Machine learning (ML) models may be deemed confidential due to their sensitive training data, commercial value, or use in security applications. Increasingly often, confidential ML models are being deployed with publicly accessible query interfaces. ML-as-a-service ("predictive analytics") systems are an example: Some allow users to train models on potentially sensitive data and charge others for access on a pay-per-query basis.The tension between model confidentiality and public access motivates our investigation of model extraction attacks. In such attacks, an adversary with black-box access, but no prior knowledge of an ML model's parameters or training data, aims to duplicate the functionality of (i.e., "steal") the model. Unlike in classical learning theory settings, ML-as-a-service offerings may accept partial feature vectors as inputs and include confidence values with predictions. Given these practices, we show simple, efficient attacks that extract target ML models with near-perfect fidelity for popular model classes including logistic regression, neural networks, and decision trees. We demonstrate these attacks against the online services of BigML and Amazon Machine Learning. We further show that the natural countermeasure of omitting confidence values from model outputs still admits potentially harmful model extraction attacks. Our results highlight the need for careful ML model deployment and new model extraction countermeasures.

机器学习与服务（MLAAS）已成为广泛的范式，即使是通过例如，也是客户可用的最复杂的机器学习模型。一个按要求的原则。这使用户避免了数据收集，超参数调整和模型培训的耗时过程。但是，通过让客户访问（预测）模型，MLAAS提供商危害其知识产权，例如敏感培训数据，优化的超参数或学到的模型参数。对手可以仅使用预测标签创建模型的副本，并以（几乎）相同的行为。尽管已经描述了这种攻击的许多变体，但仅提出了零星的防御策略，以解决孤立的威胁。这增加了对模型窃取领域进行彻底系统化的必要性，以全面了解这些攻击是成功的原因，以及如何全面地捍卫它们。我们通过对模型窃取攻击，评估其性能以及探索不同设置中相应的防御技术来解决这一问题。我们为攻击和防御方法提出了分类法，并提供有关如何根据目标和可用资源选择正确的攻击或防御策略的准则。最后，我们分析了当前攻击策略使哪些防御能力降低。

窃取对受控信息的攻击，以及越来越多的信息泄漏事件，已成为近年来新兴网络安全威胁。由于蓬勃发展和部署先进的分析解决方案，新颖的窃取攻击利用机器学习（ML）算法来实现高成功率并导致大量损坏。检测和捍卫这种攻击是挑战性和紧迫的，因此政府，组织和个人应该非常重视基于ML的窃取攻击。本调查显示了这种新型攻击和相应对策的最新进展。以三类目标受控信息的视角审查了基于ML的窃取攻击，包括受控用户活动，受控ML模型相关信息和受控认证信息。最近的出版物总结了概括了总体攻击方法，并导出了基于ML的窃取攻击的限制和未来方向。此外，提出了从三个方面制定有效保护的对策 - 检测，破坏和隔离。

We quantitatively investigate how machine learning models leak information about the individual data records on which they were trained. We focus on the basic membership inference attack: given a data record and black-box access to a model, determine if the record was in the model's training dataset. To perform membership inference against a target model, we make adversarial use of machine learning and train our own inference model to recognize differences in the target model's predictions on the inputs that it trained on versus the inputs that it did not train on.We empirically evaluate our inference techniques on classification models trained by commercial "machine learning as a service" providers such as Google and Amazon. Using realistic datasets and classification tasks, including a hospital discharge dataset whose membership is sensitive from the privacy perspective, we show that these models can be vulnerable to membership inference attacks. We then investigate the factors that influence this leakage and evaluate mitigation strategies.

会员推理攻击是机器学习模型中最简单的隐私泄漏形式之一：给定数据点和模型，确定该点是否用于培训模型。当查询其培训数据时，现有会员推理攻击利用模型的异常置信度。如果对手访问模型的预测标签，则不会申请这些攻击，而不会置信度。在本文中，我们介绍了仅限标签的会员资格推理攻击。我们的攻击而不是依赖置信分数，而是评估模型预测标签在扰动下的稳健性，以获得细粒度的隶属信号。这些扰动包括常见的数据增强或对抗例。我们经验表明，我们的标签占会员推理攻击与先前攻击相符，以便需要访问模型信心。我们进一步证明，仅限标签攻击违反了（隐含或明确）依赖于我们呼叫信心屏蔽的现象的员工推论攻击的多种防御。这些防御修改了模型的置信度分数以挫败攻击，但留下模型的预测标签不变。我们的标签攻击展示了置信性掩蔽不是抵御会员推理的可行的防御策略。最后，我们调查唯一的案例标签攻击，该攻击推断为少量异常值数据点。我们显示仅标签攻击也匹配此设置中基于置信的攻击。我们发现具有差异隐私和（强）L2正则化的培训模型是唯一已知的防御策略，成功地防止所有攻击。即使差异隐私预算太高而无法提供有意义的可证明担保，这仍然存在。

从公共机器学习（ML）模型中泄漏数据是一个越来越重要的领域，因为ML的商业和政府应用可以利用多个数据源，可能包括用户和客户的敏感数据。我们对几个方面的当代进步进行了全面的调查，涵盖了非自愿数据泄漏，这对ML模型很自然，潜在的恶毒泄漏是由隐私攻击引起的，以及目前可用的防御机制。我们专注于推理时间泄漏，这是公开可用模型的最可能场景。我们首先在不同的数据，任务和模型体系结构的背景下讨论什么是泄漏。然后，我们提出了跨非自愿和恶意泄漏的分类法，可用的防御措施，然后进行当前可用的评估指标和应用。我们以杰出的挑战和开放性的问题结束，概述了一些有希望的未来研究方向。

Machine learning (ML) models, e.g., deep neural networks (DNNs), are vulnerable to adversarial examples: malicious inputs modified to yield erroneous model outputs, while appearing unmodified to human observers. Potential attacks include having malicious content like malware identified as legitimate or controlling vehicle behavior. Yet, all existing adversarial example attacks require knowledge of either the model internals or its training data. We introduce the first practical demonstration of an attacker controlling a remotely hosted DNN with no such knowledge. Indeed, the only capability of our black-box adversary is to observe labels given by the DNN to chosen inputs. Our attack strategy consists in training a local model to substitute for the target DNN, using inputs synthetically generated by an adversary and labeled by the target DNN. We use the local substitute to craft adversarial examples, and find that they are misclassified by the targeted DNN. To perform a real-world and properly-blinded evaluation, we attack a DNN hosted by MetaMind, an online deep learning API. We find that their DNN misclassifies 84.24% of the adversarial examples crafted with our substitute. We demonstrate the general applicability of our strategy to many ML techniques by conducting the same attack against models hosted by Amazon and Google, using logistic regression substitutes. They yield adversarial examples misclassified by Amazon and Google at rates of 96.19% and 88.94%. We also find that this black-box attack strategy is capable of evading defense strategies previously found to make adversarial example crafting harder.

Machine learning algorithms, when applied to sensitive data, pose a distinct threat to privacy. A growing body of prior work demonstrates that models produced by these algorithms may leak specific private information in the training data to an attacker, either through the models' structure or their observable behavior. However, the underlying cause of this privacy risk is not well understood beyond a handful of anecdotal accounts that suggest overfitting and influence might play a role.This paper examines the effect that overfitting and influence have on the ability of an attacker to learn information about the training data from machine learning models, either through training set membership inference or attribute inference attacks. Using both formal and empirical analyses, we illustrate a clear relationship between these factors and the privacy risk that arises in several popular machine learning algorithms. We find that overfitting is sufficient to allow an attacker to perform membership inference and, when the target attribute meets certain conditions about its influence, attribute inference attacks. Interestingly, our formal analysis also shows that overfitting is not necessary for these attacks and begins to shed light on what other factors may be in play. Finally, we explore the connection between membership inference and attribute inference, showing that there are deep connections between the two that lead to effective new attacks.

机器学习模型越来越多地被世界各地的企业和组织用于自动化任务和决策。在潜在敏感的数据集上培训，已经显示了机器学习模型来泄露数据集中的个人信息以及全局数据集信息。我们在这里通过提出针对ML模型的新攻击来进一步研究数据集财产推理攻击一步：数据集相关推理攻击，其中攻击者的目标是推断模型的输入变量之间的相关性。我们首先表明攻击者可以利用相关矩阵的球面参数化，以进行明智的猜测。这意味着仅使用输入变量与目标变量之间的相关性，攻击者可以推断出两个输入变量之间的相关性，而不是随机猜测基线。我们提出了第二次攻击，利用暗影建模来利用机器学习模型来改进猜测。我们的攻击采用基于高斯opula的生成建模来生成具有各种相关性的合成数据集，以便为相关推断任务培训Meta-Model。我们评估我们对逻辑回归和多层Perceptron模型的攻击，并显示出胜过模型的攻击。我们的研究结果表明，基于机器的准确性，基于机器学习的攻击随着变量的数量而减少，并达到模型攻击的准确性。然而，无论变量的数量如何，与目标变量高度相关的输入变量之间的相关性更易受攻击。我们的工作桥梁可以考虑训练数据集和个人级泄漏的全球泄漏之间的差距。当加上边缘泄漏攻击时，它也可能构成数据集重建的第一步。

Differential privacy is a strong notion for privacy that can be used to prove formal guarantees, in terms of a privacy budget, , about how much information is leaked by a mechanism. However, implementations of privacy-preserving machine learning often select large values of in order to get acceptable utility of the model, with little understanding of the impact of such choices on meaningful privacy. Moreover, in scenarios where iterative learning procedures are used, differential privacy variants that offer tighter analyses are used which appear to reduce the needed privacy budget but present poorly understood trade-offs between privacy and utility. In this paper, we quantify the impact of these choices on privacy in experiments with logistic regression and neural network models. Our main finding is that there is a huge gap between the upper bounds on privacy loss that can be guaranteed, even with advanced mechanisms, and the effective privacy loss that can be measured using current inference attacks. Current mechanisms for differentially private machine learning rarely offer acceptable utility-privacy trade-offs with guarantees for complex learning tasks: settings that provide limited accuracy loss provide meaningless privacy guarantees, and settings that provide strong privacy guarantees result in useless models.

数十年来，计算机系统持有大量个人数据。一方面，这种数据丰度允许在人工智能（AI），尤其是机器学习（ML）模型中突破。另一方面，它可能威胁用户的隐私并削弱人类与人工智能之间的信任。最近的法规要求，可以从一般情况下从计算机系统中删除有关用户的私人信息，特别是根据要求从ML模型中删除（例如，“被遗忘的权利”）。虽然从后端数据库中删除数据应该很简单，但在AI上下文中，它不够，因为ML模型经常“记住”旧数据。现有的对抗攻击证明，我们可以从训练有素的模型中学习私人会员或培训数据的属性。这种现象要求采用新的范式，即机器学习，以使ML模型忘记了特定的数据。事实证明，由于缺乏共同的框架和资源，最近在机器上学习的工作无法完全解决问题。在本调查文件中，我们试图在其定义，场景，机制和应用中对机器进行彻底的研究。具体而言，作为最先进的研究的类别集合，我们希望为那些寻求机器未学习的入门及其各种表述，设计要求，删除请求，算法和用途的人提供广泛的参考。 ML申请。此外，我们希望概述范式中的关键发现和趋势，并突出显示尚未看到机器无法使用的新研究领域，但仍可以受益匪浅。我们希望这项调查为ML研究人员以及寻求创新隐私技术的研究人员提供宝贵的参考。我们的资源是在https://github.com/tamlhp/awesome-machine-unlearning上。

属性推理攻击使对手可以从机器学习模型中提取培训数据集的全局属性。此类攻击对共享数据集来培训机器学习模型的数据所有者具有隐私影响。已经提出了几种针对深神经网络的财产推理攻击的现有方法，但它们都依靠攻击者训练大量的影子模型，这会导致大型计算开销。在本文中，我们考虑了攻击者可以毒化训练数据集的子集并查询训练有素的目标模型的属性推理攻击的设置。通过我们对中毒下模型信心的理论分析的激励，我们设计了有效的财产推理攻击，SNAP，该攻击获得了更高的攻击成功，并且需要比Mahloujifar Et的基于最先进的中毒的财产推理攻击更高的中毒量。 al。例如，在人口普查数据集上，SNAP的成功率比Mahloujifar等人高34％。同时更快56.5倍。我们还扩展了攻击，以确定在培训中是否根本存在某个财产，并有效地估算了利息财产的确切比例。我们评估了对四个数据集各种比例的多种属性的攻击，并证明了Snap的一般性和有效性。

Machine learning (ML) has become a core component of many real-world applications and training data is a key factor that drives current progress. This huge success has led Internet companies to deploy machine learning as a service (MLaaS). Recently, the first membership inference attack has shown that extraction of information on the training set is possible in such MLaaS settings, which has severe security and privacy implications.However, the early demonstrations of the feasibility of such attacks have many assumptions on the adversary, such as using multiple so-called shadow models, knowledge of the target model structure, and having a dataset from the same distribution as the target model's training data. We relax all these key assumptions, thereby showing that such attacks are very broadly applicable at low cost and thereby pose a more severe risk than previously thought. We present the most comprehensive study so far on this emerging and developing threat using eight diverse datasets which show the viability of the proposed attacks across domains.In addition, we propose the first effective defense mechanisms against such broader class of membership inference attacks that maintain a high level of utility of the ML model.

鉴于对机器学习模型的访问，可以进行对手重建模型的培训数据？这项工作从一个强大的知情对手的镜头研究了这个问题，他们知道除了一个之外的所有培训数据点。通过实例化混凝土攻击，我们表明重建此严格威胁模型中的剩余数据点是可行的。对于凸模型（例如Logistic回归），重建攻击很简单，可以以封闭形式导出。对于更常规的模型（例如神经网络），我们提出了一种基于训练的攻击策略，该攻击策略接收作为输入攻击的模型的权重，并产生目标数据点。我们展示了我们对MNIST和CIFAR-10训练的图像分类器的攻击的有效性，并系统地研究了标准机器学习管道的哪些因素影响重建成功。最后，我们从理论上调查了有多差异的隐私足以通过知情对手减轻重建攻击。我们的工作提供了有效的重建攻击，模型开发人员可以用于评估超出以前作品中考虑的一般设置中的个别点的记忆（例如，生成语言模型或访问培训梯度）;它表明，标准模型具有存储足够信息的能力，以实现培训数据点的高保真重建;它表明，差异隐私可以成功减轻该参数制度中的攻击，其中公用事业劣化最小。

模型可以公开有关其培训数据的敏感信息。在属性推理攻击中，对手对某些培训记录有部分知识，并访问了对这些记录进行培训的模型，并渗透了这些记录敏感功能的未知值。我们研究了一种属性推理的细粒变体，我们称为\ emph {敏感值推理}，其中对手的目标是高度置信度识别一些来自候选人集的记录，其中未知属性具有特定的敏感值。我们将属性推断与捕获培训分布统计数据的数据插补进行明确比较，该数据在对对手可用的培训数据的各种假设下进行了比较。我们的主要结论是：（1）以前的属性推理方法并没有比对手可以推断出有关训练数据的训练数据的更多信息，而无需访问训练的模型，而是对培训所需的基础分布相同的知识属性推理攻击； （2）Black-Box属性推理攻击很少学习没有模型的任何东西；但是（3）我们在论文中介绍和评估的白框攻击可以可靠地识别一些具有敏感值属性的记录，而这些记录在不访问模型的情况下无法预测。此外，我们表明提出的防御措施，例如私人培训和从培训中删除脆弱记录不会减轻这种隐私风险。我们的实验代码可在\ url {https://github.com/bargavj/evaluatingdpml}上获得。

机器学习（ML）模型已广泛应用于各种应用，包括图像分类，文本生成，音频识别和图形数据分析。然而，最近的研究表明，ML模型容易受到隶属推导攻击（MIS），其目的是推断数据记录是否用于训练目标模型。 ML模型上的MIA可以直接导致隐私违规行为。例如，通过确定已经用于训练与某种疾病相关的模型的临床记录，攻击者可以推断临床记录的所有者具有很大的机会。近年来，MIS已被证明对各种ML模型有效，例如，分类模型和生成模型。同时，已经提出了许多防御方法来减轻米西亚。虽然ML模型上的MIAS形成了一个新的新兴和快速增长的研究区，但还没有对这一主题进行系统的调查。在本文中，我们对会员推论和防御进行了第一个全面调查。我们根据其特征提供攻击和防御的分类管理，并讨论其优点和缺点。根据本次调查中确定的限制和差距，我们指出了几个未来的未来研究方向，以激发希望遵循该地区的研究人员。这项调查不仅是研究社区的参考，而且还为该研究领域之外的研究人员带来了清晰的照片。为了进一步促进研究人员，我们创建了一个在线资源存储库，并与未来的相关作品继续更新。感兴趣的读者可以在https://github.com/hongshenghu/membership-inference-machine-learning-literature找到存储库。

Collaborative machine learning and related techniques such as federated learning allow multiple participants, each with his own training dataset, to build a joint model by training locally and periodically exchanging model updates. We demonstrate that these updates leak unintended information about participants' training data and develop passive and active inference attacks to exploit this leakage. First, we show that an adversarial participant can infer the presence of exact data points-for example, specific locations-in others' training data (i.e., membership inference). Then, we show how this adversary can infer properties that hold only for a subset of the training data and are independent of the properties that the joint model aims to capture. For example, he can infer when a specific person first appears in the photos used to train a binary gender classifier. We evaluate our attacks on a variety of tasks, datasets, and learning configurations, analyze their limitations, and discuss possible defenses.

This paper describes a testing methodology for quantitatively assessing the risk that rare or unique training-data sequences are unintentionally memorized by generative sequence models-a common type of machine-learning model. Because such models are sometimes trained on sensitive data (e.g., the text of users' private messages), this methodology can benefit privacy by allowing deep-learning practitioners to select means of training that minimize such memorization.In experiments, we show that unintended memorization is a persistent, hard-to-avoid issue that can have serious consequences. Specifically, for models trained without consideration of memorization, we describe new, efficient procedures that can extract unique, secret sequences, such as credit card numbers. We show that our testing strategy is a practical and easy-to-use first line of defense, e.g., by describing its application to quantitatively limit data exposure in Google's Smart Compose, a commercial text-completion neural network trained on millions of users' email messages.

在培训机器学习模型期间，它们可能会存储或“了解”有关培训数据的更多信息，而不是预测或分类任务所需的信息。属性推理攻击旨在从给定模型的培训数据中提取统计属性，而无需访问培训数据本身，从而利用了这一点。这些属性可能包括图片的质量，以识别相机模型，以揭示产品的目标受众的年龄分布或在计算机网络中使用恶意软件攻击的随附的主机类型。当攻击者可以访问所有模型参数时，即在白色盒子方案中，此攻击尤其准确。通过捍卫此类攻击，模型所有者可以确保其培训数据，相关的属性以及其知识产权保持私密，即使他们故意共享自己的模型，例如协作培训或模型泄漏。在本文中，我们介绍了属性，这是针对白盒属性推理攻击的有效防御机制，独立于培训数据类型，模型任务或属性数量。属性通过系统地更改目标模型的训练的权重和偏见来减轻属性推理攻击，从而使对手无法提取所选属性。我们在三个不同的数据集（包括表格数据和图像数据）以及两种类型的人工神经网络（包括人造神经网络）上进行了经验评估属性。我们的研究结果表明，以良好的隐私性权衡取舍，可以保护机器学习模型免受财产推理攻击的侵害，既有效又可靠。此外，我们的方法表明该机制也有效地取消了多个特性。

即使机器学习算法已经在数据科学中发挥了重要作用，但许多当前方法对输入数据提出了不现实的假设。由于不兼容的数据格式，或数据集中的异质，分层或完全缺少的数据片段，因此很难应用此类方法。作为解决方案，我们提出了一个用于样本表示，模型定义和培训的多功能，统一的框架，称为“ Hmill”。我们深入审查框架构建和扩展的机器学习的多个范围范式。从理论上讲，为HMILL的关键组件的设计合理，我们将通用近似定理的扩展显示到框架中实现的模型所实现的所有功能的集合。本文还包含有关我们实施中技术和绩效改进的详细讨论，该讨论将在MIT许可下发布供下载。该框架的主要资产是其灵活性，它可以通过相同的工具对不同的现实世界数据源进行建模。除了单独观察到每个对象的一组属性的标准设置外，我们解释了如何在框架中实现表示整个对象系统的图表中的消息推断。为了支持我们的主张，我们使用框架解决了网络安全域的三个不同问题。第一种用例涉及来自原始网络观察结果的IoT设备识别。在第二个问题中，我们研究了如何使用以有向图表示的操作系统的快照可以对恶意二进制文件进行分类。最后提供的示例是通过网络中实体之间建模域黑名单扩展的任务。在所有三个问题中，基于建议的框架的解决方案可实现与专业方法相当的性能。