Membership inference攻击无法证明模型用过你的数据，因无法验证假阳性率。
Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Data
- 用会员推理攻击做训练数据证明不成立，因无法模拟无训练数据的假设。
- 真实训练数据证明需低假阳性，但无法复现未训练该数据的模型状态。
- 建议改用数据提取攻击或特殊可测数据（canary data）实现可信证明。
我们探讨了训练数据证明问题：数据所有者希望向第三方证明某机器学习模型是基于其数据训练的。此类证明在针对基于网络大规模数据训练的基础模型的诉讼中至关重要。此前许多工作建议使用会员推理攻击来构建训练数据证明。但我们认为这一方法本质上不可靠：要提供令人信服的证据，数据所有者需证明其攻击具有低假阳性率，即在模型未训练目标数据的零假设下，攻击结果极不可能出现。然而，由于未知训练集的具体内容，且无法高效重训大型基础模型，这种零假设的采样不可行。最后我们提出两种可行路径：利用数据提取攻击，以及在特殊可测数据（canary data）上进行会员推理，均可构建更可靠的训练数据证明。
原文摘要 · Abstract (English)
We consider the problem of a training data proof, where a data creator or owner wants to demonstrate to a third party that some machine learning model was trained on their data. Training data proofs play a key role in recent lawsuits against foundation models trained on web-scale data. Many prior works suggest to instantiate training data proofs using membership inference attacks. We argue that this approach is fundamentally unsound: to provide convincing evidence, the data creator needs to demonstrate that their attack has a low false positive rate, i.e., that the attack's output is unlikely under the null hypothesis that the model was not trained on the target data. Yet, sampling from this null hypothesis is impossible, as we do not know the exact contents of the training set, nor can we (efficiently) retrain a large foundation model. We conclude by offering two paths forward, by showing that data extraction attacks and membership inference on special canary data can be used to create sound training data proofs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。