Membership Inference Attack Against Masked Image Modeling

TL;DR

This paper introduces the first membership inference attack against Masked Image Modeling (MIM) pre-trained image encoders, revealing privacy vulnerabilities by analyzing reconstruction errors to determine dataset membership.

Contribution

It proposes a novel attack method against MIM pre-trained models, demonstrating privacy risks and outperforming baseline approaches through extensive evaluations.

Findings

The attack effectively infers dataset membership with high accuracy.

Reconstruction errors serve as reliable signals for membership inference.

The attack's performance varies with different model architectures and datasets.

Abstract

Masked Image Modeling (MIM) has achieved significant success in the realm of self-supervised learning (SSL) for visual recognition. The image encoder pre-trained through MIM, involving the masking and subsequent reconstruction of input images, attains state-of-the-art performance in various downstream vision tasks. However, most existing works focus on improving the performance of MIM.In this work, we take a different angle by studying the pre-training data privacy of MIM. Specifically, we propose the first membership inference attack against image encoders pre-trained by MIM, which aims to determine whether an image is part of the MIM pre-training dataset. The key design is to simulate the pre-training paradigm of MIM, i.e., image masking and subsequent reconstruction, and then obtain reconstruction errors. These reconstruction errors can serve as membership signals for achieving attack goals, as the encoder is more capable of reconstructing the input image in its training set with lower errors. Extensive evaluations are conducted on three model architectures and three benchmark datasets. Empirical results show that our attack outperforms baseline methods. Additionally, we undertake intricate ablation studies to analyze multiple factors that could influence the performance of the attack.