l-Leaks: Membership Inference Attacks with Logits

TL;DR

This paper introduces l-Leaks, a black-box membership inference attack leveraging logits to determine if data was part of a model's training set, demonstrating high effectiveness across various models and datasets.

Contribution

The paper presents a novel black-box attack method, l-Leaks, that uses logits and shadow models to improve membership inference without needing network structure details.

Findings

l-Leaks achieves high attack accuracy across multiple datasets.

Shadow models learned from logits enhance inference effectiveness.

Attack performance is robust against different network structures.

Abstract

Machine Learning (ML) has made unprecedented progress in the past several decades. However, due to the memorability of the training data, ML is susceptible to various attacks, especially Membership Inference Attacks (MIAs), the objective of which is to infer the model's training data. So far, most of the membership inference attacks against ML classifiers leverage the shadow model with the same structure as the target model. However, empirical results show that these attacks can be easily mitigated if the shadow model is not clear about the network structure of the target model. In this paper, We present attacks based on black-box access to the target model. We name our attack \textbf{l-Leaks}. The l-Leaks follows the intuition that if an established shadow model is similar enough to the target model, then the adversary can leverage the shadow model's information to predict a target sample's membership.The logits of the trained target model contain valuable sample knowledge. We build the shadow model by learning the logits of the target model and making the shadow model more similar to the target model. Then shadow model will have sufficient confidence in the member samples of the target model. We also discuss the effect of the shadow model's different network structures to attack results. Experiments over different networks and datasets demonstrate that both of our attacks achieve strong performance.