论文标题
使用自我影响功能的会员推理攻击
Membership Inference Attack Using Self Influence Functions
论文作者
论文摘要
成员推理（MI）攻击旨在确定是否使用特定的数据样本来训练机器学习模型。因此，MI是对接受私人敏感数据（例如病历）培训的模型的主要隐私威胁。在MI攻击中，人们可以考虑黑框设置，其中模型的参数和激活被隐藏在对手或对攻击者可用的白色盒子情况下。在这项工作中，我们专注于后者，并为其提出了一种新型的MI攻击，它采用了影响功能，或者更具体地说是样本的自我影响得分来执行MI预测。我们使用Alexnet，Resnet和Densenet等多功能体系结构评估了对CIFAR-10，CIFAR-100和Tiny Imagenet数据集的攻击。我们的攻击方法可实现有或没有数据增强的培训的新最新结果。代码可从https://github.com/giladcohen/sif_mi_attack获得。
Member inference (MI) attacks aim to determine if a specific data sample was used to train a machine learning model. Thus, MI is a major privacy threat to models trained on private sensitive data, such as medical records. In MI attacks one may consider the black-box settings, where the model's parameters and activations are hidden from the adversary, or the white-box case where they are available to the attacker. In this work, we focus on the latter and present a novel MI attack for it that employs influence functions, or more specifically the samples' self-influence scores, to perform the MI prediction. We evaluate our attack on CIFAR-10, CIFAR-100, and Tiny ImageNet datasets, using versatile architectures such as AlexNet, ResNet, and DenseNet. Our attack method achieves new state-of-the-art results for both training with and without data augmentations. Code is available at https://github.com/giladcohen/sif_mi_attack.
