Abstract:The newly emerged machine learning（ML） methods have been widely applied to various applications, and have become a strong driving force to revolutionize a wide range of industries, which have greatly promoted the prosperity and development of artificial intelligence. Meanwhile, the training and inference of the machine learning model are based on a large amount of data, which always contains some private information. And the privacy and security of the ML has faced serious challenges. Membership inference attacks（MIAs） mainly aim to infer whether a data record was used to train a target model or not. MIAs have not only been shown to be effective on various ML models（e.g., classification models and generative models）, but also have been penetrated into the fields of image classification, speech recognition, natural language processing, computer vision and so on, which creates a great security threat to the long-term development of machine learning.Therefore, in order to better improve the security of ML models for membership inference attacks, in this paper, we systematically introduce and analyze the basic principles and characteristics of the MIAs and their defenses from a ML attack-defense perspective. Firstly, we introduce the definitions and threat models of the MIAs, and classify these MIAs from six different perspectives such as attacks’ principles, scenarios, background knowledge, target models, fields and the size of attack datasets, and we compare their advantages and disadvantages. Secondly, we summary the reasons caused the MIAs from three aspects, namely diversity of training data, types of target models and overfitting of target models. Thirdly, we survey defensive techniques for MIAs as well as their characteristics by differential privacy, regularization, data argumentation,model stacking, early stopping, confidence score masking and knowledge distillation. Futhermore, we institute the evaluation metrics and datasets used in MIAs, and the other applications of the MIAs. Finally, by comparing and analyzing the existing MIAs and their defenses, we discuss the challenges and future research directions.

Assessing Membership Leakages Via Task-Aligned Divergent Shadow Datasets in Vehicular Road Cooperation

Practical Membership Inference Attack Against Collaborative Inference in Industrial IoT

Evaluating the Impact of Adversarial Factors on Membership Inference Attacks

Shadow-Free Membership Inference Attacks: Recommender Systems Are More Vulnerable Than You Thought

Practical Blind Membership Inference Attack via Differential Comparisons

Asurvey on membership inference attacks and defenses in Machine Learning

TransMIA: Membership Inference Attacks Using Transfer Shadow Training

Defending Against Membership Inference Attack by Shielding Membership Signals

Hide in Plain Sight: Clean-Label Backdoor for Auditing Membership Inference

Debiasing Learning for Membership Inference Attacks Against Recommender Systems

l-Leaks: Membership Inference Attacks with Logits

Real-World Benchmarks Make Membership Inference Attacks Fail on Diffusion Models

Advancing Membership Inference Attacks: the Present and the Future

Privacy Analysis of Deep Learning in the Wild: Membership Inference Attacks against Transfer Learning

Investigating Membership Inference Attacks under Data Dependencies

Impact of Dataset Properties on Membership Inference Vulnerability of Deep Transfer Learning

EM-MIAs: Enhancing Membership Inference Attacks in Large Language Models through Ensemble Modeling

When Fairness Meets Privacy: Exploring Privacy Threats in Fair Binary Classifiers via Membership Inference Attacks

Membership reconstruction attack in deep neural networks

Privacy for All: Demystify Vulnerability Disparity of Differential Privacy against Membership Inference Attack

Order of Magnitude Speedups for LLM Membership Inference