White-box vs Black-box: Bayes Optimal Strategies for Membership Inference

Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference

Membership inference (MI) attacks exploit the fact that machine learning algorithms sometimes leak information about their training data through the learned model. In this work, we study membership inference in the white-box setting in order to exploit the internals of a model, which have not been effectively utilized by previous work. Leveraging new insights about how overfitting occurs in deep neural networks, we show how a model's idiosyncratic use of features can provide evidence for membership to white-box attackers---even when the model's black-box behavior appears to generalize well---a…

Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning

Deep neural networks are susceptible to various inference attacks as they remember information about their training data. We design white-box inference attacks to perform a comprehensive privacy analysis of deep learning models. We measure the privacy leakage through parameters of fully trained models as well as the parameter updates of models during training. We design inference algorithms for both centralized and federated learning, with respect to passive and active inference attackers, and assuming different adversary prior knowledge. We evaluate our novel white-box membership inference at…

用于成员推理攻击中差分隐私贝叶斯估计的MCMC

MCMC for Bayesian estimation of Differential Privacy from Membership Inference Attacks

提出MCMC-DP-Est框架，通过MCMC算法结合多种成员推理攻击证据，联合估计攻击强度与训练算法隐私参数的完整后验分布，实现更谨慎的差分隐私贝叶斯估计。

On the Effectiveness of Regularization Against Membership Inference Attacks

Deep learning models often raise privacy concerns as they leak information about their training data. This enables an adversary to determine whether a data point was in a model's training set by conducting a membership inference attack (MIA). Prior work has conjectured that regularization techniques, which combat overfitting, may also mitigate the leakage. While many regularization mechanisms exist, their effectiveness against MIAs has not been studied systematically, and the resulting privacy properties are not well understood. We explore the lower bound for information leakage that practical…

Sequential Monte Carlo Inference of Mixed Membership Stochastic Blockmodels for Dynamic Social Networks

Many kinds of data can be represented as a network or graph. It is crucial to infer the latent structure underlying such a network and to predict unobserved links in the network. Mixed Membership Stochastic Blockmodel (MMSB) is a promising model for network data. Latent variables and unknown parameters in MMSB have been estimated through Bayesian inference with the entire network; however, it is important to estimate them online for evolving networks. In this paper, we first develop online inference methods for MMSB through sequential Monte Carlo methods, also known as particle filters. We the…

某些目标比其他目标更难识别：量化依赖于目标的成员泄露

Some Targets Are Harder to Identify than Others: Quantifying the Target-dependent Membership Leakage

本文通过Mahalanobis距离刻画固定目标成员推理博弈中最优攻击的效能，解释了目标依赖的攻击难度，并提出改进的协方差攻击及联邦学习隐私审计策略。