MIBench.github.io

Comparing Different Membership Inference Attacks with a Comprehensive Benchmark

Membership inference (MI) attacks threaten user privacy through determining if a given data example has been used to train a target model. However, although the new MI attacks have substantially enhanced researchers’ understanding about how Membership Inference could be conducted in various ways, we found that a common conclusion made in these attack proposals could be misleading. We call this finding the Conflicting Comparison Result (CCR) Phenomenon. This paper seeks to present the systematic analysis we have conducted and interpret the conflicting comparison results resulted from the analysis. In order to systematically conduct the analysis, we have developed MIBench, a new benchmark in the area of Membership Inference. The uniqueness of MIBench is as follows: our benchmark consists not only the evaluation metrics, but also the evaluation scenarios (ESs). And we design the ESs from four perspectives: the distance distribution of data samples in the target dataset, the distance between data samples in the target dataset, the differential distance between two datasets (i.e., the target dataset and a generated dataset with only nonmembers), and the ratio of the samples that are made no inferences by an MI attack. The evaluation metrics consist of ten typical evaluation metrics. We have designed and implemented the MIBench benchmark with 84 evaluation scenarios for each dataset. In total, we have used our benchmark to fairly and systematically compare 15 state-of-the-art MI attack algorithms across 588 evaluation scenarios, and these evaluation scenarios cover 7 widely used datasets and 7 representative types of models. To the best of our knowledge, this paper is the first work reporting and analyzing the CCR Phenomenon. Our experimental analysis reveals 83 conflicting comparison results, and we have gained strong evidences that the CCR Phenomenon is widely existing. All codes and evaluations of MIBench are publicly available at this link1.

MI attacks:

NN_attack
Loss-Threshold
Label-only
Top3-NN attack
Top1-Threshold
BlindMI-Diff-w
BlindMI-Diff-w/o
BlindMI-Diff-1CLASS
Top2+True
Privacy Risk Scores
Shapley Values
Positive Predictive Value
Calibrated Score
Distillation-based Thre.
Likelihood ratio attack

Datasets: CIFAR100, CIFAR10, CH_MNIST, ImageNet, Location30, Purchase100, Texas100

Models: MLP, StandDNN, VGG16, VGG19, ResNet50, ResNet101, DenseNet121

Requirements: You can run the following script to configurate necessary environment sh ./sh/install.sh

Usage: Please first to make a folder for record, all experiment results with save to record folder as default. And make folder for data to put supported datasets. XXX XXX

Attack: This is a demo script of running NN_attack on CIFAR100. python ./attack/NN_attack.py --yaml_path ../config/attack/NN/CIFAR100.yaml --dataset CIFAR100 --dataset_path ../data --save_folder_name CIFAR100_0_1

Selected attacks:

Evaluation Framework:
MIBench is a comprehensive benchmark for comparing different MI attacks, which consists not only the evaluation metric module, but also the evaluation scenario module.

Part I: Evaluation Scenarios

In this work, we have designed and implemented the MIBench benchmark with 84 evaluation scenarios for each dataset. In total, we have used our benchmark to fairly and systematically compare 15 state-of-the-art MI attack algorithms across 588 evaluation scenarios, and these evaluation scenarios cover 7 widely used datasets and 7 representative types of models.

(a) Evaluation Scenarios of CIFAR100.

(b) Evaluation Scenarios of CIFAR10.

(c) Evaluation Scenarios of CH_MNIST.

(d) Evaluation Scenarios of ImageNet.

(e) Evaluation Scenarios of Location30.

(f) Evaluation Scenarios of Purchase100.

(g) Evaluation Scenarios of Texas100.

Part II: Evaluation Metrics

We mainly use attacker-side accuracy, precision, recall, f1-score, false positive rate (FPR), false negative rate (FNR), membership advantage (MA), the Area Under the Curve (AUC) of attack Receiver Operating Characteristic (ROC) curve, TPR @ fixed (low) FPR, threshold at maximum MA, as our evaluation metrics. The details of the evaluation metrics are shown as follows.

(a) accuracy: the percentage of data samples with correct membership predictions by MI attacks;
(b) precision: the ratio of real-true members predicted among all the positive membership predictions made by an adversary;
(c) recall: the ratio of true members predicted by an adversary among all the real-true members;
(d) f1-score: the harmonic mean of precision and recall;
(e) false positive rate (FPR): the ratio of nonmember samples are erroneously predicted as members;
(f) false negative rate (FNR): the difference of the 1 and recall (e.g., FNR=1-recall);
(g) membership advantage (MA)：the difference between the true positive rate and the false positive rate (e.g., MA = TPR - FPR);
(h) Area Under the Curve (AUC): computed as the Area Under the Curve of attack Receiver Operating Characteristic (ROC);
(i) TPR @ fixed (low) FPR: an attack’s truepositive rate at (fixed) low false-positive rates;
(j) threshold at maximum MA: a threshold to achieve maximum MA.

Results:

The results section consists of three parts: the results of 84 evaluation scenarios (ES), the thresholds at maximum MA of the Risk score and Shapley values attacks and the results of 4 research questions (RQ). And in part I and part III, we identify the evaluation results of 15 state-of-the-art MI attacks by ten evaluation metrics (e.g., attacker-side accuracy, precision, recall, f1-score, FPR, FNR, MA, AUC, TPR @ fixed (low) FPR (T@0.01%F and T@0.1%F), threshold at maximum MA).

Part I: The Results of 84 Evaluation Scenarios

1. Distillation-based:

(1) CIFAR100: (2) CIFAR10: (3) CH_MNIST: (4) ImageNet: (5) Location30:
(6) Purchase100:
(7) Texas100:

2. Calibrated Score:

(1) CIFAR100: (2) CIFAR10: (3) CH_MNIST: (4) ImageNet: (5) Purchase100:
(6) Texas100:

3. Label-only:

(1) CIFAR100: (2) CIFAR10: (3) CH_MNIST: (4) ImageNet: (5) Location30:
(6) Purchase100:
(7) Texas100:

4. NN_attack:

(1) CIFAR100: (2) CIFAR10: (3) CH_MNIST: (4) ImageNet:
(5) Location30: (6) Purchase100:
(7) Texas100:

5. PPV: