An Extension of Fano's Inequality for Characterizing Model Susceptibility to Membership Inference Attacks

TL;DR

This paper extends Fano's inequality to theoretically relate a deep neural network's vulnerability to membership inference attacks with the mutual information between inputs and activations, providing a new measure of privacy risk.

Contribution

It introduces a novel extension of Fano's inequality that bounds attack success probability using mutual information, linking information theory with privacy vulnerability analysis.

Findings

High correlation between mutual information and attack susceptibility (above 0.95) across datasets.

Theoretical framework for measuring model privacy risk using mutual information.

Empirical validation on multiple datasets confirms the proposed bounds.

Abstract

Deep neural networks have been shown to be vulnerable to membership inference attacks wherein the attacker aims to detect whether specific input data were used to train the model. These attacks can potentially leak private or proprietary data. We present a new extension of Fano's inequality and employ it to theoretically establish that the probability of success for a membership inference attack on a deep neural network can be bounded using the mutual information between its inputs and its activations. This enables the use of mutual information to measure the susceptibility of a DNN model to membership inference attacks. In our empirical evaluation, we show that the correlation between the mutual information and the susceptibility of the DNN model to membership inference attacks is 0.966, 0.996, and 0.955 for CIFAR-10, SVHN and GTSRB models, respectively.