Membership inference attacks aim to infer whether an individual record was
used to train a model, serving as a key tool for disclosure auditing. While
such evaluations are useful to demonstrate risk, they are computationally
expensive and often make strong assumptions about potential adversaries' access
to models and training environments, and thus do not provide very tight bounds
on leakage from potential attacks. We show how prior claims around black-box
access being sufficient for optimal membership inference do not hold for most
useful settings such as stochastic gradient descent, and that optimal
membership inference indeed requires white-box access. We validate our findings
with a new white-box inference attack IHA (Inverse Hessian Attack) that
explicitly uses model parameters by taking advantage of computing
inverse-Hessian vector products. Our results show that both audits and
adversaries may be able to benefit from access to model parameters, and we
advocate for further research into white-box methods for membership privacy
auditing.

成员推断攻击、披露审核、黑盒访问、白盒访问、成员隐私审核的研究。

参数是否透露了比损失函数更多的关于成员推断的信息？

Do Parameters Reveal More than Loss for Membership Inference?

External audits of AI systems are increasingly recognized as a key mechanism
for AI governance. The effectiveness of an audit, however, depends on the
degree of system access granted to auditors. Recent audits of state-of-the-art
AI systems have primarily relied on black-box access, in which auditors can
only query the system and observe its outputs. However, white-box access to the
system's inner workings (e.g., weights, activations, gradients) allows an
auditor to perform stronger attacks, more thoroughly interpret models, and
conduct fine-tuning. Meanwhile, outside-the-box access to its training and
deployment information (e.g., methodology, code, documentation,
hyperparameters, data, deployment details, findings from internal evaluations)
allows for auditors to scrutinize the development process and design more
targeted evaluations. In this paper, we examine the limitations of black-box
audits and the advantages of white- and outside-the-box audits. We also discuss
technical, physical, and legal safeguards for performing these audits with
minimal security risks. Given that different forms of access can lead to very
different levels of evaluation, we conclude that (1) transparency regarding the
access and methods used by auditors is necessary to properly interpret audit
results, and (2) white- and outside-the-box access allow for substantially more
scrutiny than black-box access alone.

外部审计、人工智能系统、黑盒访问、白盒访问、外盒访问