OSLO: One-Shot Label-Only Membership Inference Attacks

To Reviewer CtKQ:

Response to Weaknesses 1: Thank you for your feedback. We apologize for not including a comparison with YOQO [1] in our initial submission. Please note that OSLO and YOQO differ in several key aspects:

• Effectiveness on Low FPR Settings: The accepted norm in the MIA community is that achieving low FPR is key for MIAs to be practical [2][3][4]. By design, YOQO cannot adjust the TPR and FPR trade-off and thus cannot achieve low FPRs, which is also acknowledged in their paper [1]. We reproduced YOQO's results on ResNet18 with 2,500 training samples (as used in their paper), and although it achieved over 80% attack accuracy, its FPR was 26%, which makes it highly impractical. On the other hand, OSLO is designed to achieve high attack TPR under low FPR conditions and significantly outperforms previous methods on this metric. Thus, we are not able to have a fair comparison because YOQO cannot achieve the low FPR that OSLO primarily works on.

• Methodology: To our knowledge, OSLO is the first to use transfer-based adversarial attacks to create label-only attack samples. In contrast, YOQO is a variant of the previous work LIRA [3] in a label-only setting, requiring the training of models on the target sample (IN models) and models not trained on the target sample (OUT models). It optimizes the differences between IN and OUT models to construct attack samples.

• Assumptions about the Attacker: OSLO does not assume that the attacker knows the target model's architecture. In our experiments, the surrogate model used has a different architecture from the target model. YOQO, however, relies on the similarity between shadow models and the target model, and the difference in architecture significantly impacts its effectiveness [1].

We will include these comparisons in the revised version of our paper.

Regarding the comparison with [2], [2] and OSLO operate in different settings. [2] requires access to the target model's logits, whereas OSLO operates in a label-only context. In this paper, we only compare with label-only MIAs, but we will include a discussion of [2] in the related work section. We hope this clarifies our contributions and the significance of our work.

Response to Question 1: Thank you for your question. We tested the effectiveness of OSLO against target models trained with different algorithms and found that OSLO remains highly effective. Below are the results for CIFAR-10 using ResNet18, where the target model was trained with SGD, and the surrogate models were trained with Adam:

These results demonstrate that OSLO is effective even when the target model is trained using a different algorithm. We will include these findings in the revised version of the paper.

Response to Question 2: Thank you for your question. OSLO does not require retraining any models when applied to a new target data point. For a given target model, OSLO trains the source models and validation models only once. These models can then be used to add perturbations to all target samples. For a new target data point, we compute gradient updates on the source models and validate using the pre-trained validation models. This process uses the already trained models, so no retraining is needed.

References:

[1] Wu et al. You Only Query Once: An Efficient Label-Only Membership Inference Attack. ICLR’24
[2] Wen et al. Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries. ICLR’23
[3] Carlini et al. Membership Inference from First Principles. S&P’22
[4] Chaudhari et al. Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning. ICLR’24

To Reviewer Vvp4:

Response to Weaknesses 1: Thank you for your insightful feedback. We apologize for not including a comparison with YOQO in our paper. Please note that the accepted norm in the MIA community is that achieving low FPR is key for MIAs to be practical [1][2]. Although YOQO also requires only a single query, it is designed in a way that it cannot adjust the TPR and FPR trade-off, and thus cannot achieve low FPRs (as acknowledged in their paper [3]), making YOQO highly impractical. For example, we reproduced YOQO's experiments on ResNet18 using 2,500 training samples (as per their settings), and although the attack accuracy was over 80%, the FPR was 26%. In contrast, OSLO is primarily designed to achieve high TPR under low FPR conditions. Therefore, we are not able to have a fair comparison because YOQO cannot achieve the low FPRs that OSLO achieves.

Response to Weaknesses 2/3/4: Thank you for pointing these out. We will clarify and fix these issues in our paper, including the introduction of variables in Equation 2 and correcting the typos.

Response to Question 1: Thank you for your suggestion. In our experiments, we found that stopping the generation of the adversarial example as soon as the label flips does not ensure that enough perturbation is added to achieve a sufficiently low FPR. For example, with ResNet18:

We observed that a small $\tau$ is needed to achieve a low FPR. We will include experimental comparisons regarding this in the final version of the paper. Thank you for bringing this up.

Response to Question 2: Thank you for your question. We believe the attacker can choose $\tau$ based on the desired FPR. By adjusting the success rate of the transfer-based adversarial attack on the target model, the attacker can set $\tau$ accordingly. For example, if the attacker tolerates an FPR of 5%, they can adjust $\tau$ to achieve a 95% success rate on the target model. This may introduce an additional assumption by requiring a small set of non-members to detect the success rate of the adversarial attack; however, access to some non-members is a common assumption in MIAs [4][5]. We will include this discussion in the next version of the paper.

Response to Question 3: We agree that dynamic adjustment of the threshold is a promising direction for improving OSLO. However, it is challenging to determine how to adjust the threshold without prior knowledge of the target sample's membership. The high-level idea of OSLO is to choose a sufficiently small $\tau$ to ensure all non-members are misclassified, thus identifying members who are correctly classified. Currently, we use the same threshold for all samples based on this intuition.

Response to Question 4: Thank you for pointing this out. In our experiments, we used ResNet18 on CIFAR-10. The following hyperparameters were varied:

We will further clarify the model structures and hyperparameters used in the defenses mentioned in Section 6.2 of the revised paper.

References:

[1] Carlini et al. Membership Inference from First Principles. S&P’22
[2] Chaudhari et al. Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning. ICLR’24
[3] Wu et al. You Only Query Once: An Efficient Label-Only Membership Inference Attack. ICLR’24
[4] Salem et al. ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. NDSS’19
[5] Hui et al. Practical Blind Membership Inference Attack via Differential Comparisons. NDSS’21

To Reviewer B8Vg:

Response to Weakness 1: Thank you for your suggestion. We agree that deeper research into defenses against such attacks is a promising direction. However, due to space limitations, we focused our contribution on improving label-only MIAs in terms of query cost and attack performance. We will leave further exploration of defenses for future work.

Response to Weakness 2: Thank you for your insightful feedback. The calculation of perturbations in OSLO occurs locally, and the time required for each sample is limited (less than 3 minutes on CIFAR-10). We believe this computational cost is acceptable for an attack setting. Once the calculations are complete, only one query to the target model is needed by the attacker, making the attack highly practical against target models under almost any resource constraints.

It is important to note that previous methods, while using uniform thresholds, still require calculating specific perturbations for each sample. This process involves continuous access to the target model, resulting in potentially thousands of queries [1][2]. This can be impractical for resource-limited target models. In contrast, OSLO minimizes the number of queries to the target model, thus offering a more efficient approach.

Response to Question 1: Thank you for your question. We tested OSLO against target models trained with adversarial training. The results are as shown in the table below:

We observed that adversarial training can reduce OSLO's ability to achieve low FPR, but it also reduces model utility and increases training overhead. Additionally, it increases the overall difference in robustness to adversarial examples between members and non-members, potentially leading to improved attack effectiveness on average metrics such as attack accuracy. We will discuss these aspects further in the next version of the paper.

References:

[1] Choquette-Choo et al. Label-Only Membership Inference Attacks. ICML’21.
[2] Li et al. Membership leakage in label-only exposures. CCS’21

To Reviewer uq6v:

Response to Weaknesses 1: Thank you for your feedback. While we acknowledge that training these surrogate models introduces additional computational overhead, it is a one-time process for each target model. Once completed, these models can be used to infer any target sample's membership, unlike previous online attacks [2][3] that require retraining shadow models for each sample.

Moreover, training shadow or surrogate models is a standard practice in MIAs, including well-cited state-of-the-art works [1][2]. It is worth noting that OSLO requires fewer models compared to the related works. For instance, the state-of-the-art score-based MIA LiRA [2] requires training at least 128 shadow models, and the most recent label-only attack YOQO [3] requires training 32 shadow models. However, OSLO needs fewer than 20 surrogate models (e.g., 12 for CIFAR-10, 18 for CIFAR-100, and 6 for SVHN). To our knowledge, OSLO is the first label-only attack to achieve high TPR under low FPR. Therefore, we believe the computational cost is acceptable given the improvements.

Response to Weaknesses 2 / Question 1: Instead of tuning our method on the test or validation data, we adjust $\tau$ to obtain and report the complete ROC curve (e.g., in Figures 2 and 3, each point on OSLO's ROC curve corresponds to a different $\tau$). The primary goal of this adjustment is to capture the trade-off between TPR and FPR rather than setting $\tau$ to a fixed value derived from any specific data set. This approach is analogous to adjusting loss thresholds to generate the ROC curve, as discussed in previous loss-based MIAs [2]. We are happy to provide further details during the interactive discussion if our explanation does not fully address your question.

Response to Weaknesses 3 / Question 2: Thank you for pointing this out. We apologize for omitting the training details due to page limitations. For CIFAR-10 and CIFAR-100, we use half of the training set (25,000 samples) to train the target model and the remaining half (25,000 samples) to train the source models and validation models. The source models and validation models are trained on the same data but are disjoint from the data used to train the target model. Similarly, for SVHN, we use two disjoint subsets of 5,000 samples each to train the target model and the surrogate models. For the evaluation of the attack, we randomly select 1,000 samples from both the target model's training set and the remaining samples (not used for any model training) as target samples. Here is a summary table to clarify the data split:

We will clarify these details and add them to the appendix in the revised manuscript.

Response to Weaknesses 4: Thank you for your valuable suggestions. We appreciate your understanding of the innovative aspects of OSLO. Regarding the impact of the number of source models and validation models on the attack performance, We have found that increasing the number of source and validation models does not significantly improve the trade-off between TPR and FPR, or the trade-off between precision and recall, but it allows for further trading TPR to achieve lower FPR. We have included these discussions in Appendix A.3.

Regarding the ablation study on the role of validation models, we are running experiments on that and will post the results once they become available during the interactive discussion.

Response to Question 3: Thank you for your question. In our default settings, we train the following number of source and validation models:

• CIFAR-10: 3 source models and 9 validation models (3 models per architecture)
• CIFAR-100: 3 source models and 15 validation models (5 models per architecture)
• SVHN: 3 source models and 3 validation models (1 model per architecture)

We will provide a detailed description of the source and validation model configurations in the revised paper.

References:

[1] Shokri et al. Membership Inference Attacks against Machine Learning Models. S&P’17
[2] Carlini et al. Membership Inference from First Principles. S&P’22
[3] Wu et al. You Only Query Once: An Efficient Label-Only Membership Inference Attack. ICLR’24