仅用一个训练好的模型，就能高效识别数据是否曾用于训练。
Training data membership inference via Gaussian process meta-modeling: a post-hoc analysis approach
- 基于高斯过程构建元模型，通过后验指标判断数据成员身份。
- 在多个数据集上实现高精度攻击，且无需额外查询或影子模型。
- 提供置信度估计，适合研究模型隐私风险的开发者使用。
成员推理攻击（MIAs）用于检测某条数据是否属于模型的训练集，带来严重隐私风险。现有方法通常依赖影子模型或大量查询访问，实用性受限。本文提出GP-MIA，一种基于高斯过程（GP）元建模的高效可解释方法。仅需从单个训练好的模型中提取准确率、熵、数据集统计量，以及可选的敏感性特征（如梯度、NTK度量），即可训练一个GP分类器来区分成员与非成员数据，并提供校准的不确定性估计。在合成数据、真实世界欺诈检测数据、CIFAR-10和WikiText-2上的实验表明，GP-MIA具有高准确率和强泛化能力，为现有MIAs提供了实用替代方案。
原文摘要 · Abstract (English)
Membership inference attacks (MIAs) test whether a data point was part of a model's training set, posing serious privacy risks. Existing methods often depend on shadow models or heavy query access, which limits their practicality. We propose GP-MIA, an efficient and interpretable approach based on Gaussian process (GP) meta-modeling. Using post-hoc metrics such as accuracy, entropy, dataset statistics, and optional sensitivity features (e.g. gradients, NTK measures) from a single trained model, GP-MIA trains a GP classifier to distinguish members from non-members while providing calibrated uncertainty estimates. Experiments on synthetic data, real-world fraud detection data, CIFAR-10, and WikiText-2 show that GP-MIA achieves high accuracy and generalizability, offering a practical alternative to existing MIAs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。