Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries
Authors: Yuxin Wen
Arpit Bansal
Hamid Kazemi
Eitan Borgnia
Micah Goldblum
Jonas Geiping
Tom Goldstein
Venue: ICLR 2023 notable top 25% (2023)

Abstract: As industrial applications are increasingly automated by machine learning models, enforcing personal data ownership and intellectual property rights requires tracing training data back to their rightful owners. Membership inference algorithms approach this problem by using statistical techniques to discern whether a target sample was included in a model's training set. However, existing methods only utilize the unaltered target sample or simple augmentations of the target to compute statistics. Such a sparse sampling of the model's behavior carries little information, leading to poor inference capabilities. In this work, we use adversarial tools to directly optimize for queries that are discriminative and diverse. Our improvements achieve significantly more accurate membership inference than existing methods, especially in offline scenarios and in the low false-positive regime which is critical in legal settings.

Published as a conference paper at ICLR 2023
CANARY IN A COALMINE: BETTER MEMBERSHIP IN- FERENCE WITH ENSEMBLED ADVERSARIAL QUERIES
Yuxin Wen
Arpit Bansal
Hamid Kazemi University of Maryland
University of Maryland ywen& edu
University of Maryland
Eitan Borgnia University of Chicago
Micah Goldblum New York University
Jonas Geiping
University of Maryland
Tom Goldstein
University of Maryland
ABSTRACT
As industrial applications increasingly automated by machine learning mod- els, enforcing personal data ownership and intellectual property rights requires tracing training data back to their rightful owners. Membership inference algo- rithms approach this problem by using statistical techniques to discern whether target sample was included in a model's training set. However, existing meth- ods only utilize the unaltered target sample or simple augmentations of the target compute statistics. Such a sparse sampling of the model's behavior carries little information, leading to poor inference capabilities. In this work, we use adversarial tools to directly optimize for queries that are discriminative and di- verse. Our improvements achieve significantly more accurate membership in- ference than existing methods, especially offline scenarios and in the low false-positive regime which is critical in legal settings. Code is available at hattps://qithun www.aauw..com/uuiiiiii.oomc http://owooooiiieeeeeeec//aaaae.
INTRODUCTION
In an increasingly data-driven world, legislators have begun developing slew of regulations with the intention of protecting data ownership. The right-to-be-forgotten written into the strict GDPR law passed by the European Union has important implications for the operation of ML-as-a--ervias (MLaaS) providers (Wilka et al.] 2017; Truong et al.] (021). As one example, Veale al. (2018) discuss that machine learning models could legally (in terms of the GDPR) fall into the category of "personal data", which equips all parties represented in the data with rights restrict processing and to object to their inclusion. However, such rights are vacuous if enforcement agencies are unable to detect when they are violated. Membership inference algorithms are designed determine whether a given data point was present in the training data of model. Though membership inference is often presented as a breach of privacy situations where belonging to a dataset is itself sensitive information (e.g. a model trained on group of people with rare disease), such methods can also be used as a legal tool against a non-compliant or malicious MLaaS provider.
Because membership inference is a difficult task, the typical setting for existing work is generous to the attacker and assumes full white-box access to model weights. the aforementioned legal scenario, this is not realistic assumption. Organizations have understandable interest in keep- ing their proprictary model weights secret and short of a legal search warrant, often only provide black-box querying their clients (OpenAl 2020). Moreover, even if regulatory agency forcibly obtained white-box access via an audit, for example, malicious provider could adversarially spoof the reported weights to cover up any violations.
In this paper. we achieve state-of-the-a performance for membership inference in the black-bo box setting by using a adversarial approach. We observe that previous work (Shokri et al. 2017

---

Published as a conference paper at ICLR 2023
Yeom et al., 2018: Salem et al. 2018 Carlini et al. 2022a) improves membership inference attacks through a variety of creative strategies, but these methods query the targeted model using only the original target data point or its augmentations. We instead learn query vectors that are maximally discriminative; they separate all models trained with the target data point from all models trained without it. We show that this strategy reliably results in more precise predictions than the baseline method for three different datasets, four different model architectures, and even models trained with differential privacy.
BACKGROUND AND RELATED WORK
Homer al. (2008) originated the idea of membership inference attacks (MIAs) by using aggregated information about SNPs to isolate a specific genome present in the underlying dataset with high probability. Such attacks on genomies data are facilitated by small sample sizes and the richness of information present in each DNA sequence, which for humans can be up to three billion base pairs. Similarly, the overparametrized regime of deep learning makes it vulnerable MIAs. Yeom et al.) (2188) designed the first attacks on deep neural networks by leveraging overfitting to the training data members exhibit statistically lower loss values than non-members.
Since their inception, improved MIAs have been developed, across different problem settings and threat models with varying levels of adversarial knowledge. Broadly speaking, MIAs can be categorized into metric-based approaches and binary classifier approaches (Hu et al.) 2021). The latter utilizes a variety of calculated statistics to ascertain membership while the former involves training shadow models and using neural network learn the correlation (Shokri et al. 2017 Truong et al. 2021 Saalm et al. 2018).
More specifically. existing metric-based approaches include: correctness Yeom et al. 2018 Choquette- et al.
2021 Bentley et al. 2020; Irolla & Châtel 2019 Sablayrolles et al.
2019),
loss (Yeom al., [0188] Saallyyolles et al. 2019), confidence (Salem et al.) 2018), and entropy
(Song & Mittal 2022 Salem et al. 2018). The ability to query such metrics at various points during
training has been shown further improve membership inference. [Liu et al. (2022) devise model
distillation approach to simulate the loss trajectories during training, and Dagielski et al. (2022b)
leverage continual updates to model parameters to get multiple trajectory points.
Despite the vast literature on MIAs, all existing methods in both categories rely solely on the data point x whose membership status in question metric-based approaches compute statistics based on xx or augmentations of x and binary classifiers take x= as an input and output membership status directly. Our work hinges on the observation that an optimized canary image Imaa can be a more effective litmus test for determining the membership of x=" Note that this terminology is separate from the use in ZZneila-Béguelin et al. (2020) and Carlini et al. (2019), where a canary refers to a sequence that serves proxy to test memorization of sensitive data in language models. It also differs from the canary-based gradient attack in Pasquini et al. (2021), where a malicious federated learning server sends adversarial weights users to infer properties about individual user data (e.g. membership inference) even with secure aggregation.
The metric used for assessing the efficacy of MIA has been the subject of some debate. A com- monly used approach is balanced altack accuracy, which is an empirically determined probability of correctly ascertaining membership. However, Carlini al. (2022a) point out that this metric is inadequate because it implicitly assigns equal weight to both classes of mistakes (i.e. false positive and false negatives) and is an average-case metric. The latter characteristic especially troubling because meaningful privacy should protect minorities and not be measured solely on effectiveness for the majority. A good alternative to address these shortcomings is to provide the receiver operating characteristic (ROC) curve. This metric reports the true positive rate (TPR) at each false positive rate (FPR) by varying the detection threshold. One way to distill the information present in the ROC curve is by computing the area under the curve (AUC) more area means higher TPR across all FPRs on average. However, more meaningful violations of privacy occur at a low FPR. Methods that optimize solely for AUC can overstress the importance of high TPR at high FPR, a regime inherently protected by plausible deniability. In our work, we report both AUC and numerical results the FPR deemed acceptable by Carlini et al. (2022a) for ease of comparison.
2

---

Published as a conference paper at ICLR 2023
There have been efforts characterize the types of models and data most vulnerable to the MIAs described above. Empirical work has shown the increased privacy risk for more overparametrized models ( Yeom et al. [2018 Carlini et al. 2022a Leino & Fredrikson 2020). which was made rigor- ous by Tan et al. (2022b) for linear regression models with Gaussian data. Tan et al. (2022a) show tradeoff can be improved by using wider networks and early stop- ping to prevent overfitting. From the data point of view, |Carlini et al. (2022c) show that data at the tails of the training distribution more vulnerable, and efforts to side-step the privacy leakage by removing tail data points just creates a new set of vulnerable data, Jagielski et al. (2022a) show data points encountered early in training are "forgotten" and thus more protected from MIAs than data encountered late in training.
the overparaaeeterization/nnnn
LETTING THE CANARY FLY
In this section, we expound upon the threat model for the type membership inference we perform. We then provide additional background on petric-based MIA through likelihood ratio tests, before describing how to optimize the canary query data point.
3.1 THREAT MODELS
Membership inference is useful tool in many real-world scenarios. For example, suppose MLLaS company trains image classifier by scraping large amounts of online images and using data from users/clients to maximize model performance. the company's model - via their membership inference of a private image during training. We assume the client also has the ability to scrape online data points, which may may not be in the training data of the target classifier. How- ever, the target model can only be accessed through an API that returns predictions and confidence scores, hiding weights and intermediate activations.
client requests that their data be unlearned from and wants to test compliance by determining
We formulate two threat models, where the trainer is the company and the attacker is the client as described above:
Online Threat Model. We assume there exists a public training algorithm T (including the model architecture) and universal dataset D. The trainer trains target model 6, on random subset D. D through T. Given a sensitive point (x", y²) E D, the attacker aims to determine whether (x", ,²) D, (x* (x*""") $ D, The target model parameters are protected, and the attacker has limited query access to the target model and its confidence So, (2) y for any (x, y).
We use the term online indicate that the attacker can modify their membership inference strat- egy as function of (x", .y). A more conservative threat model is the offline variant, where the attacker must a priori decide on fixed strategy to utilize across all sensitive data points. This is more realistic when the strategy involves training many shadow models, which is computationally expensive.
Offline Threat Model. As above, the trainer trains target model on D. C D with T. However, now we assume the attacker only has access to an auxiliary dataset Danx C D to prepare their attack. The set of sensitive data points Drest C / is defined to have the properties Daux n Drea = but D * 0. Again, the attacker has limited query access to the target model and its confidence fa ( for any (x, y).
3.2 LIKELIHOOD RATIO ATTACKS
As a baseline, we start out with the metric-based Likelihood Ratio Attakk (LiRA) introduced by Carlini et al. (2022a). In the online threat model, a LiRA attacker first trains N shadow models
S= == 10,,... ON) on randomized even splits of the dataset D. For any data point (x, v) E D. follows that there are on average N/2 OUT shadow models trained without (z. y) and N/2 IN shadow models trained with (x, y). This allows the attacker to run membership inference using a joint pool shadow models, without having to retrain models for every new trial data point.
Given target point x* and its label y", attacker calculates confidence scores of IN models
3

---

Published as a conference paper at ICLR 2023
Mone Paoarreee PCC
Hoed Paarrott
Becaaio of
(a) Augmented Queries (b) Adversarial Queries Overfitted Adv. Queries
Figure 1: Query Decision Boundary in Model Parameter Space. We illustratee our idea by plotting the decision boundaries of two queries I1 and Z2 in model parameter space. In this case. the target image indeed in the training data of (green) target model. augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.
sketch three cases. (a) Both
S. {0j ..., ) and OUT models Sout {BTHE
goant Confidence scores are scaled via fo(a") )g- o(fo(x))) log( 1 fo(
where fo(x), denotes the confidence score from the model 0 on the point (x,y). y). This scaling approximately standardizes the confidence distribution, the distribution of the unnormalized con- fidence scores is often an--aassian. After retrieving the scaled scores for IN and OUT models, the attacker fits them to two separate Gaussian distributions denoted ([ o and N (Pau, dan) respectively. Then, the attacker queries the target model with (x".y") and computes the scaled con- fidence score of the target model conf, (x))))))) )=))- Finally, the probability of (x* ,o","") being in the training data 0, is calculated as:
p(conf, | ( 2i))
(2)
p(conf, [Nout oz
where p(conf [W,,, (2)) calculates the probability of conf under ((,,
For the offline threat model, the attacker exclusively produces OUT shadow models by training on set of randomized datasets fully disjoint from the possible sensitive data. For the sensitive data point (x", y²), the final score now calculated as a one-sided hypothesis which yields:
p(conf,
( o
Though assessing membership this way is more challenging, the offline model allows the attacker to avoid having to train any new models at inference time in response to new (x* v²" pair more realistic setting the attacker is a regulatory agency responding to malpractice claims by many users, for example.
In practice, modern machine learning models are trained with data augmentations. Both the online and offline methods above be improved if the attacker generates & augmented target data points {#1...., F& ). performs the above probability test on each the & augmented samples, and averages the resulting scores.
3.3 MOTIVATION
Despite achieving state-of-the-arr results, a LiRA attacker exclusively queries the target model with the target data (x", ) or simple, predefined augmentations of Even in the online setting, (x*, yy) is not outlier that strongly influences the final IN model (Carlini et al. 2022c [lyas] et al. 2022). then its impact on the model and thus the information gained from its confidence score quite limited. Moreover, the longer model trains, the further it becomes invariant its data augmentations, so the ensemble of augmented target samples might still lack sufficient information to ascertain membership.
4

---

Published as a conference paper at ICLR 2023
Since the threat model does not bar the attacker from querying arbitrary data, we ask whether more information about the target model can be obtained by synthesizing more powerful queries. Intu- itively, we want the final synthesized query to always give statistically separable signals for models trained with/withouu the original sensitive sample. Existing work has shown two models trained with the same data point, often share similar properties the decision boundary near that point (Somepalli et al. 2022). Using the shadow models from LiRA, the attacker can therefore adversar- ially optimize a query (near the original x²)) such that the distribution of confidence scores for IN models is as different as possible from the distribution of confidence scores for OUT models. We call the synthesized query canary because is an indicator for the membership status of x²"
3.4 OPTIMIZING FOR CANARY SUCCESS
We now formally present our strategy to generate adversarial queries. For a target data point (x* y²),
its IN shadow models Sin = {0it ...., ). and its OUT shadow models Sout = 1 ...., 0% J. the attacker's goal is to find a data point 2mal such that IN models and OUT models have different behaviors (logits/confidence scores/losses). In the simplest case, the attacker can optimize mmal so that IN shadow models have high losses 2maa and OUT models to have low losses Tmal- This can be simply achieved by minimizing the following objective:
1 [(Fmall y,, ,,)) VE
argmin ET
Cour (Fmal, y), O
(3)
711
where / the feasible data point domain, is the main task loss, and Cost is - log(1 fo()))) We further evaluate the optimal choice of objective functions in Section 4.4
Though in principle an attacker construct canary query as described above, in practice the optimization problem is in- tractable. Accumulating the loss on all shadow models requires significant amount of computa- tional resources, especially for a large number of shadow models or models with many parameters. Another way to conceptualize the problem at hand, to think of Tmal the model parameters and the shadow models as training data points in traditional machine learning. When framed this way, the number of parameters in our model mmal is much greater than the number of data points |Sin| |SSoa]- For CIFAR-I0 10 the number of parameters in Fmail is 3 x 32 x 32 = 3072, but the largest number of shadow models used in the original LiRA paper merely 256. Therefore, if we follow the loss Equation
Algorithm 1 Canary Algorithm
I: Input: IN shadow models Sin 10th ...., 0m) OUT
shadow models Sout { .... 0 ). target data point (x" "y"),,) batch size b, optimization steps T,, perturbation
bound e, input domain
2: Amal =
3: for I...,,''d do
4: Shuffle the index for Sin and Sout
5: Calculate loss on OUT models:
6:
IAmmut V b E Lour(0* + Amal, 8", BTmN))
7:
Calculate loss on IN models (removed when offline):
8:
9Amat += VA
Em f(x" + Amm, v", ,(0)
9:
Update Amal based on JA
10: Project Amal onto || 0o I and (x* + Amal) E 1
11:
Tmaal = xx= + Amal
12: return Fmall
3 Tmai will overfit to shadow models and not be able to generalize to the target model.
To alleviate the computational burden and the overfitting problem, we make some modifications to the canary generation process. During optimization, we stochastically sample 6 IN shadow models from Sn and b OUT shadow models from Sour for each iteration. where b min(n,,m) m). This is equivalent to stochastic mini-batch training for batch size b, which might be able to help the query generalize better (Geiping et al. 202T). We find that such a mini-batching strategy does reduce the required computation, but it does not completely solve the overfitting problem. An attacker can casily find Zmal with a very low loss on Equation (3), and perfect separation of confidence scores from IN models and OUT models. However, querying with such canary 3mmal results in random confidence for the holdout shadow models, which indicates that the canary is also not generalizable to the unseen target model.
To solve this, instead of searching for &mal on the whole feasible data domain, we initialize the adversarial query with the target image the target image with small noise. Meanwhile,
5

---

Published as a conference paper at ICLR 2023
Table 1: Main Results on Different Datasets. For three datasets, Canary attacks are effective in both online and offline scenarios.
Online
CIFAR-IO 10
CIFAR-I00
MNIST
AUC
TPR @ 1%FPP
AUC
TPR@1%FR
AUC
TPR PPR@1%FR 1%FPR
LiRA
74.36
17.84
94.70
53.92
56.28
3.95
Canary
76.25
21.98
94.89
56.83
58.12
5.23
+1.89
+4.14
+0.19
+2.91
+1.84
+1.28
Offline
AUC
TPR@I%FPE
AUC
TPR P1RF1%
AUC
TPR @1%FPR
LiRA
55.40
9.85
79.59
42.02
50.82
2.66
Canary
61.54
12.60
82.59
44.78
54.61
3.06
+6.14
+2.75
+3.00
+2.76
+3.79
+0.40
add an E bound to the perturbation between 3mall and x². Intuitively, the hope is that Imal and now share the same loss basin, which prevents 2mal from falling into random, suboptimal local minimum of Equation (3) We summarize our complete algorithm Canary in Algorithm [ In the offline case, remove line 8 and only OUT models during the optimization. We also illustrate our reasoning in Figure [ where we visualize how the adversarially trained queries might alter the original queries' decision boundaries and provide more confident and diverse predictions.
Once a suitable canary has been generated, we follow the same metric-based evaluation strategy described in Section 3.2 but replace (a",, ,y") with (Feal y"
EXPERIMENTS
In this section, first show that the Canary attack reliably improve LiRA results under different datasets and different models for both online and offline settings. Further, we investigate the algorithm thoroughly through series of ablation studies.
4.1 EXPERIMENTAL. SETTING
We follow the setting of Carlini et al. (2022a) for our main experiment CIFAR-10 and CIFAR- 100 for full comparability. We first train wide ResNets (WRN28-10) (Zagoruyko & Komodakis 2016) with random even splits of 50000 images to reach 92% and 71% test accuracy for CIFAR- and CIFAR-100 respectively. For MNIST, we train 8-layer ResNets (He et al. 2016 with random even splits to reach 97% test accuracy. During the experiments, runs with different random seeds. For each run, we randomly select a model as the target model and remaining 64 models shadow models, and test on 5000 random samples with 10 queries.
report the average metrics over
For the hyperparameters in the Canary attack, we empirically choose E = 2 for CIFAR- 10 & CIFAR-100 and 6 for MNIST, which will ablate in Section 4.4 We sample b 2 shadow models for each iteration and optimize each query for 40 optimization steps using Adam (Kingmal & Bal 2014) with learning rate of 0.05. For L and Lour- choose to directly minimize/maximize the logits before a softmax on the target label. All experiments in this paper are conducted by one NVIDIA RTX A4000 with 16GB of GPU memory, which allows us load all shadow models and optimize 10 adversarial queries at the same time, but the experiments could be done with smaller GPU by optimizing one query at a time or reloading the subsample of models for each iteration.
4.2 EVALUATION METRICS
In this paper, we mainly report two metrics: AUC (area under the curve) score of the ROC (receiver operating characteristic) curve and @ %FPR (true positive rate when false positive rate 1%). One construct the full ROC by shifting the probability threshold of the attack to show the TPR under each FPR. The AUC measures the average power of the attack. As mentioned in an attacker might be more interested in TPR with low FPR, also specifically report @ %FPR.

---

Published as a conference paper at ICLR 2023
Table 2: Results on Different Models Architecture. Canary attacks are able consistently outperform LiRA over different models. T@1%F stands for TPR@17FPR.
Online
WRN28-10
10
ResNet-18 18
VGG
ConvMixer
AUC
TF
AUC
T@1%F
AUC
T@ T@1%F
AUC
T81%F
LiRA
74.36
17.84
76.29
17.05
75.94
20.48
75.97
16.58
Canary
76.25
21.98
76.93
19.34
77.63
20.87
76.39
17.05
A
+1.89
+4.14
+0.64
+2.29
+1.69
+0.39
+0,42
+0.47
Offline
AUC
T@1 %F
AUC
T&1%F
AUC
T&1% %F
AUC
T81%F
LiRA
55.40
9.85
55.15
6.97
49.96
9.77
54.42
7.96
Canary
61.54
12.60
64.09
11.58
65.55
15.16
62.22
9.93
A
+6.14
+2.75
+8.94
+4.61
+15.59
+5.39
+7.80
+1.97
4.3
CANARY ATTACKS HELP MEMBERSHIP INFERENCE
We show our main results in Table [ for three datasets. Canary attacks are effective in both online and offline scenarios. The improvement TPR@1%FPR is significant for all datasets. The difference is especially notable for online CIFAR-10, where we achieve a 4. 141 boost over the baseline LiRA relative improvement TPR of 23%). In the case of online CIFAR-I00 -100 where the baseline already achieves very high AUC, Canary attacks only provide extra 0.19% over the baseline. On average, Canary attacks are most powerful in the more realistic offline scenario. We gain over 3% boost AUC scores on all datasets and over 2.75% TPR01%FPE boost for CIFAR-10 and CIFAR-100.
Overall, the improvement MNIST is relatively small. We believe this can be attributed to the lack of diversity for MNIST, which is known to make membership inference more challenging. In this setting, the difference between the decision boundaries of IN models and OUT models less pronounced, so it is more difficult to make diverse and reliable queries. Despite these challenges, still improvement over LiRA in the offline case the AUC score is close random (50.82%) for LiRA here and Canary attacks can improve this to 54.61%.
In addition WRN28-10, chitectures in CIFAR- 10: ResNet- 18 (He et al. 2016), VGG-16 (Simonyan & Zisserman 2014)), and ConvMixer (Trockman & Kolter (022). In Table Canary attacks are able consistently provide enhancement over different models. The performance of Canary ry attacks should be related to the reproducibility of the model architecture. the model decision boundary is highly reproducible, the shadow models should share similar decision boundaries with the target model, and the adversarial query trained on the shadow models will be more transferable to the target model. Indeed, we see from Table that models with higher reproducibility do correlate with more improvement for the online scenario, especially between WRN28-1B 10 and ConvMixer, where WRN28-10 10 has higher re- producibility than ConvMixer (Somepalli et al. 2022). We include further experiments regarding reproducibility and Canary in Appendix A.I
further verify the ability of Canary attacks for three other models
4.4 ABLATION EXPERIMENTS
In this section, we provide ablation experiments on several crucial hyperparameters of the discussed Canary attacks.
Number of shadow models. As described before, the number of shadow models is comparable to the number of data points in traditional machine learning, We test Canary attacks with 5 different numbers of shadow models: 4, 8, 16. 32, and 64. We see from Figure 2(a) that using more shadow models yields higher true positive rate when the false positive rate is low. Interestingly, as the number of shadow models initially decreases, the overall performance drops slightly, but such an effect diminishes after the number of shadow models is greater than 24.

---

Published as a conference paper at ICLR 2023
62.0
05-
12.0
61.5
-12
ALC
111g 1S:P1
1PR00
10.5
60.0
95
59.5
TPR
of Stedow
of Adversarisl Quariis
(a) Number of Shadow Models
(b) Number of Adversarial Queries
62-
AUC 1P
12.5
60
TPRI1RUPPT
61.3
68
01.
57
61.1
10.5
2'
Batch
(c) Bound
(d) Batch Size
Figure 2: Hyperparameter Ablation Experiments. We provide ablation experiments on several crucial hyperparameters: number of shadow models, number of adversarial queries, s bound, and batch size.
Number of queries. Because of the stochasticity of optimization, different queries can fall into different minima of Equation (3), returning different sets of confidence scores and thus more ways to probe the target model. Therefore, it is essential to investigate how the number of queries affects the membership inference results. We plot the results in Figure 2(b) The ensemble of more adversarial queries consistently enhances both metrics, which means different queries indeed give different signals about the target model.
bound. The choice of is important, which is highly related to the transferability. As shown in Figure 2 the performance of Canary drops very fast after e = 2. When E = 1 the TPR 01%FT is slightly lower than when 2, which indicates that the perturbation within e = might be too small to be effective.
2( test Canary with different batch sizes. Mini-batch strategy does improve the performance of Canary attacks. Especially for "PR@1%FPT, the difference is around 2% between the batch size 2 25. Optimizing with smaller batch size prevents the adversarial query from overfitting to the shadow models. Meanwhile, it massively reduces the GPU memory required for the gradient graph, which is a win-win situation for the attacker.
Batch size. In Figure
Choice of Objectives for L and Lout- The choice the target objectives L and Lour is also crucial the generalization of Canary attacks. We test six different objectives create adversarial queries: 1) CE/reverse CE. 2) CE/CE on a random label other than the true label. 3) CW (Carlini & Waanner 2017 /reverse CW. 4) CW/CW on random label. 5) Directly minimize the scaled log score/maximize the scaled log score. 6) Directly minimize the pre-softmax logits of the true label/maximize the pre-softmax logits of the true label. We show the results in Table
During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizinggmmxiiiii
the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do. Overall, any other choices can also improve the baseline in the online scenario. However, in the offline scenario, only CW/CW and pre-softmax logits provide improvements to TPR01%FPR.
4.5 DIFFERENTIAL PRIVACY
We now challenge Canary attacks with differential privacy (Abadi et al., 2016). Differential pri- vacy is designed to prevent the leak of information about the training data. We evaluate Canary attacks in two settings. The first setting only uses norm bounding, where the norm bounding C
8

---

Published as a conference paper at ICLR 2023
Table 3: Results with Different Objectives. We evaluate Canary attacks different objectives. Directly minimizing/maximiiingg the pre-softmax logits gives the biggest improvement both the online and offline settings.
Online
Offline
AUC
TPR@1 %FPR
AUC
TPR %FPR
LiRA
74.36
17.84
55.40
9.85
CE/r. CE
75.55
19.85
56.83
9.22
CE/CE
75.55
19.89
59.23
9.77
CW/r. CW
75.37
19.97
56.57
9.26
CW/CW 75.67
20.99
59.27
11.30
Log. Logits
75.82
20.01
59.16
8.04
Logits
76.25
21.98
61.54
12.60
Table 4: Results under Differential Privacy. In both cases, the norm clipping is 5. Even when the target model is trained with differential privacy, Canary attacks reliably increase the success of membership inference.
Online
Offline
AUC
TPR @1 %FPR
AUC
TPR@1 %FPR
LiRA
66.25
9.41
56.12
3.27
8 = XX
Canary
67.17
9.93
59.73
4.41
A
+0.92
+0.52
+3.61
+1.14
LiRA
52.17
1.18
49.93
1.18
100
Canary
53.18
1.81
51.38
1.14
+1.01
+0.63
+1.45
-0.04
and = x0, and in another setting, C = and 100. In order to follow the convention of prac- tical differential privacy, we replace Batch Normalization with Group Normalization with G 16 for ResNet-18.
We see in Table that Canary attacks can provide some limited improvement. Both LiRA and Canary attacks are notably less effective when small amount of noise 100 is added during training, which is a very loose bound in practice. However, training with such a powerful defense makes the test accuracy of the target model decrease from 88% 44%. Differential privacy is still a very effective defense for membership inference attacks, but Canary ry attacks reliably increase the success chance of membership inference over LiRA.
CONCLUSION
We explore novel way enhance membership inference techniques by creating ensembles of ad- versarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model. Through series of experiments, we show that Canary attacks reliably enhance both online and offline membership inference algorithms under three different datasets, four different models, and differential privacy.
Although Canary attacks perform very well in the above experiments, there are several relevant limitations. The optimization process for constructing the ensemble of canaries is markedly more computationally expensive than using data augmentations of the target data point as in Carlini et al. (2022)). Furthermore, effective optimization routines for queries could challenging, especially when considering future applications of this approach to discrete data, like text or tabular data. In principle, we believe it should be possible devise strategy to make adversarial queries trans- ferable that do not require e-bounds, but so far have found the method detailed in Canary to be the most successful approach.

---

Published as a conference paper at ICLR 2023
ETHICS STATEMENT
Although our key goal is develop better membership inference algorithm help protect data ownership, this technique might be used by malicious party as tool for breaching the privacy of the model trainer. On one hand, we find this acceptable, due to the inherent power imbalance between agents that train models and agents that own data. On the other hand, we believe that our results do not represent a fundamental shift in the capabilities of membership inference attacks.
ACKNOWLEDGEMENTS
This work was supported by the Office of Naval Research (#N0001421 (2000)) program, DARPA GARD (HR001 2020007)) the National Science Foundation (IIS-2212182, and Capital One Bank.
12557), the AFOSR MURI
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Jason W Bentley, Daniel Gibney, Gary Hoppenworth, and Sumit Kumar Jha. Quantifying mem- bership inference vulnerability via generalization gap and other model metrics. arXiv preprint arXiv:2009.05669 2020.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). pp. 39-57. Icce, 2017.
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX Security Symposium (USENIX Security 19), pp. 267-284, 2019.
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Mem- bership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pp. 1897-1914. IEEE, 2022a.
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership Inference Attacks From First Principles. arxiv:2112.03570fcct April 2022b. doi: 10.48550//rxiv.2112..33 12.03350. UR./ttppp//arriv.orr/abb////
Nicholas Carlini, Matthew Jagielski, Nicolas Papernot, Andreas Terzis, Florian Tramer, and Chiyuan Zhang. The privacy onion effect: Memorization is relative. arXiv preprint arXiv:2206. 10469, 2022c.
Christopher Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. In International conference machine learning, pp. 1964-1974. PMLR, 2021.
Jonas Geiping, Micah Goldblum, Phillip E Pope. Michael Moeller, and Tom Goldstein. Stochastic training is not necessary for generalization. arXiv preprint arXiv:2109. 14119, 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2016.
Nils Homer, Szaboles Szelinger, Margot Redman, David Duggan, Waibhav Tembe, Jill Muehling, John V Pearson, Dietrich A Stephan, Stanley F Nelson, and David W Craig. Resolving individuals contributing trace amounts of dna to highly complex mixtures using high-density snp genotyping microarrays. PLoS genetics, 4(8):e 2008
Hongsheng Hu, Zoran Salcie, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. Member- ship inference attacks machine learning: A survey. ACM Computing Surveys (CSUR), 2021.
10

---

Published as a conference paper at ICLR 2023
Andrew Ilyas, Sung Min Park, Logan Engstrom, Guillaume Leclere, and Aleksander Madry. Data- models: Predicting Predictions from Training Data. arxiv:2202.006222/ss stat], February 2022. doi: 448555001XX1.2222200022222 URL (RLtt:://axxitee org
00622
Paul Irolla and Grégory Châtel. Demystifying the membership inference attack. In 2019 12th CMI Conference on Cybersecurity and Privacy (CMI), pp. 1-7. IEEE, 2019.
Matthew Jagielski, Om Thakkar, Florian Tramèr, Daphne Ippolito, Katherine Lee, Nicholas Carlini, Eric Wallace, Shuang Song. Abhradeep Thakurta, Nicolas Papernot, al. Measuring forgetting of memorized training examples. arXiv preprint arXiv:2207.00092 2022a.
Matthew Jagielski, Stanley Wu, Alina Oprea, Jonathan Ullman, and Roxana Geambasu. How to combine membershiipinnferncc attacks on multiple updated models. arXiv preprint arXiv:2205.063369 2022b.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint 142.6694 2014.
Klas Leino and Matt Fredrikson. Stolen memories: Leveraging model memorization for calibrated [White-Box membership inference. In 29th USENIX security symposium (USENIX Security 20), pp. 1605-1622, 2020.
Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. Membership inference attacks by exploiting loss trajectory. arXiv preprini urXiv:2208. /4933, 2022.
OpenAL. OpenAl API, June 2020. URL https: wtt.ccom/llll.. http://aii.ccoo/llll///aaaaaaapp
Dario Pasquini, Danilo Francati, and Giuseppe Ateniese. Fluding secure aggregation in federated learning via model inconsistency. arXiv preprint wxXiv2211.0033800 2021.
Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. White- box vs black-box: Bayes optimal strategies for membership inference. In International Confer- ence on Machine Learning, pp. 3558-5567. PMLR, 2019.
Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. MI-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246. 2018.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference at- tacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEEE, 2017.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint 14X.: 2014.
Gowthami Somepalli, Liam Fowl, Arpit Bansal, Ping Yeh-Chiang, Yehuda Dar, Richard Baraniuk, Micah Goldblum, and Tom Goldstein. Can neural nets learn the same model twice? investigating reproducibility and double descent from the decision boundary perspective. Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 13708,, June 2022.
Liwei Song and Prateek Mittal. Systematic evaluation of privacy risks of machine learning models. In 30th USENIX Security Symposium (USENIX Security 27), pp. 2615-2632, 2021.
Jasper Tan, Daniel LeJeune, Blake Mason, Hamid Javadi, and Richard G Baraniuk. Benign overpa- rameterization in membership inference with early stopping. arXiv preprint arXiv:2205.14055, 2022a.
Jasper Tan, Blake Mason, Hamid Javadi, and Richard G Baraniuk. Parameters or privacy: A provable tradcoff between overparameterization and membership inference. arXiv preprint arXiv:2202.01243, 2022b.
Asher Trockman and Zico Kolter. Patches are all you need? arXiv preprint 22X.022001.99792, 2022.
11

---

Published as a conference paper at ICLR 2023
Nguyen Truong, Kai Sun, Siyao Wang, Florian Guitton, and YiKe Guo. Privacy preservation in federated learning: An insightful survey from the GDPR perspective. Computers & Securiry, 110: 102402, November 2021. ISSN 0167-4048. doi: 20.
URL hetps:
//www. scl...cienti sciencei rect. com sci httpee////eteeeeee/////e/tt////e (Tt.://0000044420002222222
Michael Veale, Reuben Binns, and Lilian Edwards. Algorithms that remember: Model inversion
attacks and data protection law. Philosophical Transactions of the Royal Society Mathematical,
Physical and Engineering Sciences, 17608133))20118008, November 2018. doi: 10.1098/
2018.0083. URL httpp:://royalsocieeeypppe ishiiiigppwiiiiiigoogog org. ful 1topu11111.1111 110..
rsta. 2018 8018.00 0083
Rachel Wilka, Rachel Landy, and Scott A. McKinney. How Machines Learn: Where Do Companies
Get Data for Machine Learning and What Licenses Do They Need. Washington Journal of Law,
Technology & Arts, 13(3):117-244, 2017. URL https: /he nonl in.. org/ Hatg//OOO/PPP hein
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learn-
ing: Analyzing the connection overfitting. In 2018 IEEE 31st computer security foundations
symposium (CSF), pp. 268-282. IEEE, 2018.
Sergey Zagoruyko and Nikos Komodakis.
Wide residual networks
arXiv preprint
arXiv:1605.07146. 2016.
Santiago Zanella- Béguull,, Lukas Wutschitz, Shruti Tople, Victor Rühle, Andrew Paverd, Olga Ohrimenko, Boris Köpf, and Marc Brockschmidt. Analyzing information leakage of updates to natural language models. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 363-375, 2020.
12

---

Published as a conference paper at ICLR 2023
22
76
AUC
TPR@ 1%FPT
75
20
(PR@1%FF)
74
18
AUC
73
16
72
14
71
12
4
6
10
Model Width
Figure 3: Results with Different Widths of WRN28.. We find that with increasing width of the WideResNet, attack success increases reliably. This potentially related to an increase in repeata- bility of the decision boundaries of these models.
75
AUC
20
TPR@ 1%FPT
70
15
(PR@1%FPM
AUC
65
10
60
55
10
50
100
No DP
Privacy Budget
Figure 4: More Results under Differential Privacy. In all cases except No DP, the norm clipping Privacy Budget here refers to (e, le 1e-5)-DP, except for the last entry, which sets budget and does not clip.
A APPENDIX
A.I ABLATION STUDY: MODEL WIDTH
Appendix A.I shows the results different model widths for WRN28. As claimed in Somepalli et al. (2022), wider networks have higher reproducibility. The performance of Canary correlates with the reproducibility (width) of the model.
A.2 ABLATION STUDY: PRIVACY BUDGET
In Appendix A.2 we provide more results with more strict privacy budgets. When the e of differ- ential privacy is 10. the AUC of the attack is very close to 50% which is the random guess, and the IPR01%FPR is almost zero. Differential privacy still a very strong defense against membership inference.
13

---

Published as a conference paper at ICLR 2023
12
Canary Loss
12
10
TPR@ 1%FPT
11
Canary Loss
TPR@ 1%FPT
10
6
2
7
0
2
3
4
5
6
7
8
& Bound
Figure 5: Canary Loss (i.e. the objective evaluated the shadow models used optimize the canary attack) plotted against Performance (evaluated on the unseen test model) for various values of e. When E too large, then the attack overfits and does not generalize to the unseen test model that is attacked during membership inference.
Table 5: Comparison with Random Noise Perturbations. A random noise perturbation in the same e-hall as the canary does not increase membership success. this sense, the optimized behav- ior of the canary attack is crucial.
AUC
TPR @RR11%PPR
LiRA
74.36
17.84
Random Noise
74.30
17.87
Canary
76.25
21.98
A.3 CANARY LOSS V.S. PERFORMANCE
As shown in Appendix A.3 if we increase the Canary objective monotonically decreases, evalu- ated on the "training" shadow models, but attack success peaks and then decreases.
A.4 CANARY V.S. RANDOM NOISE
We test adding random noise within the same ball on the original target image, as shown in Table The attacker doesn't 't benefit from adding random perturbations.
A.5
COMPUTATIONAL COST
Table shows the average attack time in seconds on one single NVIDIA RTX A4000 over 5000 target images with total of 64 shadow models.
Table 6: Computational Cost in Seconds. for generation of the attack and query into the model. Not included for both methods is the computational cost to create the array of shadow models.
Query
Queries
5 Queries
10 Queries
LiRA
0.26
0.27
0.36
0.63
Canary
1.03
1.04
1.44
2.44
14


Reviews:
[{"review_id": "zdHA_rn2PoW", "reviewer": "Reviewer_4F4t", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "Paper proposes a membership inference method based on learning query vectors, and shows that it improves the current state-of-the-art methods. ", "summary_of_the_review": "I like the method proposed and view the paper having a positive impact.", "strength_and_weaknesses": "Membership inference attacks are of great interest to the privacy and security community, and the paper proposes a method to improve LiRA by learning the query vectors. I find the proposed method interesting, and of potential interest to the community. Paper is clearly written and is easy to understand.\n\nMy only comment is that it would be interesting to see the metrics with more stringent privacy budget (for differential privacy), example: $\\varepsilon \\in [10,20,\\cdots,100]$, it will also add another practical dimension to the paper, proving strong DP protections against membership inference.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "zFQd0OzKWK", "reviewer": "Reviewer_7EZU", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper presents a novel black-box membership inference attack against machine learning moles. The proposed Canary attack optimizes the queries in MIA using adversarial attacks and achieves good attack performance. ", "summary_of_the_review": "The paper presents a novel and effective membership inference attack. Using adversarial attacks in query optimization is novel. The proposed attack outperforms the state-of-the-art attack. The paper could include the computational cost and the experiments against other defenses in the paper.", "strength_and_weaknesses": "Strengths:\n1. The idea of using adversarial attacks to optimize the MIA queries is quite novel.\n2. Following the recent research in MIAs, the paper uses both AUC and FPR to measure the privacy threats.\n3. The Canary attack outperforms the state-of-the-art LiRA attack. \n4. The paper investigated practical attack scenarios in online and offline threat models. The effectiveness of the proposed Canary attack has been demonstrated in both threat models.\n5. The paper investigates the impact of several critical hyperparameters in Canary attacks. \n6. The paper is well-written.\n\nWeaknesses:\n1. The optimization process of the query generation introduces additional computational overhead. The attack performance is also related to the number of queries. It would be great to compare the computational cost with LiRA attack. In addition, how do we select perturbation bound ϵ in practice? Does the selection require additional cost?\n2. The evaluation only considers differential privacy for privacy protection. The paper could discuss the performance of Canary on other state-of-the-art defenses.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "gq4Cap_-3F", "reviewer": "Reviewer_3Ke9", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this work, an adversarial query method is proposed to boost the likelihood test-driven membership inference attack (LiRA). Instead of using the target data point as a query directly, the adversary first estimates a variant of the target data point by slightly perturbing the original target data point and minimising the fitting loss of the in-class hypothesis and out-class shadow models. The attacker then uses the estimated variant as an adversary query to infer the membership of the target data point. Experimental study shows that using the adversarial query can indeed improve the attack performances of LiRA in the low FPR regime over different datasets. ", "summary_of_the_review": "I like the idea of injecting additional perturbation to boost the data privacy leak-driven attack. It offers an alternative way to differentiate the membership class given a target data, other than compare the membership likelihood scores as in LiRA. However, the major bottleneck of this work is the lack of explanation and discussions regarding the experimental observations. As pointed out in the weakness, there is apparently a trade-off existing in the choice of epsilon. This is also related to the theoretical justification of the rationality of Eq.3. Without these discussions, it is difficult to understand why and when the proposed method can improve the inference performances. ", "strength_and_weaknesses": "Strong point: \n\nPerturbing the target data point to boost the membership inference precision is a novel and interesting idea. The core idea behind is to make use of the perturbed variant of the target data point to facilitate the attack. Even though the loss of the target data point may hardly vary if the target data point is considered to be an in- or out-class sample, the perturbed variants within the epsilon-neighbourhood of the target data point can potentially unveil more information to identify the membership. \n\nWeakness: \n1. In Table.2, the AUC and the TPR values (given the FPR level) of membership inference attack do not provide a monotonic decreasing as the reproductivity of the target model decreases (as claimed in the paper, the target models in Table.2 are given in a descending order of the model reproductivity.) \n\n2. On page 8, why does the attack performance become worse if the bound epsilon becomes larger or smaller than 2? Any explanation to the observation?  Is there any potential trade-off related to the choice of epsilon ? \n\n3. More theoretical study regarding the effectiveness of the adversarial query could further consolidate this work. The adversarial perturbation added to the target data point may help show the loss distribution within the epsilon-neighborhood of the target data point. Though the loss on the target data point may not be rich enough for a successful membership inference attack, the difference of the loss distribution may provide a better lens to differentiate two different membership classes. For the moment, the reasonability behind Eq.3 is still not very clear. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: notable-top-25%