Abstract:Recent studies have demonstrated the vulnerability of recommender systems to membership inference attacks, which determine whether a user’s historical data was utilized for model training, posing serious privacy leakage issues. Existing works assumed that member and non-member users follow different recommendation modes, and then infer membership based on the difference vector between the user’s historical behaviors and the recommendation list. The previous frameworks are invalid against inductive recommendations, such as sequential recommendations, since the disparities of difference vectors constructed by the recommendations between members and non-members become imperceptible. This motivates us to dig deeper into the target model. In addition, most MIA frameworks assume that they can obtain some in-distribution data from the same distribution of the target data, which is hard to gain in recommender system. To address these difficulties, we propose a Membership Inference Attack framework against sequential recommenders based on Model Extraction(ME-MIA). Specifically, we train a surrogate model to simulate the target model based on two universal loss functions. For a given behavior sequence, the loss functions ensure the recommended items and corresponding rank of the surrogate model are consistent with the target model’s recommendation. Due to the special training mode of the surrogate model, it is hard to judge which user is its member(non-member). Therefore, we establish a shadow model and use shadow model’s members(non-members) to train the attack model later. Next, we build a user feature generator to construct representative feature vectors from the shadow(surrogate) model. The crafting feature vectors are finally input into the attack model to identify users’ membership. Furthermore, to tackle the high cost of obtaining in-distribution data, we develop two variants of ME-MIA, realizing data-efficient and even data-free MIA by fabricating authentic in-distribution data. Notably, the latter is impossible in the previous works. Finally, we evaluate ME-MIA against multiple sequential recommendation models on three real-world datasets. Experimental results show that ME-MIA and its variants can achieve efficient extraction and outperform state-of-the-art algorithms in terms of attack performance.

Similarity Distribution Based Membership Inference Attack on Person Re-identification

Re-ID-leak: Membership Inference Attacks Against Person Re-identification

Deep Siamese Network with Multi-level Similarity Perception for Person Re-identification

Contribution-Based Multi-Stream Feature Distance Fusion Method with ${k}$ -Distribution Re-Ranking for Person Re-Identification

Contribution-Based Multi-Stream Feature Distance Fusion Method With <inline-formula> <tex-math notation="LaTeX">${k}$ </tex-math></inline-formula>-Distribution Re-Ranking for Person Re-Identification

Joining Features by Global Guidance with Bi-Relevance Trihard Loss for Person Re-Identification

Joint Uneven Channel Information Network with Blend Metric Loss for Person Re-Identification

A Similarity Inference Metric for RGB-Infrared Cross-Modality Person Re-identification

Membership reconstruction attack in deep neural networks

Invisible Backdoor Attack with Dynamic Triggers Against Person Re-identification

Combining Two Adversarial Attacks Against Person Re-Identification Systems

RGB-IR Person Re-identification by Cross-Modality Similarity Preservation

A statistical inference approach for person re-identification

On the Discredibility of Membership Inference Attacks

Membership inference attack with relative decision boundary distance

Practical Blind Membership Inference Attack via Differential Comparisons

Cross-Modality Perturbation Synergy Attack for Person Re-identification

Beyond Universal Person Re-ID Attack

Membership Inference Attacks on DNNs using Adversarial Perturbations

Image-Level Adaptive Adversarial Ranking for Person Re-Identification

Membership Inference Attacks Against Sequential Recommender Systems