Cascading and Proxy Membership Inference Attacks
This work addresses privacy risks in machine learning by improving attacks that assess data leakage, which is crucial for evaluating model security, though it is incremental as it builds on existing MIA frameworks.
The paper tackles the problem of membership inference attacks (MIAs) on machine learning models by proposing two new attacks: Cascading MIA (CMIA) for adaptive settings, which exploits membership dependencies between instances, and Proxy MIA (PMIA) for non-adaptive settings, using proxy selection and posterior odds tests. The results show that CMIA and PMIA substantially outperform existing MIAs, particularly in low false-positive regimes, with experimental validation.
A Membership Inference Attack (MIA) assesses how much a trained machine learning model reveals about its training data by determining whether specific query instances were included in the dataset. We classify existing MIAs into adaptive or non-adaptive, depending on whether the adversary is allowed to train shadow models on membership queries. In the adaptive setting, where the adversary can train shadow models after accessing query instances, we highlight the importance of exploiting membership dependencies between instances and propose an attack-agnostic framework called Cascading Membership Inference Attack (CMIA), which incorporates membership dependencies via conditional shadow training to boost membership inference performance. In the non-adaptive setting, where the adversary is restricted to training shadow models before obtaining membership queries, we introduce Proxy Membership Inference Attack (PMIA). PMIA employs a proxy selection strategy that identifies samples with similar behaviors to the query instance and uses their behaviors in shadow models to perform a membership posterior odds test for membership inference. We provide theoretical analyses for both attacks, and extensive experimental results demonstrate that CMIA and PMIA substantially outperform existing MIAs in both settings, particularly in the low false-positive regime, which is crucial for evaluating privacy risks.