Uncovering Memorization in Timeseries Imputation models: LBRM Membership Inference and its link to attribute Leakage
This work addresses critical privacy concerns for users in healthcare, IoT, and finance by exposing vulnerabilities in widely used time series imputation models, though it is incremental as it builds on existing memorization studies.
The paper tackled privacy vulnerabilities in deep learning models for time series imputation by introducing a two-stage attack framework, including a novel membership inference attack that significantly improves detection accuracy and the first attribute inference attack for such models, with results showing a high tpr@top25% score and 90% precision in linking attacks.
Deep learning models for time series imputation are now essential in fields such as healthcare, the Internet of Things (IoT), and finance. However, their deployment raises critical privacy concerns. Beyond the well-known issue of unintended memorization, which has been extensively studied in generative models, we demonstrate that time series models are vulnerable to inference attacks in a black-box setting. In this work, we introduce a two-stage attack framework comprising: (1) a novel membership inference attack based on a reference model that improves detection accuracy, even for models robust to overfitting-based attacks, and (2) the first attribute inference attack that predicts sensitive characteristics of the training data for timeseries imputation model. We evaluate these attacks on attention-based and autoencoder architectures in two scenarios: models that are trained from scratch, and fine-tuned models where the adversary has access to the initial weights. Our experimental results demonstrate that the proposed membership attack retrieves a significant portion of the training data with a tpr@top25% score significantly higher than a naive attack baseline. We show that our membership attack also provides a good insight of whether attribute inference will work (with a precision of 90% instead of 78% in the genral case).