Virtual talk by Jonathan Ullman (Northeastern)
summary
Shows that for a noisy Gaussian mean setting membership inference can be information-theoretically possible yet demand an auxiliary sample size Omega(d) that far exceeds the training set n; proves this lower bound even when the mechanism is just the empirical mean plus calibrated Gaussian noise. Practical attacks that use distribution-independent tests* (loss, confidence, thresholding) need only O(n) samples and therefore can be far from optimal. Proof uses skewed covariance hard instances and a likelihood-ratio intuition.
AI-written summary · about
chapters (15)
- 0:00Membership inference attacks
- 1:04Privacy threats in ML models
- 2:28What are membership inference attacks
- 4:14History and significance
- 6:20Attacker assumptions in privacy
- 7:46Attacker knowledge and sample complexity
- 10:13Research result overview
- 12:24Threat model for membership inference
- 16:25Optimal attacks via Neyman-Pearson
- 18:11Noisy mean estimation threat model
- 21:42Sample complexity with unknown distribution
- 24:58Practical membership inference tests
- 27:30Main theorem on sample complexity
- 31:05Implications and future research
- 32:51Q&A
related talks
47mFinite Sample Differentially Private Confidence Intervals
36mPrivately Learning High-Dimensional Distributions
01h 02mLarge-Scale Private Learning, Part I
53mOptimality in Locally Private Estimation and Learning
01h 00mDifferential Privacy And The Complexity Of Simple Queries
01h 03mSimons Institute Live Stream
01h 03mStatistical Inference and Privacy, Part II
36mLearning without Interaction Requires Separation