Beijing Key Laboratory of Network System Architecture and Convergence, School of Information and Communication Engineering, Beijing University of Posts and Telecommunications
These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
In a membership inference attack (MIA), an attacker exploits the
overconfidence exhibited by typical machine learning models to determine
whether a specific data point was used to train a target model. In this paper,
we analyze the performance of the likelihood ratio attack (LiRA) within an
information-theoretical framework that allows the investigation of the impact
of the aleatoric uncertainty in the true data generation process, of the
epistemic uncertainty caused by a limited training data set, and of the
calibration level of the target model. We compare three different settings, in
which the attacker receives decreasingly informative feedback from the target
model: confidence vector (CV) disclosure, in which the output probability
vector is released; true label confidence (TLC) disclosure, in which only the
probability assigned to the true label is made available by the model; and
decision set (DS) disclosure, in which an adaptive prediction set is produced
as in conformal prediction. We derive bounds on the advantage of an MIA
adversary with the aim of offering insights into the impact of uncertainty and
calibration on the effectiveness of MIAs. Simulation results demonstrate that
the derived analytical bounds predict well the effectiveness of MIAs.