Inferring Class Label Distribution of Training Data from Classifiers: An Accuracy-Augmented Meta-Classifier Attack

TL;DR

This paper introduces a novel property inference attack that accurately infers the class label distribution of training data from classifier parameters, significantly improving over existing methods.

Contribution

It presents a new attack method using shadow training and a meta-classifier that leverages classifier parameters and accuracy, enhancing inference accuracy.

Findings

Meta-classifier attack improves inference accuracy by up to 52%

Effective on neural network classifiers with fully connected architectures

Advances property inference beyond binary decisions

Abstract

Property inference attacks against machine learning (ML) models aim to infer properties of the training data that are unrelated to the primary task of the model, and have so far been formulated as binary decision problems, i.e., whether or not the training data have a certain property. However, in industrial and healthcare applications, the proportion of labels in the training data is quite often also considered sensitive information. In this paper we introduce a new type of property inference attack that unlike binary decision problems in literature, aim at inferring the class label distribution of the training data from parameters of ML classifier models. We propose a method based on \emph{shadow training} and a \emph{meta-classifier} trained on the parameters of the shadow classifiers augmented with the accuracy of the classifiers on auxiliary data. We evaluate the proposed approach for ML classifiers with fully connected neural network architectures. We find that the proposed \emph{meta-classifier} attack provides a maximum relative improvement of $52\%$ over state of the art.