某些目标比其他目标更难识别：量化依赖于目标的成员泄露
Some Targets Are Harder to Identify than Others: Quantifying the Target-dependent Membership Leakage
AI总结：
本文通过Mahalanobis距离刻画固定目标成员推理博弈中最优攻击的效能，解释了目标依赖的攻击难度，并提出改进的协方差攻击及联邦学习隐私审计策略。
摘要：
在成员推理（MI）博弈中，攻击者试图推断某个目标点是否被包含在算法的输入中。现有工作表明，某些目标点较易识别，而另一些则较难。本文通过研究固定目标MI博弈中最优攻击的效能，解释了成员攻击中依赖于目标的难度。我们用目标点与数据生成分布之间的Mahalanobis距离，刻画了针对经验均值的最优攻击的最优优势与权衡函数。我们进一步推导了添加Gaussian噪声和子采样这两种隐私防御，以及目标误设对最优攻击的影响。作为对似然比（LR）检验创新分析的副产品，我们提供了一种新的协方差攻击，推广并改进了标量积攻击。此外，我们提出了一种新的最优金丝雀选择策略，用于白盒联邦学习环境下的隐私审计。实验证实，Mahalanobis分数解释了固定目标MI博弈的难度。
英文摘要：
In a Membership Inference (MI) game, an attacker tries to infer whether a target point was included or not in the input of an algorithm. Existing works show that some target points are easier to identify, while others are harder. This paper explains the target-dependent hardness of membership attacks by studying the powers of the optimal attacks in a fixed-target MI game. We characterise the optimal advantage and trade-off functions of attacks against the empirical mean in terms of the Mahalanobis distance between the target point and the data-generating distribution. We further derive the impacts of two privacy defences, i.e. adding Gaussian noise and sub-sampling, and that of target misspecification on optimal attacks. As by-products of our novel analysis of the Likelihood Ratio (LR) test, we provide a new covariance attack which generalises and improves the scalar product attack. Also, we propose a new optimal canary-choosing strategy for auditing privacy in the white-box federated learning setting. Our experiments validate that the Mahalanobis score explains the hardness of fixed-target MI games.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
