Cascading and Proxy Membership Inference Attacks

Cascading and Proxy Membership Inference Attacks

Speakers: Yuntao Du

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=NPal-ujxk2Y

Overview

Membership inference attacks (MIA) determine whether specific data was used to train a machine learning model. This talk introduces two new attack strategies that fundamentally improve MIA effectiveness by exploiting a previously overlooked property: the statistical dependence between membership decisions of different instances. The Cascading MIA for adaptive settings iteratively determines membership by fixing high-confidence decisions first and retraining shadow models with that prior knowledge, boosting state-of-the-art attack performance by several times. The Proxy MIA for non-adaptive settings replaces unavailable "in-model" behaviors with proxy points from the adversary's own data, enabling the powerful likelihood ratio test without per-query shadow model retraining.

The work also provides a refined security game formalization that cleanly distinguishes adaptive from non-adaptive attack settings, resolving definitional ambiguity in the MIA literature. Both attacks are validated across multiple benchmarks, with Cascading MIA boosting LiRA (the state-of-the-art adaptive attack) by several times, and Proxy MIA outperforming all existing non-adaptive attacks.

Background

▶ Watch: Background: shadow training as the core MIA technique (0:00)

Membership inference attacks have been studied extensively over the past decade. The core technique underlying state-of-the-art attacks is shadow training: the adversary trains multiple models that either include (in-models) or exclude (out-models) a target instance, then compares the target model's output signal against the distributions from in and out models to determine membership.

The MIA security game involves three key datasets: D (the target model's training data), D_query (instances whose membership must be determined), and D_adv (adversary's sampled data from the same distribution). The relationship between D_query and D_adv defines the attack setting.

Previous work distinguished "online" and "offline" settings, but the definitions were ambiguous. This paper reformulates them as adaptive and non-adaptive settings with a clearer formalization:

• Adaptive: The adversary trains shadow models after receiving D_query, enabling instance-specific in/out models. This is the worst-case scenario.
• Non-adaptive: The adversary trains shadow models before seeing D_query, making per-instance in-model behavior unavailable. This is more realistic since shadow models need only be trained once.

Key Findings

▶ Watch: Key problem: existing definitions can't distinguish attack settings (4:00)

• Cascading MIA boosts LiRA by several times, especially on harder datasets like MNIST, with the largest gains at extremely low false positive rates where precision matters most
• Most improvement comes from initial iterations: The biggest performance gains occur in the first few cascading rounds, with marginal returns after that -- practically important since each iteration requires retraining shadow models
• Cascading is stronger when the base attack is also strong: The framework amplifies the effectiveness of whatever base MIA it wraps
• Proxy MIA outperforms all non-adaptive baselines by replacing unavailable in-model behaviors with proxy data points, enabling the likelihood ratio test in settings where it was previously inapplicable
• In-behaviors of similar instances are not that different: The key insight behind Proxy MIA is that instances similar to the query exhibit similar behavior when included in training, making proxy substitution feasible
• Proxy MIA is significantly more efficient than adaptive approaches since shadow models only need to be trained once and inference is cheap

Technical Deep Dive

▶ Watch: Cascading process: fix confident decisions, retrain shadows, iterate (8:00)

Cascading MIA (Adaptive Setting): The core insight is that membership decisions for different instances in D_query are not independent when conditioned on the target model's parameters. If two similar instances (e.g., two cat images) both show low loss on the target model, and we determine that one is a training member, we should lower our confidence that the other is also a member -- its low loss is explained by the similarity to the known member, not necessarily by its own membership.

The cascading process works as follows:

1. Apply any base MIA attack to the full D_query
2. Identify high-confidence decisions (instances that are clearly members or non-members)
3. Fix those membership labels and retrain shadow models incorporating this prior knowledge
4. Apply the same base attack to the remaining undetermined instances
5. Repeat until all instances are classified

This creates a probabilistic graphical model where conditioning on known memberships changes the posterior distribution for remaining instances. The framework is attack-agnostic -- it wraps any existing MIA as a base attack.

Proxy MIA (Non-Adaptive Setting): In non-adaptive settings, the adversary doesn't have access to D_query when training shadow models, so instances in D_query only have out-model behaviors. The likelihood ratio test (theoretically optimal for fixed false positive rates) requires both in and out distributions, making it seemingly inapplicable.

Proxy MIA solves this by selecting proxy instances from D_adv (the adversary's data used for shadow training) that are similar to each membership query. The in-model behaviors of these proxy instances are used as substitutes for the unavailable in-model behaviors of the actual query. The implementation:

1. Train shadow models on D_adv (one-time cost)
2. For each incoming query, query shadow models for out-model behavior
3. Select similar instances from D_adv as proxy points
4. Use the in-model behaviors of proxy points to approximate the query's in-model distribution
5. Apply the likelihood ratio test using the proxy in-distribution and actual out-distribution

Demo / Proof of Concept

▶ Watch: Proxy MIA: substituting similar instances for unavailable in-behaviors (10:00)

Both attacks are evaluated across multiple image classification benchmarks. Cascading MIA is applied to LiRA (state-of-the-art adaptive MIA) and demonstrates several-fold improvement, particularly at very low false positive rates -- the regime most relevant for practical attacks where high precision is essential. The iterative performance curve shows diminishing returns after the first few rounds, making the approach practically feasible despite the retraining overhead.

Proxy MIA is compared against all existing non-adaptive attacks and consistently outperforms them across benchmarks. The efficiency advantage is significant: shadow models are trained once, and inference cost per query is minimal.

The Q&A session included discussions about convergence behavior (the cascading fixed membership set stabilizes after a few iterations), the theoretical basis for proxy substitution (similar instances exhibit similar in-model behaviors), and the practical implications for choosing between adaptive and non-adaptive attack strategies.

Defensive Implications

▶ Watch: Q&A: why proxy points work and convergence behavior (16:00)

These improved attacks have implications for privacy-preserving ML deployment:

• Stronger privacy auditing: Both attacks provide more accurate membership inference, enabling better assessment of model memorization and privacy leakage in deployed models
• Defense evaluation: Existing privacy defenses should be re-evaluated against Cascading and Proxy MIA, as many were benchmarked against weaker baselines
• Differential privacy calibration: If Cascading MIA boosts attack success several-fold, organizations may need to increase their differential privacy budgets to maintain the same membership privacy guarantee
• Non-adaptive attacks are more dangerous than assumed: Proxy MIA demonstrates that the non-adaptive setting (more realistic, lower adversary cost) is more dangerous than previously believed, narrowing the gap with worst-case adaptive attacks
• Batch query risks: The cascading approach specifically exploits batch membership queries, suggesting that APIs allowing batch model queries may need additional protections

Key Takeaways

• Membership decisions for different instances are statistically dependent when conditioned on the model -- exploiting this dependence through cascading improves attacks several-fold
• Cascading MIA is an attack-agnostic framework that wraps any base MIA and iteratively leverages high-confidence decisions to improve remaining inferences
• Proxy MIA enables the theoretically optimal likelihood ratio test in non-adaptive settings by substituting similar proxy instances for unavailable in-model behaviors
• Most cascading gains come from the first few iterations, making the approach practically feasible despite retraining costs
• The refined security game formalization cleanly separates adaptive from non-adaptive settings, resolving ambiguity in the literature
• Proxy MIA outperforms all existing non-adaptive attacks while being significantly more efficient

About the Speaker(s)

Yuntao Du is a third-year PhD student at Purdue University, working under Professor Ninghui Li. The research was conducted jointly with colleagues at Purdue. Du demonstrated strong command of both the theoretical foundations (probabilistic graphical models, likelihood ratio tests) and practical implications of the work.