Fundamental Limits of Membership Inference Attacks on Machine Learning Models
This work addresses privacy risks for individuals in machine learning by providing foundational theoretical insights into MIA limitations, though it is incremental in building on existing attack frameworks.
The paper tackles the problem of membership inference attacks (MIA) on machine learning models by deriving theoretical guarantees on their statistical limitations, showing that attacks can have high success probability in overfitting non-linear regression and that data discretization can enhance security, with bounds quantified by data distribution diversity.
Membership inference attacks (MIA) can reveal whether a particular data point was part of the training dataset, potentially exposing sensitive information about individuals. This article provides theoretical guarantees by exploring the fundamental statistical limitations associated with MIAs on machine learning models at large. More precisely, we first derive the statistical quantity that governs the effectiveness and success of such attacks. We then theoretically prove that in a non-linear regression setting with overfitting learning procedures, attacks may have a high probability of success. Finally, we investigate several situations for which we provide bounds on this quantity of interest. Interestingly, our findings indicate that discretizing the data might enhance the learning procedure's security. Specifically, it is demonstrated to be limited by a constant, which quantifies the diversity of the underlying data distribution. We illustrate those results through simple simulations.