论文标题
解剖分布推断
Dissecting Distribution Inference
论文作者
论文摘要
分布推断攻击旨在推断用于训练机器学习模型的数据的统计特性。这些攻击有时令人惊讶地有效，但是影响分布推断风险的因素尚未得到充分理解，并且表现出的攻击通常依赖于强烈而不现实的假设，例如即使在据称是黑盒威胁的情况下，培训环境的全面知识也是如此。为了提高对分布推理风险的理解，我们开发了一种新的黑盒攻击，即使在大多数设置中都超过了最著名的白色盒子攻击。使用这种新攻击，我们评估分布推理风险，同时放松有关对手知识的各种假设，例如已知的模型体系结构和仅标签访问。最后，我们评估了先前提出的防御能力的有效性，并引入了新的防御能力。我们发现，尽管基于噪声的防御能力似乎无效，但简单的重新采样防御可能非常有效。代码可从https://github.com/iamgroot42/dissecting_distribution_inference获得。
A distribution inference attack aims to infer statistical properties of data used to train machine learning models. These attacks are sometimes surprisingly potent, but the factors that impact distribution inference risk are not well understood and demonstrated attacks often rely on strong and unrealistic assumptions such as full knowledge of training environments even in supposedly black-box threat scenarios. To improve understanding of distribution inference risks, we develop a new black-box attack that even outperforms the best known white-box attack in most settings. Using this new attack, we evaluate distribution inference risk while relaxing a variety of assumptions about the adversary's knowledge under black-box access, like known model architectures and label-only access. Finally, we evaluate the effectiveness of previously proposed defenses and introduce new defenses. We find that although noise-based defenses appear to be ineffective, a simple re-sampling defense can be highly effective. Code is available at https://github.com/iamgroot42/dissecting_distribution_inference
