arXiv:2602.05748cs.AI2026-02

通过优化感知损失生成探测图像,显著提升成员推理攻击效果。

LeakBoost: Perceptual-Loss-Based Membership Inference Attack

  • 用感知损失生成探测图像,放大成员与非成员的表征差异。
  • 在多个数据集上将AUC从0.53-0.62提升至0.81-0.88。
  • 适用于白盒场景,尤其对基于梯度的检测器效果突出。

成员推理攻击(MIAs)旨在判断样本是否属于模型训练集,对现代机器学习系统构成严重隐私威胁。现有方法主要依赖静态指标(如损失或置信度),未能充分利用模型在主动探测下的动态行为。本文提出LeakBoost,一种基于感知损失的主动探测框架,通过优化激活空间目标生成探测图像,放大成员与非成员之间的表征差异。该图像由现成的成员检测器分析,无需修改检测器。结合已有方法后,LeakBoost在多个图像分类数据集和多种神经网络架构上实现显著性能提升,尤其在低误报率下表现优异:将AUC从接近随机水平(0.53–0.62)提升至0.81–0.88,且在1%误报率下的真正率提升超一个数量级。敏感性分析表明,深层特征与短时低学习率优化产生最强泄漏,改进集中于基于梯度的检测器。LeakBoost为白盒环境下隐私风险评估提供模块化、高效的解决方案,推动了动态成员推理研究。

原文摘要 · Abstract (English)

Membership inference attacks (MIAs) aim to determine whether a sample was part of a model's training set, posing serious privacy risks for modern machine-learning systems. Existing MIAs primarily rely on static indicators, such as loss or confidence, and do not fully leverage the dynamic behavior of models when actively probed. We propose LeakBoost, a perceptual-loss-based interrogation framework that actively probes a model's internal representations to expose hidden membership signals. Given a candidate input, LeakBoost synthesizes an interrogation image by optimizing a perceptual (activation-space) objective, amplifying representational differences between members and non-members. This image is then analyzed by an off-the-shelf membership detector, without modifying the detector itself. When combined with existing membership inference methods, LeakBoost achieves substantial improvements at low false-positive rates across multiple image classification datasets and diverse neural network architectures. In particular, it raises AUC from near-chance levels (0.53-0.62) to 0.81-0.88, and increases TPR at 1 percent FPR by over an order of magnitude compared to strong baseline attacks. A detailed sensitivity analysis reveals that deeper layers and short, low-learning-rate optimization produce the strongest leakage, and that improvements concentrate in gradient-based detectors. LeakBoost thus offers a modular and computationally efficient way to assess privacy risks in white-box settings, advancing the study of dynamic membership inference.

隐私攻击感知损失成员推理

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。