Do Backdoors Assist Membership Inference Attacks?
This work addresses privacy leakage concerns in machine learning by showing that backdoors are ineffective for membership inference attacks, which is an incremental finding as it clarifies limitations of existing attack methods.
The paper investigated whether backdoors can assist membership inference attacks, finding that backdoors cannot separate loss distributions of training and non-training samples and thus do not aid such attacks, with experiments on an academic benchmark dataset showing unsuccessful results.
When an adversary provides poison samples to a machine learning model, privacy leakage, such as membership inference attacks that infer whether a sample was included in the training of the model, becomes effective by moving the sample to an outlier. However, the attacks can be detected because inference accuracy deteriorates due to poison samples. In this paper, we discuss a \textit{backdoor-assisted membership inference attack}, a novel membership inference attack based on backdoors that return the adversary's expected output for a triggered sample. We found three crucial insights through experiments with an academic benchmark dataset. We first demonstrate that the backdoor-assisted membership inference attack is unsuccessful. Second, when we analyzed loss distributions to understand the reason for the unsuccessful results, we found that backdoors cannot separate loss distributions of training and non-training samples. In other words, backdoors cannot affect the distribution of clean samples. Third, we also show that poison and triggered samples activate neurons of different distributions. Specifically, backdoors make any clean sample an inlier, contrary to poisoning samples. As a result, we confirm that backdoors cannot assist membership inference.