Privacy Leaks by Adversaries: Adversarial Iterations for Membership Inference Attack

2025/06/03 by Jing Xue, Xue, Jing, Sun, Zhishen +10
Computer Science · #Adversarial Robustness in Machine Learning #Cryptography and Data Security #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Security and Verification in Computing

paper · pdf · doi:10.48550/arxiv.2506.02711

openalex publication_date 2025/06/03 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Membership inference attack (MIA) has become one of the most widely used and effective methods for evaluating the privacy risks of machine learning models. These attacks aim to determine whether a specific sample is part of the model's training set by analyzing the model's output. While traditional membership inference attacks focus on leveraging the model's posterior output, such as confidence on the target sample, we propose IMIA, a novel attack strategy that utilizes the process of generating adversarial samples to infer membership. We propose to infer the member properties of the target sample using the number of iterations required to generate its adversarial sample. We conduct experiments across multiple models and datasets, and our results demonstrate that the number of iterations for generating an adversarial sample is a reliable feature for membership inference, achieving strong performance both in black-box and white-box attack scenarios. This work provides a new perspective for evaluating model privacy and highlights the potential of adversarial example-based features for privacy leakage assessment.

Citations

• Recite, Reconstruct, Recollect: Memorization in LMs as a Multifaceted Phenomenon
• Machine Learning-Based Vehicle Intention Trajectory Recognition and Prediction for Autonomous Driving
• Low-Cost High-Power Membership Inference Attacks
• Scalable Extraction of Training Data from (Production) Language Models
• Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning
• Privacy Side Channels in Machine Learning Systems
• Scalable Membership Inference Attacks via Quantile Regression
• SuperDriverAI: Towards Design and Implementation for End-to-End Learning-based Autonomous Driving
• Amplifying Membership Exposure via Data Poisoning
• Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets
• Leveraging Adversarial Examples to Quantify Membership Information Leakage
• Quantifying Memorization Across Neural Language Models
• Membership Inference Attacks From First Principles
• On the Importance of Difficulty Calibration in Membership Inference Attacks
• Extracting Training Data from Large Language Models
• Label-Only Membership Inference Attacks
• Systematic Evaluation of Privacy Risks of Machine Learning Models
• Simple Black-box Adversarial Attacks
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• The Space of Transferable Adversarial Examples
• Membership Inference Attacks against Machine Learning Models
• Towards Evaluating the Robustness of Neural Networks
• Explaining and Harnessing Adversarial Examples
• Impact of Dataset Properties on Membership Inference Vulnerability of Deep Transfer Learning

Related

• Membership Inference Attacks via Adversarial Examples
• Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble
• Sampling Attacks: Amplification of Membership Inference Attacks by Repeated Queries
• Membership Inference Attacks Beyond Overfitting
• How Does Data Augmentation Affect Privacy in Machine Learning?