Practical Bayes-Optimal Membership Inference Attacks
This work addresses privacy vulnerabilities in machine learning models, particularly for graph neural networks, by providing efficient and optimal attacks, though it is incremental as it builds on existing Bayesian frameworks.
The authors tackled the problem of membership inference attacks (MIAs) on machine learning models, developing practical and theoretically grounded attacks for both i.i.d. and graph-structured data, with G-BASE achieving superior performance in graph settings and BASE matching or exceeding prior state-of-the-art methods like LiRA and RMIA at significantly lower computational cost.
We develop practical and theoretically grounded membership inference attacks (MIAs) against both independent and identically distributed (i.i.d.) data and graph-structured data. Building on the Bayesian decision-theoretic framework of Sablayrolles et al., we derive the Bayes-optimal membership inference rule for node-level MIAs against graph neural networks, addressing key open questions about optimal query strategies in the graph setting. We introduce BASE and G-BASE, tractable approximations of the Bayes-optimal membership inference. G-BASE achieves superior performance compared to previously proposed classifier-based node-level MIA attacks. BASE, which is also applicable to non-graph data, matches or exceeds the performance of prior state-of-the-art MIAs, such as LiRA and RMIA, at a significantly lower computational cost. Finally, we show that BASE and RMIA are equivalent under a specific hyperparameter setting, providing a principled, Bayes-optimal justification for the RMIA attack.