멤버십 추론 공격

A membership attack asks whether a given record helped train a target model. The attacker’s observations and knowledge must be specified: the original Shokri and colleagues study investigates black-box model outputs and trains shadow models to produce examples of member and nonmember behavior. An attack classifier then learns patterns that may distinguish those populations. This is different from recovering an unknown record’s complete contents. Membership alone can nevertheless reveal sensitive information when inclusion in a dataset carries a meaningful implication. Some attacks use loss or confidence differences, and overfitting can increase exposure, but no single property guarantees that every record is identifiable. Membership Inference Attacks from First Principles introduces LiRA, a likelihood-ratio approach that estimates per-example score distributions from models trained with and without the example. This calibration addresses variation in how inherently easy different records are for a model. The paper emphasizes true-positive performance at low false-positive rates rather than relying only on average attack accuracy. A false positive labels an actual nonmember as a member; for instance, ten such errors among one thousand nonmembers yield a one-percent false-positive rate. An evaluation also needs the member denominator to calculate true-positive rate. Differential privacy provides a separate formal guarantee bounding changes in a randomized mechanism’s output probabilities between neighboring datasets. Its protection depends on the privacy parameters and neighboring-record definition. An empirical attack that fails to identify members does not by itself prove that this formal guarantee was implemented.