We investigate how machine learning models leak information about the individual data records on which they were trained. We focus on the basic membership inference attack: given a data record and black-box access to a model, determine whether the record was in the model's training dataset. To perform membership inference against a target model, we make adversarial use of machine learning and train our own inference attack model to recognize differences in the target model's predictions on inputs that it trained on versus inputs that it did not use during training. We empirically evaluate our inference techniques on classification models trained by commercial "machine learning as a service" providers such as Google and Amazon. Using realistic datasets and classification tasks, we show that these models can be significantly vulnerable to membership inference attacks.

本文通过对机器学习模型泄露个人数据记录的数量进行定量研究，并聚焦于基本的成员推理攻击，利用对手方机器学习技术来训练自己的推理模型，识别目标模型在训练和未训练输入上的预测差异，我们评估了这种推理技术对各种分类模型的影响，包括敏感医院出院数据集，发现这些模型容易受到成员攻击，并探讨影响泄漏的因素并评估缓解策略。

针对机器学习模型的成员推断攻击