Machine learning models have been shown to leak information violating the
privacy of their training set. We focus on membership inference attacks on
machine learning models which aim to determine whether a data point was used to
train the victim model. Our work consists of two sides: We introduce sampling
attack, a novel membership inference technique that unlike other standard
membership adversaries is able to work under severe restriction of no access to
scores of the victim model. We show that a victim model that only publishes the
labels is still susceptible to sampling attacks and the adversary can recover
up to 100% of its performance compared to when posterior vectors are provided.
The other sides of our work includes experimental results on two recent
membership inference attack models and the defenses against them. For defense,
we choose differential privacy in the form of gradient perturbation during the
training of the victim model as well as output perturbation at prediction time.
We carry out our experiments on a wide range of datasets which allows us to
better analyze the interaction between adversaries, defense mechanism and
datasets. We find out that our proposed fast and easy-to-implement output
perturbation technique offers good privacy protection for membership inference
attacks at little impact on utility.

该研究关注于机器学习模型中有关成员推断攻击的问题，并提出了一种新的会员推断技术 —— 抽样攻击，进一步研究了两种最近的攻击模型以及针对这些攻击的防御方法，最终发现在预测输出时的输出微扰技术是一种简单易行的隐私保护方法，对预测结果的影响较小。