Enhanced Label-Only Membership Inference Attacks with Fewer Queries
summary
Claims that measuring boundary distance toward a fixed point and scoring it against a shadow model distribution yields a label only MIA that needs far fewer queries. The implemented DHAttack uses fixedBD measured toward outliers like RGB255 or RGB0, trains shadow models on relabeled reference data, computes a CDF score for each sample, and cuts queries from thousands to 5–50 while boosting TPR@0.1%FPR by over an order of magnitude in some cases (mobile net 2.93 vs 0.18) and maintaining superiority under multiple defenses.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:36What is label-only MI
- 2:03Focus and related work
- 3:09Problems with existing attacks
- 4:57DH attack method
- 6:02Four stages of DH
- 8:09Evaluation results
- 10:16Robustness under relaxed assumptions
- 11:20Perturbation methods
- 13:09Defenses performance
- 15:37Conclusion
related talks
14mGuarding the Privacy of Label-Only Access to Neural Network Classifiers via Formal(…)
20mAttacking and Defending Machine Learning Applications of Public Cloud
35mNo labels? No problem!
31mEnhancing Secret Detection in Cybersecurity...
36mAdversarial Machine Learning: How Secure Is ML?
43mMetric Learning for Individual Fairness
58mLabeling a Data Set Using Sublinearly Many Queries
50mRobust Deep Learning Under Distribution Shift