Membership inference (MI) attacks try to determine if a data sample was used
to train a machine learning model. For foundation models trained on unknown Web
data, MI attacks can be used to detect copyrighted training materials, measure
test set contamination, or audit machine unlearning. Unfortunately, we find
that evaluations of MI attacks for foundation models are flawed, because they
sample members and non-members from different distributions. For 8 published MI
evaluation datasets, we show that blind attacks -- that distinguish the member
and non-member distributions without looking at any trained model -- outperform
state-of-the-art MI attacks. Existing evaluations thus tell us nothing about
membership leakage of a foundation model's training data.

成员推理攻击通过确定数据样本是否用于训练机器学习模型，可以检测版权训练材料，衡量测试集的污染程度或审计机器遗忘。然而，对于基于未知网络数据训练的基础模型的成员推理攻击的评估存在缺陷，因为它们从不同的分布中对成员和非成员进行采样。对于 8 个已发布的成员推理评估数据集，我们显示盲攻击 - 区分成员和非成员分布而不查看任何训练模型 - 胜过最先进的成员推理攻击。因此，现有的评估对于基础模型的训练数据的成员泄漏没有任何作用。

基础模型盲目基准优于基金会模型的成员推断攻击

Blind Baselines Beat Membership Inference Attacks for Foundation Models

Model Inversion (MI) attacks aim to disclose private information about the
training data by abusing access to the pre-trained models. These attacks enable
adversaries to reconstruct high-fidelity data that closely aligns with the
private training data, which has raised significant privacy concerns. Despite
the rapid advances in the field, we lack a comprehensive overview of existing
MI attacks and defenses. To fill this gap, this paper thoroughly investigates
this field and presents a holistic survey. Firstly, our work briefly reviews
the traditional MI on machine learning scenarios. We then elaborately analyze
and compare numerous recent attacks and defenses on \textbf{D}eep
\textbf{N}eural \textbf{N}etworks (DNNs) across multiple modalities and
learning tasks.

模型反演攻击致力于利用对预训练模型的访问权限揭示关于训练数据的私密信息，这些攻击使得对与私密训练数据密切一致的高保真数据的重建成为可能，从而引发了重大的隐私担忧。尽管该领域取得了快速的进展，但我们仍然缺乏对现有模型反演攻击和防御方法的全面概述。为了填补这一空白，本文对该领域进行了深入研究，并提出了综合调查报告。首先，本文简要回顾了机器学习场景下传统的模型反演方法。然后，对多种模态和学习任务下深度神经网络 (DNNs) 的近期攻击和防御方法进行了详细分析和比较。

DNN 隐私泄露：模型倒置攻击和防御方法的调查

Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and  Defenses

Membership inference (MI) attacks threaten user privacy through determining
if a given data example has been used to train a target model. However, it has
been increasingly recognized that the "comparing different MI attacks"
methodology used in the existing works has serious limitations. Due to these
limitations, we found (through the experiments in this work) that some
comparison results reported in the literature are quite misleading. In this
paper, we seek to develop a comprehensive benchmark for comparing different MI
attacks, called MIBench, which consists not only the evaluation metrics, but
also the evaluation scenarios. And we design the evaluation scenarios from four
perspectives: the distance distribution of data samples in the target dataset,
the distance between data samples of the target dataset, the differential
distance between two datasets (i.e., the target dataset and a generated dataset
with only nonmembers), and the ratio of the samples that are made no inferences
by an MI attack. The evaluation metrics consist of ten typical evaluation
metrics. We have identified three principles for the proposed "comparing
different MI attacks" methodology, and we have designed and implemented the
MIBench benchmark with 84 evaluation scenarios for each dataset. In total, we
have used our benchmark to fairly and systematically compare 15
state-of-the-art MI attack algorithms across 588 evaluation scenarios, and
these evaluation scenarios cover 7 widely used datasets and 7 representative
types of models. All codes and evaluations of MIBench are publicly available at
this https URL

本文提出了一个称为 MIBench 的综合基准，旨在比较不同的成员推断攻击，其中包括评估指标和评估场景，并且以公平和系统的方式比较了 15 种最先进的 MI 攻击算法，覆盖了 7 个广泛使用的数据集和 7 种代表性的模型。