Revisiting Membership Inference Under Realistic Assumptions

TL;DR

This paper explores membership inference attacks under more realistic conditions with skewed priors and adaptive thresholding, proposing new methods that outperform previous attacks in imbalanced scenarios.

Contribution

It introduces a PPV-based metric for skewed priors, a threshold selection procedure, and a novel attack leveraging local minima in loss functions, advancing the understanding of inference under realistic assumptions.

Findings

New PPV-based metric for skewed priors

Threshold selection improves attack effectiveness

Proposed attack achieves high PPV in imbalanced settings

Abstract

We study membership inference in settings where some of the assumptions typically used in previous research are relaxed. First, we consider skewed priors, to cover cases such as when only a small fraction of the candidate pool targeted by the adversary are actually members and develop a PPV-based metric suitable for this setting. This setting is more realistic than the balanced prior setting typically considered by researchers. Second, we consider adversaries that select inference thresholds according to their attack goals and develop a threshold selection procedure that improves inference attacks. Since previous inference attacks fail in imbalanced prior setting, we develop a new inference attack based on the intuition that inputs corresponding to training set members will be near a local minimum in the loss function, and show that an attack that combines this with thresholds on the per-instance loss can achieve high PPV even in settings where other attacks appear to be ineffective. Code for our experiments can be found here: https://github.com/bargavj/EvaluatingDPML.