The wide adoption and application of Masked language models~(MLMs) on
sensitive data (from legal to medical) necessitates a thorough quantitative
investigation into their privacy vulnerabilities -- to what extent do MLMs leak
information about their training data? Prior attempts at measuring leakage of
MLMs via membership inference attacks have been inconclusive, implying the
potential robustness of MLMs to privacy attacks. In this work, we posit that
prior attempts were inconclusive because they based their attack solely on the
MLM's model score. We devise a stronger membership inference attack based on
likelihood ratio hypothesis testing that involves an additional reference MLM
to more accurately quantify the privacy risks of memorization in MLMs. We show
that masked language models are extremely susceptible to likelihood ratio
membership inference attacks: Our empirical results, on models trained on
medical notes, show that our attack improves the AUC of prior membership
inference attacks from 0.66 to an alarmingly high 0.90 level, with a
significant improvement in the low-error region: at 1% false positive rate, our
attack is 51X more powerful than prior work.

使用类似于似然比假设检验的成员推理攻击方法，我们发现面向医疗笔记的掩模语言模型泄漏训练数据的隐私风险非常高，表现为先前攻击的 AUC 从 0.66 提高到 0.9 级别，并且在低误差区域有显着提高：在 1％误报率的情况下，攻击效果比先前攻击提高了 51 倍。