It has been widely acknowledged that machine learning models can leak a significant amount of (potentially private) information about their training data. Analyzing the amount of information leaked about the training data is important to judge the model's privacy. In practice, so-called membership inference attacks [1,2] are employed for such a privacy audit. A membership inference attack tries to predict whether a particular data sample was used in the training of a machine learning model. Besides empirical research, membership inference attacks have been put on a theoretical foundation through a Bayesian decision framework [3].

The goal of this seminar topic is to understand state-of-the-art membership inference attacks [1,2] and the Bayesian decision framework [3]. Students are encouraged to produce their own results using openly available implementations.

[1] N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis and F. Tramèr, "Membership Inference Attacks From First Principles," 2022 IEEE Symposium on Security and Privacy (SP), 2022.

[2] S. Zarifzadeh, P. Liu, R. Shokri, "Low-Cost High-Power Membership Inference Attacks," ICML 2024.

[3] A. Sablayrolles, M. Douze, C. Schmid, Y. Ollivier, H. Jegou, "White-box vs Black-box: Bayes Optimal Strategies for Membership Inferenc," Proceedings of the 36th International Conference on Machine Learning, 2019.

Prerequisites