Membership inference attacks (MIA) can reveal whether a particular data point was part of the training dataset, potentially exposing sensitive information about individuals. This article explores the fundamental statistical limitations associated with MIAs on machine learning models. More precisely, we first derive the statistical quantity that governs the effectiveness and success of such attacks. Then, we investigate several situations for which we provide bounds on this quantity of interest. This allows us to infer the accuracy of potential attacks as a function of the number of samples and other structural parameters of learning models, which in some cases can be directly estimated from the dataset.

会员推断攻击可以揭示出某个特定数据点是否属于训练数据集，并潜在地暴露个人敏感信息。本文探讨了与机器学习模型上的会员推断攻击相关的基本统计限制。具体而言，我们首先推导了统治这类攻击的有效性与成功的统计量。然后，我们研究了几种情况，并提供了对这个感兴趣的统计量的上下界。这使得我们能够推导出攻击的准确性与样本数量以及学习模型的其他结构参数之间的关系，在某些情况下，这些参数可以直接根据数据集进行估计。

机器学习模型隐私成员推断攻击的基本限制