中国邮电高校学报(英文)

中国邮电高校学报(英文) ›› 2024, Vol. 31 ›› Issue (4): 1-16.doi: 10.19682/j.cnki.1005-8885.2024.1016

• security •    下一篇

Black-box membership inference attacks based on shadow model


  

  1. School of Computer Science, Beijing University of Posts and Telecommunications, Beijing 100876, China
  • 收稿日期:2022-11-16 修回日期:2023-07-10 出版日期:2024-08-31 发布日期:2024-08-31
  • 通讯作者: Zhou Wen'an E-mail:zhouwa@bupt.edu.cn

Black-box membership inference attacks based on shadow model

  1. School of Computer Science, Beijing University of Posts and Telecommunications, Beijing 100876, China
  • Received:2022-11-16 Revised:2023-07-10 Online:2024-08-31 Published:2024-08-31

PDF

82

摘要： Membership inference attacks on machine learning models have drawn significant attention. While current research primarily utilizes shadow modeling techniques, which require knowledge of the target model and training data, practical scenarios involve black-box access to the target model with no available information. Limited training data further complicate the implementation of these attacks. In this paper, we experimentally compare common data enhancement schemes and propose a data synthesis framework based on the variational autoencoder generative adversarial network (VAE-GAN) to extend the training data for shadow models. Meanwhile, this paper proposes a shadow model training algorithm based on adversarial training to improve the shadow model's ability to mimic the predicted behavior of the target model when the target model's information is unknown. By conducting attack experiments on different models under the black-box access setting, this paper verifies the effectiveness of the VAE-GAN-based data synthesis framework for improving the accuracy of membership inference attack. Furthermore, we verify that the shadow model, trained by using the adversarial training approach, effectively improves the degree of mimicking the predicted behavior of the target model. Compared with existing research methods, the method proposed in this paper achieves a 2% improvement in attack accuracy and delivers better attack performance.

关键词: machine learning, membership inference attack, shadow model, black-box model

Abstract: Membership inference attacks on machine learning models have drawn significant attention. While current research primarily utilizes shadow modeling techniques, which require knowledge of the target model and training data, practical scenarios involve black-box access to the target model with no available information. Limited training data further complicate the implementation of these attacks. In this paper, we experimentally compare common data enhancement schemes and propose a data synthesis framework based on the variational autoencoder generative adversarial network (VAE-GAN) to extend the training data for shadow models. Meanwhile, this paper proposes a shadow model training algorithm based on adversarial training to improve the shadow model's ability to mimic the predicted behavior of the target model when the target model's information is unknown. By conducting attack experiments on different models under the black-box access setting, this paper verifies the effectiveness of the VAE-GAN-based data synthesis framework for improving the accuracy of membership inference attack. Furthermore, we verify that the shadow model, trained by using the adversarial training approach, effectively improves the degree of mimicking the predicted behavior of the target model. Compared with existing research methods, the method proposed in this paper achieves a 2% improvement in attack accuracy and delivers better attack performance.

Key words: machine learning, membership inference attack, shadow model, black-box model

中图分类号: 

版权所有 © 2020 中国邮电高校学报(英文)编辑部　
　 地址：北京邮电大学图书馆1层119 室　邮政编码：100081
Tel：86-010-62282493　Fax： 86-010-62283461　E-mail: jchupt@bupt.edu.cn
本系统由北京玛格泰克科技发展有限公司设计开发 技术支持：support@magtech.com.cn