A Novel Membership Inference Attack against Dynamic Neural Networks by Utilizing Policy Networks Information

TL;DR

This paper introduces a new membership inference attack targeting dynamic neural networks by exploiting their policy networks, demonstrating increased effectiveness over traditional methods across multiple image classification tasks.

Contribution

It presents a novel attack leveraging policy network information in dynamic NNs, improving inference success compared to existing static NN attacks.

Findings

Control-flow information significantly enhances MIA effectiveness.

The proposed method outperforms baseline and traditional attacks.

Experimental validation on four image datasets confirms its superiority.

Abstract

Unlike traditional static deep neural networks (DNNs), dynamic neural networks (NNs) adjust their structures or parameters to different inputs to guarantee accuracy and computational efficiency. Meanwhile, it has been an emerging research area in deep learning recently. Although traditional static DNNs are vulnerable to the membership inference attack (MIA) , which aims to infer whether a particular point was used to train the model, little is known about how such an attack performs on the dynamic NNs. In this paper, we propose a novel MI attack against dynamic NNs, leveraging the unique policy networks mechanism of dynamic NNs to increase the effectiveness of membership inference. We conducted extensive experiments using two dynamic NNs, i.e., GaterNet, BlockDrop, on four mainstream image classification tasks, i.e., CIFAR-10, CIFAR-100, STL-10, and GTSRB. The evaluation results demonstrate that the control-flow information can significantly promote the MIA. Based on backbone-finetuning and information-fusion, our method achieves better results than baseline attack and traditional attack using intermediate information.