Sampling Attacks: Amplification of Membership Inference Attacks by Repeated Queries

Understand

Machine learning models have been shown to leak information violating the privacy of their training set.

• We focus on membership inference attacks on machine learning models which aim to determine whether a data point was used to train the victim model.
• Our work consists of two sides: We introduce sampling attack, a novel membership inference technique that unlike other standard membership adversaries is able to work under severe restriction of no access to scores of the victim model.
• We show that a victim model that only publishes the labels is still susceptible to sampling attacks and the adversary can recover up to 100% of its performance compared to when posterior vectors are provided.