The integration of machine learning (ML) in numerous critical applications introduces a range of privacy concerns for individuals who provide their datasets for model training. One such privacy risk is Membership Inference (MI), in which an attacker seeks to determine whether a particular data sample was included in the training dataset of a model. Current state-of-the-art MI attacks capitalize on access to the model's predicted confidence scores to successfully perform membership inference, and employ data poisoning to further enhance their effectiveness. In this work, we focus on the less explored and more realistic label-only setting, where the model provides only the predicted label on a queried sample. We show that existing label-only MI attacks are ineffective at inferring membership in the low False Positive Rate (FPR) regime. To address this challenge, we propose a new attack Chameleon that leverages a novel adaptive data poisoning strategy and an efficient query selection method to achieve significantly more accurate membership inference than existing label-only attacks, especially at low FPRs.

利用机器学习在多个关键应用中的整合引入了个人提供数据进行模型训练时的隐私问题，其中一个隐私风险是成员推断（Membership Inference）攻击，攻击者试图确定特定数据样本是否包含在模型的训练数据集中。本文关注较少探索且更为现实的仅标签（label-only）设置，其中模型仅提供对查询样本的预测标签，我们发现现有的仅标签成员推断攻击在低误报率（False Positive Rate，FPR）情况下无法有效推断成员身份。我们针对这一挑战提出一种新攻击方法Chameleon，利用一种新颖的自适应数据投毒策略和高效的查询选择方法，在低FPR情况下显著提高了成员推断的准确性，较现有的仅标签攻击更为有效。

变色龙：通过自适应攻击增加仅标签成员的泄露