Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: In this work, an adversarial query method is proposed to boost the likelihood test-driven membership inference attack (LiRA). Instead of using the target data point as a query directly, the adversary first estimates a variant of the target data point by slightly perturbing the original target data point and minimising the fitting loss of the in-class hypothesis and out-class shadow models. The attacker then uses the estimated variant as an adversary query to infer the membership of the target data point. Experimental study shows that using the adversarial query can indeed improve the attack performances of LiRA in the low FPR regime over different datasets. 
strength_and_weaknesses: Strong point: 

Perturbing the target data point to boost the membership inference precision is a novel and interesting idea. The core idea behind is to make use of the perturbed variant of the target data point to facilitate the attack. Even though the loss of the target data point may hardly vary if the target data point is considered to be an in- or out-class sample, the perturbed variants within the epsilon-neighbourhood of the target data point can potentially unveil more information to identify the membership. 

Weakness: 
1. In Table.2, the AUC and the TPR values (given the FPR level) of membership inference attack do not provide a monotonic decreasing as the reproductivity of the target model decreases (as claimed in the paper, the target models in Table.2 are given in a descending order of the model reproductivity.) 

2. On page 8, why does the attack performance become worse if the bound epsilon becomes larger or smaller than 2? Any explanation to the observation?  Is there any potential trade-off related to the choice of epsilon ? 

3. More theoretical study regarding the effectiveness of the adversarial query could further consolidate this work. The adversarial perturbation added to the target data point may help show the loss distribution within the epsilon-neighborhood of the target data point. Though the loss on the target data point may not be rich enough for a successful membership inference attack, the difference of the loss distribution may provide a better lens to differentiate two different membership classes. For the moment, the reasonability behind Eq.3 is still not very clear. 
clarity,_quality,_novelty_and_reproducibility: The presentation of this work is well organised and the main contribution is clearly conveyed. Besides, the paper provides enough details to reproduce the experimental results. 
summary_of_the_review: I like the idea of injecting additional perturbation to boost the data privacy leak-driven attack. It offers an alternative way to differentiate the membership class given a target data, other than compare the membership likelihood scores as in LiRA. However, the major bottleneck of this work is the lack of explanation and discussions regarding the experimental observations. As pointed out in the weakness, there is apparently a trade-off existing in the choice of epsilon. This is also related to the theoretical justification of the rationality of Eq.3. Without these discussions, it is difficult to understand why and when the proposed method can improve the inference performances.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: Paper proposes a membership inference method based on learning query vectors, and shows that it improves the current state-of-the-art methods. 
strength_and_weaknesses: Membership inference attacks are of great interest to the privacy and security community, and the paper proposes a method to improve LiRA by learning the query vectors. I find the proposed method interesting, and of potential interest to the community. Paper is clearly written and is easy to understand.

My only comment is that it would be interesting to see the metrics with more stringent privacy budget (for differential privacy), example: $\varepsilon \in [10,20,\cdots,100]$, it will also add another practical dimension to the paper, proving strong DP protections against membership inference.
clarity,_quality,_novelty_and_reproducibility: paper is clearly written and is easy to understand
summary_of_the_review: I like the method proposed and view the paper having a positive impact.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper presents a novel black-box membership inference attack against machine learning moles. The proposed Canary attack optimizes the queries in MIA using adversarial attacks and achieves good attack performance. 
strength_and_weaknesses: Strengths:
1. The idea of using adversarial attacks to optimize the MIA queries is quite novel.
2. Following the recent research in MIAs, the paper uses both AUC and FPR to measure the privacy threats.
3. The Canary attack outperforms the state-of-the-art LiRA attack. 
4. The paper investigated practical attack scenarios in online and offline threat models. The effectiveness of the proposed Canary attack has been demonstrated in both threat models.
5. The paper investigates the impact of several critical hyperparameters in Canary attacks. 
6. The paper is well-written.

Weaknesses:
1. The optimization process of the query generation introduces additional computational overhead. The attack performance is also related to the number of queries. It would be great to compare the computational cost with LiRA attack. In addition, how do we select perturbation bound ϵ in practice? Does the selection require additional cost?
2. The evaluation only considers differential privacy for privacy protection. The paper could discuss the performance of Canary on other state-of-the-art defenses.
clarity,_quality,_novelty_and_reproducibility: The overall quality of this paper is good. The idea is novel. The code is provided to reproduce the paper.
summary_of_the_review: The paper presents a novel and effective membership inference attack. Using adversarial attacks in query optimization is novel. The proposed attack outperforms the state-of-the-art attack. The paper could include the computational cost and the experiments against other defenses in the paper.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This is a work about a black-box test to determine whether a certain example was in the training set. A novel "Canary" algorithm is developed  which uses adversarial queries. It is experimentally compared with baselines from prior work, specifically LiRA.

The reviewers found the idea of perturbing the target data point to boost the membership inference precision to be interesting and creative. The experiments were adequate and conveyed the main points of the result. One reviewer called for further theoretical study regarding the effectiveness of the adversarial queries. 
justification_for_why_not_higher_score: While all the reviewers felt that the experiments were adequate, nobody found the work to be a breakthrough or remarkably interesting. One reviewer wished for better theoretical motivation.
Decision: Accept: notable-top-25%