论文标题
关于在多个会员推理攻击和目标模型下数据点的脆弱性
On the Vulnerability of Data Points under Multiple Membership Inference Attacks and Target Models
论文作者
论文摘要
会员推理攻击（MIA）推断机器学习模型的培训数据中是否存在数据点。在培训数据中，这是一个威胁，是数据点的私人信息。 MIA正确地将某些数据点作为成员或非成员培训数据。直观地，MIA准确检测到的数据点很脆弱。考虑到这些数据点可能存在于易受多种MIA的不同目标模型中，因此值得探索数据点和目标模型下的数据点的脆弱性。 本文定义了可以反映数据点漏洞的实际状况并捕获多个MIA和目标模型下的脆弱数据点的新指标。从分析中，尽管总体推断性能较低，但MIA仍具有某些数据点的推论趋势。此外，我们实施了54个MIA，其平均攻击精度范围从0.5到0.9，以通过可扩展和灵活的平台，会员推理攻击平台（VMIAP）来支持我们的分析。此外，以前的方法不适合在多个MIA和不同的目标模型下查找脆弱的数据点。最后，我们观察到漏洞不是数据点的特征，而是与MIA和目标模型有关的。
Membership Inference Attacks (MIAs) infer whether a data point is in the training data of a machine learning model. It is a threat while being in the training data is private information of a data point. MIA correctly infers some data points as members or non-members of the training data. Intuitively, data points that MIA accurately detects are vulnerable. Considering those data points may exist in different target models susceptible to multiple MIAs, the vulnerability of data points under multiple MIAs and target models is worth exploring. This paper defines new metrics that can reflect the actual situation of data points' vulnerability and capture vulnerable data points under multiple MIAs and target models. From the analysis, MIA has an inference tendency to some data points despite a low overall inference performance. Additionally, we implement 54 MIAs, whose average attack accuracy ranges from 0.5 to 0.9, to support our analysis with our scalable and flexible platform, Membership Inference Attacks Platform (VMIAP). Furthermore, previous methods are unsuitable for finding vulnerable data points under multiple MIAs and different target models. Finally, we observe that the vulnerability is not characteristic of the data point but related to the MIA and target model.
