Is Difficulty Calibration All We Need? Towards More Practical Membership Inference Attacks

Yu He,Boheng Li,Yao Wang,Mengda Yang,Juan Wang,Hongxin Hu,Xingyu Zhao
2024-09-04
Abstract:The vulnerability of machine learning models to Membership Inference Attacks (MIAs) has garnered considerable attention in recent years. These attacks determine whether a data sample belongs to the model's training set or not. Recent research has focused on reference-based attacks, which leverage difficulty calibration with independently trained reference models. While empirical studies have demonstrated its effectiveness, there is a notable gap in our understanding of the circumstances under which it succeeds or fails. In this paper, we take a further step towards a deeper understanding of the role of difficulty calibration. Our observations reveal inherent limitations in calibration methods, leading to the misclassification of non-members and suboptimal performance, particularly on high-loss samples. We further identify that these errors stem from an imperfect sampling of the potential distribution and a strong dependence of membership scores on the model parameters. By shedding light on these issues, we propose RAPID: a query-efficient and computation-efficient MIA that directly \textbf{R}e-lever\textbf{A}ges the original membershi\textbf{P} scores to m\textbf{I}tigate the errors in \textbf{D}ifficulty calibration. Our experimental results, spanning 9 datasets and 5 model architectures, demonstrate that RAPID outperforms previous state-of-the-art attacks (e.g., LiRA and Canary offline) across different metrics while remaining computationally efficient. Our observations and analysis challenge the current de facto paradigm of difficulty calibration in high-precision inference, encouraging greater attention to the persistent risks posed by MIAs in more practical scenarios.
Cryptography and Security
What problem does this paper attempt to address?
The problem that this paper attempts to solve is: **How to more effectively deal with the limitations of difficulty calibration in Membership Inference Attacks (MIAs) to achieve more powerful and practical attack methods**. Specifically, although the existing MIAs based on difficulty calibration perform well on some metrics, they have the following problems in practical applications: 1. **Non - member misclassification**: Difficulty calibration may cause some samples that should be correctly classified as non - members to be misclassified, resulting in performance degradation. 2. **Dependence on model parameters**: The member scores are highly dependent on model parameters, which makes the effect of difficulty calibration unstable. 3. **Sampling bias**: The reference data set is only a subset of the potential distribution and cannot fully represent the entire distribution, resulting in calibration errors. To solve these problems, the author proposes a new attack method - **RAPID** (Re - lever Aging the original membership scores to mitigate errors in Difficulty calibration). The main features of RAPID include: - **Direct use of original member scores**: By re - using the original member scores to correct errors in difficulty calibration, it avoids relying on a large number of reference models. - **High efficiency and practicality**: RAPID is not only superior to existing methods in performance, but also has lower computational costs and is more suitable for practical application scenarios. ### Formula summary 1. **Member scores after difficulty calibration**: \[ S'(x, y)=S(x, y)-\mathbb{E}_{M_{\text{ref}}\sim T(D_{\text{attack}})}[S(x, y)] \] where \(S(x, y)\) is the original member score, and \(\mathbb{E}_{M_{\text{ref}}\sim T(D_{\text{attack}})}[S(x, y)]\) is the average member score of the reference model. 2. **The final member score of RAPID**: \[ A(x, y)=1[M_{\text{score}}(S, S') > t] \] where \(M_{\text{score}}\) is a scoring model used to map the original member score and the calibrated member score to the final member score, and \(t\) is the decision threshold. Through these improvements, RAPID can significantly improve the accuracy and practicality of membership inference attacks while maintaining high efficiency.