通过分析模型更新序列，更精准地判断数据是否被用于训练。
Sequential Membership Inference Attacks
- 利用模型迭代过程中的梯度或损失变化，定位目标数据插入时间。
- 在多组实验中，攻击成功率显著高于只看最终模型的旧方法。
- 适合关注隐私泄露风险的研究者与模型开发者使用。
现代AI模型在其生命周期中会经历多次更新。本文提出序列成员推断（SeMI）攻击，通过利用模型序列并控制目标数据的插入时间，实现更严格的隐私审计。针对均值计算，我们设计了最优的SeMI*攻击，可识别目标数据在特定更新步骤中的存在性。理论分析表明，访问模型序列能带来比仅分析最终模型更强的成员推断能力。SeMI*具有隔离特性——其攻击效果仅依赖于目标插入前后模型的统计特征。基于此，我们提出了白盒（访问梯度）和黑盒（访问损失）的实用攻击方法，适用于使用（DP-）SGD训练的模型。在多个数据集和模型上，实验显示SeMI攻击优于不依赖序列的基线方法，且因可控制插入时间、观察整个训练序列，能提供更紧致的隐私评估。
原文摘要 · Abstract (English)
Modern AI models are not static. They go through multiple updates in their lifecycles. We propose to design Sequential Membership Inference (SeMI) attacks leading to tighter privacy audits by exploiting the sequence of models and injecting a target canary at a controlled insertion time. First, for empirical mean computation, we develop SeMI*, an {optimal SeMI attack to identify the presence of a target inserted at a specific insertion step}. We derive the power of SeMI* to show that accessing the model sequence yields more powerful MI attacks than scrutinising only the final model. SeMI* exhibits an isolation property -- its power depends on the statistics obtained right before and after insertion of the target. Leveraging this insight, we develop practical white-box (accessing model gradients) and black-box (accessing loss) SeMI attacks against models trained with (DP-)SGD. Across datasets and models trained with (DP-)SGD, our experiments show that SeMI attacks achieve higher powers than snapshot-independent baselines, and yield tighter privacy audits thanks to (a) control over the insertion time and (b) observations across the model sequence.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。