2021

ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models

Liu, Yugeng, Wen, Rui, He, Xinlei et al.

Understand

Inference attacks against Machine Learning (ML) models allow adversaries to learn sensitive information about training data, model parameters, etc.

While researchers have studied, in depth, several kinds of attacks, they have done so in isolation.
As a result, we lack a comprehensive picture of the risks caused by the attacks, e.g., the different scenarios they can be applied to, the common factors that influence their performance, the relationship among them, or the effectiveness of possible defenses.
In this paper, we fill this gap by presenting a first-of-its-kind holistic risk assessment of different inference attacks against machine learning models.

Built on

An Analysis of Single-Layer Networks in Unsupervised Feature Learning
Adam Coates, Andrew Y. Ng, and Honglak Lee · 2011
Earlier work this paper cites.
ImageNet Classification with Deep Convolutional Neural Networks
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton · 2012
Earlier work this paper cites.
The Algorithmic Foundations of Differential Privacy
Cynthia Dwork and Aaron Roth · 2014
Earlier work this paper cites.
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing
Matt Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart · 2014
Earlier work this paper cites.
Generative Adversarial Nets
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio · 2014
Earlier work this paper cites.
Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers
Giuseppe Ateniese, Luigi V. Mancini, Angelo Spognardi, Antonio Villani, Domenico Vitali, and Giovanni Felici · 2015
Earlier work this paper cites.
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart · 2015
Earlier work this paper cites.
Distilling the Knowledge in a Neural Network
Original
Geoffrey E. Hinton, Oriol Vinyals, and Jeffrey Dean · 2015
Earlier work this paper cites.
Deep Learning Face Attributes in the Wild
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang · 2015
Earlier work this paper cites.
Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks
Original
Alec Radford, Luke Metz, and Soumith Chintala · 2015
Earlier work this paper cites.
Very Deep Convolutional Networks for Large-Scale Image Recognition
Karen Simonyan and Andrew Zisserman · 2015
Earlier work this paper cites.
Deep Learning with Differential Privacy
Martin Abadi, Andy Chu, Ian Goodfellow, Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang · 2016
Earlier work this paper cites.
Concentrated Differential Privacy: Simplifications, Extensions, and Lower Bounds
Mark Bun and Thomas Steinke · 2016
Earlier work this paper cites.
Deep Residual Learning for Image Recognition
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun · 2016
Earlier work this paper cites.
Differential Privacy: From Theory to Practice
Ninghui Li, Min Lyu, Dong Su, and Weining Yang · 2016
Earlier work this paper cites.
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Nicolas Papernot, Patrick D. McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami · 2016
Earlier work this paper cites.
Stealing Machine Learning Models via Prediction APIs
Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart · 2016
Earlier work this paper cites.
Xception: Deep Learning with Depthwise Separable Convolutions
François Chollet · 2017
Earlier work this paper cites.
Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data
Nicolas Papernot, Martin Abadi, Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar · 2017
Earlier work this paper cites.
Practical Black-Box Attacks Against Machine Learning
Nicolas Papernot, Patrick D. McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami · 2017
Earlier work this paper cites.
Membership Inference Attacks Against Machine Learning Models
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov · 2017
Earlier work this paper cites.
Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
Original
Han Xiao, Kashif Rasul, and Roland Vollgraf · 2017
Earlier work this paper cites.

Similar

Age Progression/Regression by Conditional Adversarial Autoencoder
Zhifei Zhang, Yang Song, and Hairong Qi · 2017
Cited alongside, same era.
Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations
Karan Ganju, Qi Wang, Wei Yang, Carl A. Gunter, and Nikita Borisov · 2018
Cited alongside, same era.
Machine Learning with Membership Privacy using Adversarial Regularization
Milad Nasr, Reza Shokri, and Amir Houmansadr · 2018
Cited alongside, same era.
Towards Reverse-Engineering Black-Box Neural Networks
Seong Joon Oh, Max Augustin, Bernt Schiele, and Mario Fritz · 2018
Cited alongside, same era.
Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
Original
Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Kurakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, Alexander Matyasko, Vahid Behzadan, Karen Hambardzumyan, Zhishuai Zhang, Yi-Lin Juang, Zhi Li, Ryan Sheatsley, Abhibhav Garg, Jonathan Uesato, Willi Gierke, Yinpeng Dong, David Berthelot, Paul Hendricks, Jonas Rauber, Rujun Long, and Patrick McDaniel · 2018
Cited alongside, same era.
SoK: Towards the Science of Security and Privacy in Machine Learning
Nicolas Papernot, Patrick McDaniel, Arunesh Sinha, and Michael Wellman · 2018
Cited alongside, same era.
Stealing Hyperparameters in Machine Learning
Binghui Wang and Neil Zhenqiang Gong · 2018
Cited alongside, same era.
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha · 2018
Cited alongside, same era.
The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song · 2019
Cited alongside, same era.
LOGAN: Evaluating Privacy Leakage of Generative Models Using Generative Adversarial Networks
Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro · 2019
Cited alongside, same era.
Monte Carlo and Reconstruction Membership Inference Attacks against Generative Models
Benjamin Hilprecht, Martin Härterich, and Daniel Bernau · 2019
Cited alongside, same era.
MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples
Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong · 2019
Cited alongside, same era.

Then

An Overview of Privacy in Machine Learning
Original
Emiliano De Cristofaro · 2020
Later among the works it cites.
Analyzing and Improving the Image Quality of StyleGAN
Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila · 2020
Later among the works it cites.
Thieves on Sesame Street! Model Extraction of BERT-based APIs
Kalpesh Krishna, Gaurav Singh Tomar, Ankur P. Parikh, Nicolas Papernot, and Mohit Iyyer · 2020
Later among the works it cites.
Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference
Klas Leino and Matt Fredrikson · 2020
Later among the works it cites.
ML Privacy Meter: Aiding Regulatory Compliance by Quantifying the Privacy Risks of Machine Learning
Original
Sasi Kumar Murakonda and Reza Shokri · 2020
Later among the works it cites.
TROJANZOO: Everything You Ever Wanted to Know about Neural Backdoors (But Were Afraid to Ask)
Original
Ren Pang, Zheng Zhang, Xiangshan Gao, Zhaohan Xi, Shouling Ji, Peng Cheng, and Ting Wang · 2020
Later among the works it cites.
Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang · 2020
Later among the works it cites.
Information Leakage in Embedding Models
Congzheng Song and Ananth Raghunathan · 2020
Later among the works it cites.
Overlearning Reveals Sensitive Attributes
Congzheng Song and Vitaly Shmatikov · 2020
Later among the works it cites.
The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks
Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song · 2020
Later among the works it cites.
When Machine Unlearning Jeopardizes Privacy
Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang · 2021
Closest in time.
Stealing Links from Graph Neural Networks
Xinlei He, Jinyuan Jia, Michael Backes, Neil Zhenqiang Gong, and Yang Zhang · 2021
Closest in time.
Quantifying and Mitigating Privacy Risks of Contrastive Learning
Xinlei He and Yang Zhang · 2021
Closest in time.
When Does Data Augmentation Help With Membership Inference Attacks?
Yigitcan Kaya and Tudor Dumitras · 2021
Closest in time.
Membership Leakage in Label-Only Exposures
Zheng Li and Yang Zhang · 2021
Closest in time.
EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learning
Hongbin Liu, Jinyuan Jia, Wenjie Qu, and Neil Zhenqiang Gong · 2021
Closest in time.
Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning
Milad Nasr, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlini · 2021
Closest in time.
Membership Privacy for Machine Learning Models Through Knowledge Transfer
Virat Shejwalkar and Amir Houmansadr · 2021
Closest in time.
Systematic Evaluation of Privacy Risks of Machine Learning Models
Liwei Song and Prateek Mittal · 2021
Closest in time.
Detecting AI Trojans Using Meta Neural Analysis
Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A. Gunter, and Bo Li · 2021
Closest in time.
Membership Inference Attacks Against Recommender Systems
Minxing Zhang, Zhaochun Ren, Zihan Wang, Pengjie Ren, Zhumin Chen, Pengfei Hu, and Yang Zhang · 2021
Closest in time.
BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning
Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong · 2022
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…