Communication Dans Un Congrès Année : 2025

Some Targets Are Harder to Identify than Others: Quantifying the Target-dependent Membership Leakage

Résumé

In a Membership Inference (MI) game, an attacker tries to infer whether a target point was included or not in the input of an algorithm. Existing works show that some target points are easier to identify, while others are harder. This paper explains the target-dependent hardness of membership attacks by studying the powers of the optimal attacks in a fixed-target MI game. We characterise the optimal advantage and trade-off functions of attacks against the empirical mean in terms of the Mahalanobis distance between the target point and the data-generating distribution. We further derive the impacts of two privacy defences, i.e. adding Gaussian noise and sub-sampling, and that of target misspecification on optimal attacks. As by-products of our novel analysis of the Likelihood Ratio (LR) test, we provide a new covariance attack which generalises and improves the scalar product attack. Also, we propose a new optimal canary-choosing strategy for auditing privacy in the white-box federated learning setting. Our experiments validate that the Mahalanobis score explains the hardness of fixed-target MI games.

Dates et versions

hal-04615701 , version 1 (18-06-2024)

Identifiants

Citer

Achraf Azize, Debabrota Basu. Some Targets Are Harder to Identify than Others: Quantifying the Target-dependent Membership Leakage. AISTATS 2025 – International Conference on Artificial Intelligence and Statistics, May 2025, Phuket, Thailand. ⟨hal-04615701⟩
408 Consultations
0 Téléchargements

Altmetric

Partager

  • More