In a membership inference attack (MIA), an attacker exploits the
overconfidence exhibited by typical machine learning models to determine
whether a specific data point was used to train a target model. In this paper,
we analyze the performance of the state-of-the-art likelihood ratio attack
(LiRA) within an information-theoretical framework that allows the
investigation of the impact of the aleatoric uncertainty in the true data
generation process, of the epistemic uncertainty caused by a limited training
data set, and of the calibration level of the target model. We compare three
different settings, in which the attacker receives decreasingly informative
feedback from the target model: confidence vector (CV) disclosure, in which the
output probability vector is released; true label confidence (TLC) disclosure,
in which only the probability assigned to the true label is made available by
the model; and decision set (DS) disclosure, in which an adaptive prediction
set is produced as in conformal prediction. We derive bounds on the advantage
of an MIA adversary with the aim of offering insights into the impact of
uncertainty and calibration on the effectiveness of MIAs. Simulation results
demonstrate that the derived analytical bounds predict well the effectiveness
of MIAs.

模拟结果表明，会员推理攻击的效果可以很好地通过得出的分析边界进行预测。

不确定性、校准和成员推断攻击：信息论视角

Uncertainty, Calibration, and Membership Inference Attacks: An  Information-Theoretic Perspective

A membership inference attack allows an adversary to query a trained machine
learning model to predict whether or not a particular example was contained in
the model's training dataset. These attacks are currently evaluated using
average-case "accuracy" metrics that fail to characterize whether the attack
can confidently identify any members of the training set. We argue that attacks
should instead be evaluated by computing their true-positive rate at low (e.g.,
<0.1%) false-positive rates, and find most prior attacks perform poorly when
evaluated in this way. To address this we develop a Likelihood Ratio Attack
(LiRA) that carefully combines multiple ideas from the literature. Our attack
is 10x more powerful at low false-positive rates, and also strictly dominates
prior attacks on existing metrics.

本文针对成员推断攻击，提出了一种基于似然比的攻击方法，并认为攻击应该在低误报率下进行评估，发现以往攻击方法在该评估指标上表现欠佳。