Enhanced Label-Only Membership Inference Attacks with Fewer Queries

Enhanced Label-Only Membership Inference Attacks with Fewer Queries

Speakers: Hao Li

Conference: USENIX Security

YouTube: https://www.youtube.com/watch?v=YlS2K18OqYY

Overview

This talk, presented by Hao Li at USENIX Security, introduces a novel approach to Label-Only Membership Inference Attacks (MIA), significantly reducing the number of queries required while enhancing attack performance. The research, titled "Enhanced Label-Only Membership Inference Attacks with Fewer Queries," addresses critical vulnerabilities in machine learning models that can lead to severe user privacy infringements. Traditional membership inference attacks often demand an impractical number of queries, limiting their real-world applicability and their utility as a tool for security researchers.

The core motivation behind this work stems from the escalating concerns surrounding data privacy in the age of widespread AI adoption. If an attacker can determine whether a specific individual's data was used to train a model—for instance, a medical dataset—it could reveal sensitive personal information, such as a user's prior treatment at a hospital. Beyond direct privacy breaches, effective MIA tools are crucial for identifying potential privacy risks in models before deployment, ensuring compliance with regulations like GDPR and CCPA, and ultimately advancing the development of stronger privacy defenses by better understanding attack vectors.

The proposed method, dubbed the DH attack, tackles the dual challenges of high query requirements and limited distinguishing ability inherent in existing label-only MIA techniques. By re-evaluating the underlying mechanisms used to identify members, the DH attack demonstrates how to achieve superior inference capabilities with a fraction of the computational cost, making privacy auditing and adversarial analysis more practical and potent. This work not only highlights current model vulnerabilities but also provides a robust framework for assessing and mitigating them.

Background

▶ Watch: Introduction to label-only membership inference and its importance (0:00)

Membership inference attacks (MIA) aim to determine if a specific data sample was part of the training dataset used for a machine learning model. In a label-only setting, the adversary's capabilities are severely restricted: they can only observe the model's final predicted labels for input queries, without access to confidence scores, model parameters, or gradients. This scenario is particularly challenging but reflects many real-world black-box attack surfaces where models are exposed via APIs.

Prior work in label-only MIA, such as UBA (Uncertainty-Based Attack) and SBA (Shortest Boundary Distance Attack), typically relies on generating adversarial examples. The fundamental idea behind these attacks is that samples used in training (members) tend to behave differently near the model's decision boundaries compared to samples not used in training (non-members). Specifically, members are often "closer" to the decision boundary in some sense, or conversely, their adversarial perturbations might require larger changes to cross the boundary.

These existing methods often involve iteratively perturbing a sample until it crosses a decision boundary, aiming to find the shortest boundary distance (shortest BD). The assumption is that members, having been seen during training, might exhibit a larger shortest BD compared to non-members. For example, UBA and SBA might generate adversarial examples by querying the model hundreds or thousands of times to identify this shortest BD. The distance between an original sample and its adversarial counterpart is then used as a score to distinguish members from non-members.

However, these traditional approaches suffer from two significant limitations. Firstly, they demand an exorbitant number of queries. Advanced adversarial example techniques like the HopSkipJump or QEBA often necessitate thousands or even tens of thousands of queries per sample to accurately determine the shortest BD. This is because there is no universal direction for perturbation; for each individual sample, the algorithm must effectively "re-learn" the unique shortest path to cross the decision boundary, leading to immense computational overhead and making such attacks impractical for large-scale assessments.

Secondly, and perhaps more fundamentally, the shortest BD itself is often not a reliable or sufficiently significant indicator of membership. Research has shown that while there might be a subtle difference between members and non-members at their shortest distances to a boundary, this difference is often not pronounced enough to serve as a robust distinguishing feature. This inherent limitation contributes to the relatively poor performance of these methods, even when extensive queries are used. These two problems—high query cost and limited distinguishing ability—are precisely what the DH attack seeks to overcome.

Key Findings

▶ Watch: Introducing DH attack: fixed BD for fewer queries (4:00)

The research presents several pivotal findings that collectively demonstrate the superior efficiency and effectiveness of the proposed DH attack over existing label-only membership inference methods.

Firstly, the DH attack drastically reduces the query requirements for performing membership inference. While baseline attacks like SBA and UBA typically require thousands or even tens of thousands of queries per sample, the DH attack achieves optimal performance with only 30 to 50 queries. This reduction in query cost, by several orders of magnitude, makes the attack far more practical and scalable for real-world scenarios.

Secondly, the DH attack consistently outperforms state-of-the-art baselines in terms of membership inference accuracy. When evaluated across various datasets (e.g., CIFAR-10, News) and model architectures (e.g., VGG, ResNet, MobileNet), the DH attack demonstrates significantly higher True Positive Rate (TPR) at a low False Positive Rate (FPR). For instance, under the MobileNet setting, the DH attack achieved a TPR at a low FPR of 2.93% with just 50 queries, whereas the baseline SBA only managed 0.18% with 11,000 queries. This represents an improvement by several times, and in some cases, over tenfold. The attack also showed superior performance in terms of Area Under the Curve (AUC), a comprehensive metric for classifier performance, achieving AUC values of 0.752 on ResNet and 0.750 on MobileNet, compared to SBA's 0.694 and 0.702 respectively, both with significantly fewer queries.

Thirdly, the DH attack exhibits strong robustness to common adversarial assumptions. The study relaxed assumptions about the attacker's knowledge regarding the target model's training data distribution and architecture. Even when shadow models were trained using datasets with different distributions or built with different architectures than the target model, the attack performance only slightly decreased, with AUC values showing consistent robustness. This indicates that the DH attack remains effective even under more practical and challenging black-box conditions.

Fourthly, the research explored various fixed perturbation patterns beyond simple outlier directions. Methods such as blurriness, rotation, and resizing were tested to calculate fixed boundary distances. While all these methods proved effective, perturbing towards specific RGB values (e.g., RGB 255 and RGB 0) generally outperformed others. Notably, for MobileNet, RGB 255 achieved an impressive TPR of 4.04% (compared to blurriness at 3.3%), and RGB 0 achieved the highest AUC of 0.756, demonstrating their superior effectiveness in distinguishing classes. These findings led to the adoption of RGB 255 and RGB 0 as default perturbation methods due to their reliability.

Finally, the DH attack demonstrated remarkable resilience against various privacy-preserving defenses. When tested against models equipped with defenses such as Local Differential Learning (LDL), Mixup, Manifold Mixup (MMD), and Differential Privacy Stochastic Gradient Descent (DP-SGD), the DH attack consistently achieved the best performance among all evaluated methods. For example, under LDL defense, the DH attack achieved a TPR of 0.54% at low FPR, significantly exceeding baselines SBA and NRA (both at 0.14%) by more than three times. Even under stronger defenses like Mixup, MMD, and DP-SGD, where all methods suffered performance drops, the DH attack still maintained a clear advantage, outperforming others and achieving comparable or better AUC values than the best baseline in each setting. This highlights that existing defenses, while reducing attack success, are not sufficient against advanced membership inference techniques like the DH attack.

Technical Deep Dive

▶ Watch: Four stages of the proposed DH attack methodology (5:00)

The DH attack fundamentally re-engineers the process of membership inference by replacing the computationally expensive and often unreliable "shortest BD" with a novel concept called "fixed BD" (Fixed Boundary Distance). This shift is central to achieving both query efficiency and improved accuracy.

Instead of exhaustively searching for the shortest distance to a decision boundary by perturbing a sample in all possible directions, the DH attack simplifies this process. It moves a sample in one fixed, predetermined direction until it crosses the decision boundary. This "fixed BD" is then the distance traveled along that specific vector. This strategic simplification immediately reduces the query count from thousands to a mere 30-50 queries. To ensure the validity and effectiveness of this fixed BD, the research recommends choosing an outlier direction, such as perturbing the image towards all pixels having values of RGB 255 (pure white) or RGB 0 (pure black). These extreme values provide a consistent and effective perturbation vector.

The DH attack operates in four distinct stages:

1. Reference Data Relabeling: The adversary begins by acquiring a reference dataset. This dataset does not need to contain any samples from the target model's training data, but ideally, its distribution should be somewhat similar to the target data. The adversary then queries the target model using samples from this reference dataset. Based on the target model's predictions, this reference dataset is relabeled. This relabeled reference dataset is crucial because it captures the predictive behavior and decision boundaries of the target model, enabling subsequent local models to approximate its characteristics.

1. Shadow Model Training: Leveraging the relabeled reference dataset, the adversary trains several local models, referred to as shadow models. Each shadow model is trained in a way that its decision boundary approximates that of the target model. Crucially, these shadow models are trained without any samples from the specific target sample whose membership is being inferred. This ensures that the shadow models represent a "non-member" state relative to the target sample. By training multiple shadow models, the adversary can capture a range of possible decision boundaries that a target model might exhibit if the target sample were not part of its training data.

1. Non-Member Data Construction: For each target sample under investigation, the adversary repeats a process across all the trained shadow models. For each shadow model, the "fixed BD" for the target sample is calculated by perturbing it along the chosen fixed direction (e.g., RGB 255) until it crosses that shadow model's decision boundary. This yields a collection of fixed BD values. Since the target sample was explicitly excluded from the training of these shadow models, these collected fixed BD values inherently represent the target sample's behavior if it were a non-member. These values are then modeled as a Gaussian distribution, which effectively characterizes the "non-member state" of the target sample.

1. Membership Inference: In the final stage, the adversary calculates the real "fixed BD" (let's call it D) for the target sample on the actual target model. This is done by perturbing the target sample along the same fixed direction until it crosses the target model's decision boundary, just as with the shadow models. Once D is obtained, the adversary calculates its Cumulative Distribution Function (CDF) value within the Gaussian distribution derived in the "Non-Member Data Construction" stage. A larger CDF value for D indicates that the target sample's fixed BD on the target model exceeds most of the fixed BD values observed when it was treated as a non-member in the shadow models. This suggests a higher likelihood of the sample being a member of the target model's training dataset. In essence, members tend to exhibit a larger fixed BD when queried on the target model compared to what would be expected if they were non-members, as approximated by the shadow models.

The choice of perturbation direction is critical. The research specifically evaluated various methods, including perturbing towards RGB 255 (all white), RGB 0 (all black), as well as more complex image transformations like blurriness (gradually blurring the image by averaging pixels), rotation (rotating up to 180 degrees), and resizing (reducing dimensions and filling exposed pixels with zeros). While all these methods proved effective in calculating a fixed BD, RGB 255 and RGB 0 consistently demonstrated superior performance in distinguishing between classes and achieving higher TPR at low FPR and AUC values, making them the preferred default methods for the DH attack.

Demo / Proof of Concept

▶ Watch: Attack robustness under unknown data distribution and architecture (10:00)

While the talk primarily focuses on the theoretical framework and extensive experimental validation of the DH attack, it does not detail a live demonstration or a specific, step-by-step proof-of-concept implementation during the presentation. The speaker mentions at the outset that "we have open sourced the code," indicating that the practical implementation and capabilities of the DH attack are available for scrutiny and reproduction by the research community.

The effectiveness of the DH attack as a proof of concept is thoroughly substantiated through its rigorous evaluation across diverse datasets, model architectures, and adversarial conditions. The experimental results, comparing the DH attack against established baselines like UBA and SBA, serve as the primary evidence of its feasibility and superior performance. These evaluations demonstrated the attack's ability to infer membership with significantly fewer queries and higher accuracy, even against models protected by various privacy defenses. The availability of the codebase further empowers researchers and practitioners to deploy and test the attack in their own environments, effectively serving as a reproducible proof of concept.

Defensive Implications

▶ Watch: Effectiveness of alternative fixed perturbation patterns (11:00)

The findings from the DH attack research carry significant implications for developers and organizations responsible for deploying and securing machine learning models. The most immediate implication is that existing privacy-preserving machine learning (PPML) defenses are not sufficient against advanced membership inference attacks.

The study rigorously evaluated the DH attack's performance against models equipped with several state-of-the-art defenses, including Local Differential Learning (LDL), Mixup, Manifold Mixup (MMD), and Differential Privacy Stochastic Gradient Descent (DP-SGD). While these defenses did reduce the overall attack success rates across the board, the DH attack consistently maintained a clear advantage over baseline MIA methods. For instance, under the LDL defense, the DH attack achieved a TPR of 0.54% at low FPR, more than triple that of SBA and NRA (both 0.14%). Even under the stronger protections of Mixup, MMD, and DP-SGD, where all attack methods saw performance drops, the DH attack still outperformed others, with TPRs of 0.22% while baselines remained below 0.12%. This demonstrates that even with robust defenses in place, the DH attack can still effectively infer membership, albeit with reduced efficacy.

This persistent effectiveness highlights a critical vulnerability: current defensive strategies, while valuable, do not completely neutralize the threat of sophisticated membership inference. Defenders should recognize that relying solely on existing PPML techniques might create a false sense of security.

Therefore, defenders should:

1. Re-evaluate Privacy Guarantees: Organizations must re-evaluate the privacy guarantees of their deployed models using advanced MIA techniques like the DH attack. Traditional benchmarks for privacy might no longer be sufficient.
2. Proactive Auditing: Integrate advanced membership inference attacks into their model development and deployment pipelines as a proactive auditing tool. Before deploying a model, it should be rigorously tested against the DH attack to assess its real-world privacy risks.
3. Investigate Novel Defenses: The research underscores the need for continued innovation in privacy defense mechanisms. Future defenses must specifically address the vulnerabilities exploited by "fixed BD" approaches and other query-efficient MIA techniques. This might involve exploring new ways to obfuscate decision boundaries or to make the "non-member" distribution less distinguishable from the "member" distribution.
4. Consider Adversary Capabilities: When designing defenses, consider adversaries with limited knowledge (label-only access) but potentially sophisticated attack methodologies. The robustness of DH attack to distribution shifts and architecture mismatches means that defenders cannot rely on obscurity of model internals as a primary defense.
5. Balance Utility and Privacy: Further research is needed to find an optimal balance between model utility and privacy. Aggressive defenses often lead to a significant drop in model performance. Understanding the trade-offs in the context of advanced MIA is crucial.

In summary, the DH attack serves as a stark reminder that the arms race between attackers and defenders in machine learning privacy is ongoing. Defenders must stay informed about new attack vectors and continuously adapt their strategies to protect user data effectively.

Key Takeaways

• Label-Only Membership Inference Attacks (MIA) pose a significant threat to user privacy, potentially revealing sensitive information about individuals whose data was used to train machine learning models.
• Existing label-only MIA methods, such as UBA and SBA, suffer from impractical query requirements (thousands to tens of thousands per sample) and limited effectiveness due to the unreliability of "shortest boundary distance" as a membership indicator.
• The DH attack introduces the concept of "fixed boundary distance (fixed BD)", which involves perturbing a sample in one predetermined direction (e.g., RGB 255 or RGB 0) until it crosses the decision boundary. This drastically reduces queries to just 30-50 per sample.
• The DH attack achieves superior performance, significantly outperforming baselines in terms of True Positive Rate at low False Positive Rate (e.g., 2.93% vs. 0.18% for MobileNet) and Area Under the Curve (AUC) (e.g., 0.752 vs. 0.694 for ResNet), while using vastly fewer queries.
• The attack demonstrates strong robustness to practical adversary assumptions, remaining effective even when the attacker lacks knowledge of the target model's training data distribution or its internal architecture.
• Even against models equipped with various privacy-preserving defenses (e.g., LDL, Mixup, MMD, DP-SGD), the DH attack consistently achieves the best performance among evaluated methods, highlighting that current defenses are not fully sufficient against advanced MIA.

About the Speaker(s)

The talk "Enhanced Label-Only Membership Inference Attacks with Fewer Queries" was presented by Hao Li at USENIX Security. The transcript also mentions "my co-authors," indicating a collaborative research effort. Based on the provided information, extensive biographical details about Hao Li or the co-authors are not available within the talk metadata or transcript.