SeqMIA：基于序列度量的成员推理攻击
SeqMIA: Sequential-Metric Based Membership Inference Attack
AI总结：
针对现有成员推理攻击忽略训练过程中度量序列时间模式的问题，提出基于序列度量的SeqMIA方法，利用知识蒸馏和注意力RNN提升攻击性能，在低假阳性率下实现数量级改进。
摘要：
现有的大多数成员推理攻击（MIA）利用在模型最终状态上计算的度量（如损失），而近期的高级攻击则利用在模型训练过程中各个阶段（包括中间阶段和最终阶段）计算的度量。然而，这些攻击往往独立地处理度量的多个中间状态，忽略了它们随时间变化的模式。因此，它们难以有效区分具有相似度量值的成员和非成员，尤其导致较高的假阳性率。在本研究中，我们深入探讨黑盒场景中新的成员信号。我们识别出一个新的、更综合的成员信号：度量序列的模式，该模式来源于模型训练的各个阶段。我们认为，现有信号仅提供了这一新信号的部分视角：新信号涵盖了模型的多个中间状态和最终状态，并更强调它们之间的时间模式。基于这一信号，我们提出了一种新的攻击方法，称为基于序列度量的成员推理攻击（SeqMIA）。具体来说，我们利用知识蒸馏获得一组蒸馏模型，代表目标模型训练的不同阶段。然后，我们按时间顺序在这些蒸馏模型上评估多个度量，创建蒸馏度量序列。最后，我们将蒸馏的多度量序列整合为序列多格式，并采用基于注意力的RNN攻击模型进行推理。实证结果表明，SeqMIA优于所有基线，尤其是在0.1%假阳性率下的真阳性率方面可以实现数量级的提升。此外，我们深入探讨了该信号为何有助于SeqMIA的高攻击性能，并评估了针对SeqMIA的各种防御机制。
英文摘要：
Most existing membership inference attacks (MIAs) utilize metrics (e.g., loss) calculated on the model's final state, while recent advanced attacks leverage metrics computed at various stages, including both intermediate and final stages, throughout the model training. Nevertheless, these attacks often process multiple intermediate states of the metric independently, ignoring their time-dependent patterns. Consequently, they struggle to effectively distinguish between members and non-members who exhibit similar metric values, particularly resulting in a high false-positive rate. In this study, we delve deeper into the new membership signals in the black-box scenario. We identify a new, more integrated membership signal: the Pattern of Metric Sequence, derived from the various stages of model training. We contend that current signals provide only partial perspectives of this new signal: the new one encompasses both the model's multiple intermediate and final states, with a greater emphasis on temporal patterns among them. Building upon this signal, we introduce a novel attack method called Sequential-metric based Membership Inference Attack (SeqMIA). Specifically, we utilize knowledge distillation to obtain a set of distilled models representing various stages of the target model's training. We then assess multiple metrics on these distilled models in chronological order, creating distilled metric sequence. We finally integrate distilled multi-metric sequences as a sequential multiformat and employ an attention-based RNN attack model for inference. Empirical results show SeqMIA outperforms all baselines, especially can achieve an order of magnitude improvement in terms of TPR @ 0.1% FPR. Furthermore, we delve into the reasons why this signal contributes to SeqMIA's high attack performance, and assess various defense mechanisms against SeqMIA.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
