SNAP: Efficient Extraction of Private Properties with Poisoning

Understand

Property inference attacks allow an adversary to extract global properties of the training dataset from a machine learning model.

• Such attacks have privacy implications for data owners sharing their datasets to train machine learning models.
• Several existing approaches for property inference attacks against deep neural networks have been proposed, but they all rely on the attacker training a large number of shadow models, which induces a large computational overhead.
• In this paper, we consider the setting of property inference attacks in which the attacker can poison a subset of the training dataset and query the trained target model.