Practical Bayes-Optimal Membership Inference Attacks

TL;DR

This paper introduces practical, Bayes-optimal membership inference attacks for both i.i.d. and graph data, providing new methods that outperform existing attacks in efficiency and effectiveness.

Contribution

It derives the Bayes-optimal inference rule for node-level MIAs on graph neural networks and proposes BASE and G-BASE, efficient approximations that improve attack performance.

Findings

G-BASE outperforms previous node-level MIA methods.

BASE matches or exceeds state-of-the-art MIAs like LiRA and RMIA.

BASE is computationally more efficient than prior methods.

Abstract

We develop practical and theoretically grounded membership inference attacks (MIAs) against both independent and identically distributed (i.i.d.) data and graph-structured data. Building on the Bayesian decision-theoretic framework of Sablayrolles et al., we derive the Bayes-optimal membership inference rule for node-level MIAs against graph neural networks, addressing key open questions about optimal query strategies in the graph setting. We introduce BASE and G-BASE, tractable approximations of the Bayes-optimal membership inference. G-BASE achieves superior performance compared to previously proposed classifier-based node-level MIA attacks. BASE, which is also applicable to non-graph data, matches or exceeds the performance of prior state-of-the-art MIAs, such as LiRA and RMIA, at a significantly lower computational cost. Finally, we show that BASE and RMIA are equivalent under a specific hyperparameter setting, providing a principled, Bayes-optimal justification for the RMIA attack.