examples receive label 0.
- At.S & Ac.S: The At.S & Ac.S attack queries a shadow student model and labels intermediate representations according to whether records participated in shadow-model training.The resulting representations and labels train a binary classification model for membership prediction.
VI. EXPERIMENTAL RESULTS
This section reports the performance results of the evaluated attacks.
- Experimental Results: The section introduces the reporting of performance results.No specific metric or numerical outcome is stated in the supplied passage.
- Experimental Results: The supplied passage identifies performance reporting as the focus of this experimental section.The passage does not specify datasets, methods, or comparisons.
- Experimental Results: No quantitative result is provided in the supplied section-opening statement.The statement only announces that performance results will be reported.
A. Evaluation Setup
The evaluation uses multiple established datasets and transfer-learning configurations to test membership inference under controlled teacher–student settings. It measures attack performance with standard binary-classification metrics and evaluates the proposed attack on several model and dataset combinations.
- Datasets: The evaluation uses ImageNet, CIFAR-100, Flowers102, and Cats vs. Dogs across teacher and student transfer-learning tasks.ImageNet supplies the teacher pre-training data, while the other datasets support student-task evaluation.
- Model configuration: The experiments predominantly use ResNet50, freeze teacher-model Parts 1–3, and fine-tune student models on CIFAR-100, Flowers102, and Cats vs. Dogs.The ResNet50 is divided into five parts for transfer-learning evaluation.
- Evaluation protocol: Teacher and student data are divided into balanced member and non-member groups without overlap for evaluation.Shadow datasets are split 70% for training and 30% for testing, and attack queries use balanced member and non-member samples.
- Metrics: Attack performance is measured with precision, recall, accuracy, and AUC.These metrics quantify classification correctness, member detection, predicted-member reliability, and ranking separation between members and non-members.
- Overall performance: On the three student datasets, the proposed attack achieves accuracies of 0.581, 0.632, and 0.728 for CIFAR-100, Flowers102, and Cats vs. Dogs, respectively.The corresponding AUC values approach or exceed 0.7.
C. Impact of the Number of Frozen Layers
The experiments vary how many ResNet50 parts remain frozen during transfer learning and examine how this choice affects attack performance. Attack accuracy generally increases with more frozen layers, although the magnitude varies across datasets.
- Cats vs. Dogs: 0.637, 0.664, and 0.809 attack accuracy are obtained when freezing Parts 1–2, 1–3, and 1–4, respectively, on Cats vs. Dogs.The reported sequence shows higher attack accuracy as more teacher-model parts are frozen.
- Interpretation: The authors suggest that freezing more layers preserves abstract features that help distinguish records from the teacher dataset.They also state that more freezing can limit adaptability when task nuances differ.
- Cross-dataset results: On CIFAR-100, attack accuracy ranges from 0.527 to 0.681 across different frozen-part configurations.The passage reports a consistent improvement trend as more layers are frozen.
- Cross-dataset results: On Flowers102, attack accuracy ranges from 0.582 to 0.652 across different frozen-part configurations.The improvement with more frozen layers is reported as less pronounced than in the other datasets.
- Comparison with SOTA Methods: The section compares the proposed method with Zou et al. and TransMIA across three datasets.The supplied comparison passages state that the proposed approach outperforms existing methods on all three datasets.
- Comparison with SOTA Methods: On Cats vs. Dogs, the proposed method reaches 0.728 accuracy versus 0.624 for TransMIA and 0.539 for Zou et al.On CIFAR-100, it reaches 0.581 versus 0.525 for TransMIA and 0.478 for Zou et al.
- Teacher-model variation: Across VGG19, ResNet50, Inception v3, and DenseNet169, the proposed method generalizes to different teacher-model structures.For CIFAR-100, the reported accuracies are 0.581, 0.545, 0.568, and 0.593, respectively; for Cats vs. Dogs, they are 0.728, 0.627, 0.700, and 0.725.
F. Performance of At.T & Ac.T and At.S & Ac.S.
The evaluation measures attack performance across teacher- and student-access scenarios and multiple transfer-learning datasets. The proposed method achieves effective membership inference and exploits teacher–student representation relationships that prior work did not fully examine.
- At.T & Ac.T: The method evaluates At.T & Ac.T using ImageNet as the teacher dataset across VGG19, ResNet50, Inception v3, and DenseNet169.
- At.T & Ac.T: 0.732, 0.652, 0.751, and 0.769 attack accuracy were achieved under the four evaluated teacher models.The corresponding attack AUC values were 0.869, 0.714, 0.830, and 0.849.
- At.S & Ac.S: The paper reports that dataset overlap and task specificity may affect attack accuracy, with ImageNet-to-Flowers102 transfer offered as an example.
- At.S & Ac.S: The student-access evaluation transfers a ResNet50 teacher trained on ImageNet to CIFAR-100, Flowers102, and Cats vs Dogs tasks.Parts 1–3 of the teacher model were frozen during student-model training.
- Comparison with prior work: Prior transfer-learning MIA studies explored black-box attacks or transfer shadow training but did not fully examine teacher–student interrelations in a white-box setting.
VIII. DISCUSSION
The discussion outlines mitigation options and clarifies the study’s scope and assumptions. It emphasizes that defenses, broader transfer-learning settings, and alternative architectures or metrics require further evaluation.
- Attack mitigation strategies: Specific defenses for MIAs in transfer learning are not well-defined, limiting comparison with established MIA defenses.The paper identifies tailored defense development and assessment as an open research need.
- Attack mitigation strategies: The study considers output randomization and differential privacy, adversarial training, and generative learning as potential mitigation strategies.The paper notes that noise-based defenses may reduce model performance.
- Limitations and future work: The evaluation is limited to image classification and parameter-based transfer learning, excluding domains such as natural language processing and other transfer-learning types.
- Assumptions: The threat model assumes white-box access and uses the same dataset to underscore effectiveness despite possible differences between real-world shadow and teacher/student distributions.
- Limitations and future work: Future work should examine additional architectures and frameworks, including Inception v2, EfficientNet, and transformers.
- Conclusion: The study concludes that teacher–student feature-representation differences expose teacher-model privacy vulnerabilities to membership inference.