重新审视在现实假设下的LiRA成员推断攻击
Revisiting the LiRA Membership Inference Attack Under Realistic Assumptions
AI总结：
本文重新评估了在现实假设下的LiRA成员推断攻击，发现抗过拟合和迁移学习显著削弱了攻击效果，同时强调了评估协议需考虑实际训练实践和可重复性。
摘要：
成员推断攻击（MIAs）已成为评估机器学习（ML）中隐私泄露的标准工具。其中，似然比攻击（LiRA）在有足够的影子模型可用时被广泛认为是最先进的方法。然而，以往的评估经常高估了LiRA的有效性，通过攻击对训练样本过于自信的模型、在目标数据上校准阈值、假设成员先验分布平衡，或者忽视攻击可重复性。我们重新评估LiRA，采用一个现实的协议，即（i）在适用时使用抗过拟合（AOF）和迁移学习（TL）训练模型，以减少生产模型中的过度自信；（ii）使用影子模型和数据而不是目标数据校准决策阈值；（iii）在影子基于阈值和倾斜的成员先验分布（pi <= 10%）下测量正预测值（PPV，或精度）；（iv）量化不同种子和训练变化下的每样本成员可重复性。我们发现AOF显著削弱了LiRA，而TL进一步减少攻击效果同时提高模型准确性。在影子基于阈值和倾斜先验下，LiRA的PPV往往大幅下降，尤其是在AOF或AOF+TL的情况下。我们还发现，在极低FPR的阈值脆弱集上，可重复性在不同运行中表现较差，而似然比排名更稳定。这些结果表明，在现实条件下，LiRA以及可能较弱的MIAs的效果可能不如之前所建议的那么强，可靠的隐私审计需要评估协议能够反映实际的训练实践、可行的攻击者假设和可重复性考虑。代码可在https://github.com/najeebjebreel/lira_analysis上获取。
英文摘要：
Membership inference attacks (MIAs) have become the standard tool for evaluating privacy leakage in machine learning (ML). Among them, the Likelihood-Ratio Attack (LiRA) is widely regarded as the state of the art when sufficient shadow models are available. However, prior evaluations have often overstated the effectiveness of LiRA by attacking models overconfident on their training samples, calibrating thresholds on target data, assuming balanced membership priors, and/or overlooking attack reproducibility. We re-evaluate LiRA under a realistic protocol that (i) trains models using anti-overfitting (AOF) and transfer learning (TL), when applicable, to reduce overconfidence as in production models; (ii) calibrates decision thresholds using shadow models and data rather than target data; (iii) measures positive predictive value (PPV, or precision) under shadow-based thresholds and skewed membership priors (pi <= 10%); and (iv) quantifies per-sample membership reproducibility across different seeds and training variations. We find that AOF significantly weakens LiRA, while TL further reduces attack effectiveness while improving model accuracy. Under shadow-based thresholds and skewed priors, LiRA's PPV often drops substantially, especially under AOF or AOF+TL. We also find that thresholded vulnerable sets at extremely low FPR show poor reproducibility across runs, while likelihood-ratio rankings are more stable. These results suggest that LiRA, and likely weaker MIAs, are less effective than previously suggested under realistic conditions, and that reliable privacy auditing requires evaluation protocols that reflect practical training practices, feasible attacker assumptions, and reproducibility considerations. Code is available at https://github.com/najeebjebreel/lira_analysis.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
