Label-Only Membership Inference
Reproducing a 2021 ML-security paper and everything I learned along the way.
3/6 parts, in reading order. · code on GitHub
- Part 1 What is a membership inference attack?
The first in a series cataloguing my journey reproducing papers I want to properly understand. Starting with the core idea and vocabulary of membership inference attacks.
- Part 2 The gap attack, and some ML fundamentals
To build the gap attack I first had to learn how to train a neural network, so this post is mostly the ML setup (CNNs, tensors, loss, gradient descent), with the working attack at the end.
- Part 3 Recovering confidence from labels alone
Part 2 got us a baseline. Now we ask the model about wobbled copies of a point, and use how reliably it still gets them right as a stand-in for confidence. It beats the baseline, though the obvious way of counting the answers does worse than not augmenting at all.