Two-Stage High Precision Membership Inference Attack

EasyChair Preprint 8027

Abstract

Most membership inference attacks (MIA) identify training set records by observing the particular behavior of machine learning models on training data, but these methods based only on overfitting are difficult to achieve high precision. Even though recent difficulty calibration techniques have alleviated this problem, calibrated attacks can still only identify a smaller number of memberships with high precision.
In this work, we rethink the value of overfitting for MIA and we argue that overfitting can provide clear signals of non-membership to the adversary. In scenarios where the cost of an attack is high, such signals can prevent the adversary from launching unnecessary attacks. We propose a simple and efficient two-stage high-precision MIA that uses an overfitting-based attack to perform ‘‘membership exclusion’’ before performing the MIA. We show that this two-stage attack can significantly increase the number of identified members while guaranteeing high precision.

Keyphrases: Overfitting, machine learning, membership inference

@booklet{EasyChair:8027,
  author    = {Shi Chen and Yubin Zhong},
  title     = {Two-Stage High Precision Membership Inference Attack},
  howpublished = {EasyChair Preprint 8027},
  year      = {EasyChair, 2022}}