通过训练中自然产生的数据,免费识别模型最易泄露的训练样本。
Free Record-Level Privacy Risk Evaluation Through Artifact-Based Methods
- 分析训练过程中的样本损失轨迹,无需额外训练模型
- 在标准数据集上实现92%精确率,优于传统方法
- 适合模型开发阶段快速排查隐私风险
成员推断攻击(MIAs)被广泛用于评估机器学习模型的隐私风险,既能提供模型级脆弱性指标,又能定位最易受攻击的训练样本。然而,现有最优方法需训练数百个与目标模型同架构的影子模型,计算成本极高,难以在实际应用中迭代使用,尤其对大模型不适用。本文提出一种新方法——损失轨迹四分位距(LT-IQR),通过分析训练过程中自然生成的每样本损失轨迹,识别高风险样本,无需额外模型训练。在标准基准测试中,LT-IQR在识别最脆弱样本时达到92%的precision@k=1%,且在不同数据集和模型架构下均表现优异,超越传统损失指标及使用少量影子模型的轻量级MIAs。实验还验证了其对多种MIAs方法的普适性,并开展消融研究。我们相信,LT-IQR可让开发者在模型开发过程中免费、高效地识别敏感训练样本,凸显基于训练产物的方法在隐私风险评估中的潜力。
原文摘要 · Abstract (English)
Membership inference attacks (MIAs) are widely used to empirically assess privacy risks in machine learning models, both providing model-level vulnerability metrics and identifying the most vulnerable training samples. State-of-the-art methods, however, require training hundreds of shadow models with the same architecture as the target model. This makes the computational cost of assessing the privacy of models prohibitive for many practical applications, particularly when used iteratively as part of the model development process and for large models. We propose a novel approach for identifying the training samples most vulnerable to membership inference attacks by analyzing artifacts naturally available during the training process. Our method, Loss Trace Interquartile Range (LT-IQR), analyzes per-sample loss trajectories collected during model training to identify high-risk samples without requiring any additional model training. Through experiments on standard benchmarks, we demonstrate that LT-IQR achieves 92% precision@k=1% in identifying the samples most vulnerable to state-of-the-art MIAs. This result holds across datasets and model architectures with LT-IQR outperforming both traditional vulnerability metrics, such as loss, and lightweight MIAs using few shadow models. We also show LT-IQR to accurately identify points vulnerable to multiple MIA methods and perform ablation studies. We believe LT-IQR enables model developers to identify vulnerable training samples, for free, as part of the model development process. Our results emphasize the potential of artifact-based methods to efficiently evaluate privacy risks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。