You Only Query Once: An Efficient Label-Only Membership Inference Attack
Authors: YUTONG WU
Han Qiu
Shangwei Guo
Jiwei Li
Tianwei Zhang
Venue: ICLR 2024 poster (2024)
Keywords: Machine learning
Membership Inference Attack
Computer Vision
Primary area: societal considerations including fairness, safety, privacy
TL;DR: A novel label-only MIA that reduce the query budget.

Abstract: As one of the privacy threats to machine learning models, the membership inference attack (MIA) tries to infer whether a given sample is in the original training set of a victim model by analyzing its outputs. Recent studies only use the predicted hard labels to achieve impressive membership inference accuracy. However, such label-only MIA approach requires very high query budgets to evaluate the distance of the target sample from the victim model's decision boundary.  
   We propose YOQO, a novel label-only attack to overcome the above limitation.YOQO aims at identifying a special area (called improvement area) around the target sample and crafting a query sample, whose hard label from the victim model can reliably reflect the target sample's membership. YOQO can successfully reduce the query budget from more than 1,000 times to only ONCE. Experiments demonstrate that YOQO is not only as effective as SOTA attack methods, but also performs comparably or even more robustly against many sophisticated defenses.

Published as a conference paper at ICLR 2024
YOU ONLY QUERY ONCE: AN EFFICIENT LABEL- ONLY MEMBERSHIP INFERENCE ATTACK
Yutong Wu', Han Qiu²; Shangwei Guo Jiwei Li Tianwei Zhang' Nanyang Technological University, "Tsinghua University, 'Chongqing University, *Zhejiang University, 'Shannon Ai
yuteng0020e.. ntu. edu...du.... sg, qiuhantt edu. awguolcqu.c www.eecuuuecc.omm en jiwei com, tianwel. changentu.edu.
ABSTRACT
As one of the most severe privacy threats machine learning models, the member- ship inference attack (MIA) tries to infer whether given sample is in the original training set of a victim model by analyzing its outputs. Recent studies only use the predicted hard labels to achieve impressive membership inference accuracy. How- ever, such label-only MIA approach requires very high query budgets to evaluate the distance of the target sample from the victim model's decision boundary. We propose YOQO, a novel label-only attack to overcome the above limitation. YOQO aims identifying special area (called improvement area) around the target sample and crafting a query sample, whose hard label from the victim model can reliably reflect the target sample's membership. YOQO can successfully reduce the query budget from more than 1,000 to only ONCE. Experiments demonstrate that YOQO is not only as effective as SOTA attack methods, but also performs comparably or even more robustly against many sophisticated defenses. Our code is available https: htt///gittthttt cwm/ WD YU- TONG/YO20.
INTRODUCTION
Recent years have witnessed the widespread applications of machine learning our daily life. Train- ing a high-quality model requires massive data, which may contain sensitive information. Prior stud- ies (Choquette-Choo et al., 2021; Li & Zhang, 2021; Long et al., 2018; Salem et al., 2018: Shokri et al., 2017) have proven that machine learning models capable of memorizing most of the train- ing data, leading to the possibility of membership inference attacks (MIAs), where an adversary can infer whether target data point is in the training set of the victim mode not.
Most of the existing works (Carlini et al., 2022: Liu et al., 2022; Long et al., 2018; Salem et al., 2018; Shokri al., 2017; Yuan & Zhang, 2022) exploit loss functions or predic- tion scores to conduct MIAs. The adversary feeds the target sample to the victim model and obtains the outputs in the form of posteriors, which are subsequently processed by binary classifier to make membership decisions. Therefore, one effective defense against these attacks
simply mask the posteriors (Jia et al., 2019) or only return hard labels.
To break these defenses, researchers further proposed the label-only MIA (e.g., boundary attack (Choquette- Chho et al., 2021; Li & Zhang, 2021)), which requires only hard labels to infer the membership of the target sam- ple. This attack estimates the distance between the target sample and its nearest decision boundaries by querying the victim model iteratively, and then decides the mem- bership by categorizing samples with longer distances as members and shorter distances brought MIAs to a much more practical scenario, as many Machine Learning as a Service (MLaaS) platforms only return hard labels to users (Foundation, 2021).
Top-Is
800
Top Banign Sampl:
Frequercy
600
400
200
3..8885 58.08888888888 Prediction Scores
non-members. It has
Figure 1: Distributions of top-1 scores of benign queries and malicious queries.
"Corresponding Author

---

Published as a conference paper at ICLR 2024
However, the boundary attack requires a high query budget, usually more than x queries to check each sample (Choquette- Choo et al., 2021; Li & Zhang, 2021). This leads to the following limitations. (1) The attack is rather costly given that MLaaS normally charges users based on the number of queries. (2) It is easier to detect this attack, due to the large number of anomalous queries. Fig. 1 compares the distribution of the top-1 scores for victim model under the boundary attack and benign environment. Their distinct difference indicates that iterative queries put the boundary attack in jeopardy of being detected and disturbed by statistissbbssl defenses like PRADA (Juuti et al., 2019). (3) As the boundary attack requires accurate distance estimation, Rajabi et al. (2022) proposed a defense called LDL against it. LDL creates hyper-sphere around the samples in which the decisions of the victim model will not alter. It successfully enervates the boundary attack as the gap attack (Yeom et al., 2018), which has much lower inference accuracy.
To overcome the above limitations of the houndary attack (Choquette-Ci) Choo et al., 2021; Li & Zhang, 2021), we propose YOQO ("You Only Query Once"), a novel label-only MIA that only requires to query the victim model once to identify the membership of each target sample. The key insight of YOQO lies in the concept of the improvement area, which can precisely reflect the contribution of the target sample to the victim model's performance. Any sample inside the improvement area can be used as the query sample to disclose the target sample's 's membership. Based on this insight, we further propose two approaches (online and offiin attacks), which can generate such sample with different efficiency and accuracy trade-offs.
We perform extensive experiments over different datasets (CIFARIO, GTSRB, Location, Texas), and compare YOQO with different label-only MIAs. Evaluations indicate that YOQO can achieve comparable inference accuracy to state-of-the-art attacks, with a much smaller query budget (once). We also show that YOQO is more robust against various defense solutions to existing attacks.
2
PRELIMINARY
2.1
MEMBERSHIP INFERENCE ATTACK
MIA (Shokri et al., 2017) has drawn great attention since it reflects the memorization ability of machine learning models over their sensitive training data. The adversary tries to infer if a target sample belongs to the training set D of victim model fo. He solves this binary classification prob- lem by building an algorithm A for an arbitrary sample x: A(fD. = I(x E D)), where I(X) is the indicator function that equals 1 if X is true and 0 otherwise. There are two main categories of MIA approaches based on the adversary's 's knowledge.
Posterior-based MIA. Numerous works (Carlini al., 2022; Hayes al., 2017; Hu & Pang, 2023;
Liu et al., 2022: Sablayrolles et al.. 2019; Salem et al., 2018: Shokri et al., 2017; Song et al., 2019; Yeom et al., 2018; Yuan & Zhang, 2022; Wen et al., 2022) exploit posteriors (e.g.. prediction scores or output logits) to infer the membership of the target sample. There are two strategies to build the algorithm A. The first strategy to implement baNed binary classifier (Hayes et al., 2017; Liu et al., 2022; Shokri et al., 2017; Yuan & Zhang, 2022). The adversary first prepares set of shadow datasets D., which follow the same distribution as the victim model's training set D. Some of the shadow datasets contain the target sample while others do not. Then he trains a surrogate model fa on each shadow dataset. Based on these surrogate models, he can construct a membership dataset: Dmnm {(f (w), [[w ). The adversary then trains binary classifier g on Dmem- In the attack phase, he queries the victim model with x and retrieves the outputs, which are then fed to g infer the membership: A(fp, xr) f(f((z)).
The second strategy relies on statistic-based approaches to learn a threshold 7 to divide the mani- fold into two classes (Carlini et al., 2022: Hu & Pang, 2023; Sablayrolles al., 2019; Salem al., 2018; Song et al., 2019; Yeom et al., 2018). Specifically, the adversary also trains surrogate models on the subsets of a shadow dataset. He then uses the training loss or some specially designed loss functions F to gain score for each output given by fD. The threshold 7 is subsequently learned by studying the correlation between the memberships and the scores. Thereby, for these works: A(fr, = I(F(Sn(z)) > r). To get the posterior from the victim model, most works directly use the original target samples, while some works like (Wen et al. (2022)) proposed to query the target model with adversarial examples to further enlarge the variance in the logits between the IN and OUT models to achieve better performance. In this paper, we share the similar thoughts to craft a label-level membership-senieee sensssiiieeeeeeiveeeeeeeeee query sample.
Label-only MIA. The above attacks require the adversary to have the posteriors of the query sam- ple, which is not possible in some MaaaS platforms (Foundation, 2021). To address this issue,
2

---

Published as a conference paper at ICLR 2024
researchers proposed label-only attacks, where the adversary only needs the prediction labels.
There are mainly three state-of tftte-of-the-art label-only attacks. (1) Gap attack (Yeom et al., 2018) lever- ages the overfitting phenomenon to infer the membership. The adversary simply takes samples that are misclassified by the victim model as non-members and the rest as members. (2) Boundary attack al., 2021; Li & Zhang. 2021) follows the intuition that non-member samples closer to the decision boundary of the victim model. The adversary generates an ad adversarial example from the target sample using decision-bases adversarial attack algorithms like (Chen et al., 2020; Li et al., 2020; Bai et al., 2020), and calculates the distance between them, which will be used as the estimation of the distance between the target sample and its nearest decision boundary. He then trains a bunch of surrogate models and casts the attack on them to learn a threshold 7 to distinguish member and non-member samples. (3) Data uugmentation attuck (Choquette-Chil
Sthoquette-Choo
et al., 2021) exploits the observation that machine learning models are likely to overfit augmented samples. The adversary first creates additional data points from the target sample z with different augmentation strategies. Then he feeds all these samples to a shadow model à following the target model's 's archi- tecture and training data distribution. He compares the returned labels (lo....,.,,) with the ground truth Itrnes and uses the comparison results b, = [[(rre = (44) as features to train the algorithm A for membership inference. This approach requires the strong assumption that the adversary knows the augmentation strategies for training the victim model, which may not be practical in reality.
2.2 DEFENSES AGAINST MIAS
Multiple solutions are proposed to mitigate MIAs, which can be summarized into four categories. Fine-tuning the model. In Adversarial Regularization (ADV) (Nasr et al., 2018), the defender first trains an attack model to infer the membership. Then he fine-tunes the target model by minimiz- ing the loss on the training set while maximizing the classification loss of the attack model. PPB (Yuan & Zhang, 2022) tries to narrow the prediction gaps between members and non-members to make them indistinguishable. It fine-tunes the target model by minimizing both the KL divergence between the ranked output posterior and classification loss on the training set.
Perturbing the inputs. LDL (Rajabi al., 2022) constructs hyper-sphere around the target sam- ple by adding noise nı ~ (O, o) to make the decisions of the model unchanged for all samples in the sphere. Samples inside the hyper-sphere are fed into the victim model, and all the outputs are merged by average to get the final prediction.
Modifying the posteriors. MemGuard (Jia et al., 2019) injects adversarial perturbations to the confidence to mislead the adversary's 's membership classifier. One-hot encoding (Yang et al., 2020) encodes the prediction confidence into a one-hot code, making it almost impossible to achieve MIAs just based on the posteriors.
Differential privacy (Abadi et al., 2016; Zou et al., 2020). DP-SGD is proven to be effective in pre- venting privacy leakage (Rahimian et al., 2021; Truex et al., 2019; Zou et al., 2020). It modifies the gradient in the training process by clipping and then adding Gaussian noise to it. As the noise follows the distribution (0 o), the standard deviation 5 should be in the order of Q(q B[gyTlog (1/5)/c..
3 METHODOLOGY
Threat Model. We follow the same threat model from (Choquette- Choo et al., 2021: Li & Zhang, 2021). Specifically, we consider a victim model fo trained from a training set DD It accepts query data from users and only returns the corresponding hard labels. This is practical setting in many MLaaS platforms (Foundation, 2021). An adversary tries to perform the MIA over fo: for an arbitrary sample x, he wants to check whether it belongs to the training set D. The adversary has clue about the tasks of the victim model. We further assume the adversary can collect data samples that follow similar distribution the training samples of the victim model. He is also capable of training shadow models by himself. However, he does not have the knowledge of either the network architecture or parameters of the victim model.
3.1 KEY INSIGHT
To reduce the attack cost and risk of being detected, we further restrict the attack budget to querying Io once. Therefore, instead of directly sending the target sample to fD. we aim to craft new query data z' from 2, which can better reflect the membership of æ. Assuming the ground-truth label of z is then x' should satisfy the following two properties:
Specificity: for any model fout whose training set does not include x (dubbed out out-model), predicts different label for x' from l.
3

---

Published as a conference paper at ICLR 2024
Sensitivity: for any model fin whose training set includes (dubbed in-model), it predicts the same label for z'.
With such properties, we can tell the membership of x based on the returned label of x'. To identify x', we introduce the concept of improvement area, which is the set of all qualified query samples x². This is based the phenomenon that the performance of a machine learning model on certain classes in- added the training set (Salem et al., 2018; Liu et al., 2022). Basically, each newly added sam- ple provide special features for the model to learn, which will change the model's decision boundary. Fig. 2 visualizes this process. new sample (blue rhombus) added the train- ing set can drive the boundary farther from it locally. resulting green zone, which is the improvement area. All the data points within the improvement area are originally assigned to the orange class and switched to the blue class due to the new sample. Therefore, the adversary's s goal is to discover data point from this area to query the remote model for membership inference.
creases when new samples
Troin comple
New Scundrry
O dhountayy
Inproverroni
Attack
Figure 2: Illustration of improve-
ment and query samples.
Although samples in the improvement area can effectively disclose the membership of the target sample x, is non-trive con-trivial to identify such area. When only is added the training set, its influence on the prediction accuracy is minor, leading to very small improvement area. Below propose two approaches to generate query samples.
3.2 ONLINE ATTACK
The adversary first prepares N training sets, denoted as D Dont for i [1, These datasets composed of data samples whose membership is not interesting to the adversary. He then trains N out-models from these training sets: foue- These out-models can be consistently used to check the membership status of all other samples.
For target sample z with the ground-truth label I, to generate the corresponding query sample x' that satisfies the specificity property, the adversary needs to enforce * (x') for E NJ. This can be realized with the following optimization objective, where CE stands for the cross entropy:
x' arg max
CE(ffm((a)..)
To meet the sensitivity property for x', the adversary needs to construct N training sets Di Di U {ar, and trains the corresponding in-models fi. Then he expects x' to be classified as the ground-truth label which is converted to the following objective:
x' arg min CE((),))
Based the requirements, we formulate the following loss function for optimizing a':
N
()
Lin
x' = arg min
arg min Σ CE
(a)
(3)
However, since scalars in both f (a) and fine (a) are in [0, 1]. the optimization process lopsided towards the specificity term (Eq. 1) regardless of the sensitivity property (Eq. 2). To address this issue, we can covert Eq. I to a minimization problem. Specifically, we choose K. which is the predicted label of (ona( (x) with the highest confidence score other than the ground-truth label l: NJ. We
V = arg max, f (x) s.t. a + I. Then we aim to achieve !/ = f for choose the label 7' because the generated z' will be closer to Since the decision boundary closer to x is more probable to be changed by the addition of x, it is also easier to find qualified query samples whose labels predicted by the out-model for is I'. The optimization objective is
4

---

Published as a conference paper at ICLR 2024
N
N (a) + + (E((
x' arg
argmin min (a Σ 1=1
(4)
where is hyper-parameter to balance the two terms. Algorithm 1 describes the details of our online attack. In our implementation, we use stochastic gradient descent to generate x'.
Algorithm 1: Online attack
input target sample and corresponding ground-truth label 4, victim model f. N out-dataset
Do and corresponding out-models Sout
output: membership of
for == to N do
D in < out U {x
Jin + TRAINWIT((DL
D: Shadow training
14 arg max: fou (2) s.t. 4
end
Generate x' by optimizing Eq. 4 <-
> Querying victim model
if = then
return 'Member'
10 else
return 'Non-member' 12 end
11
3.3 OFFLINE ATTACK
In our online attack, the N out-datasets Di Dutt and out-models four be reused for any data sample not in these datasets. However, for each target sample x, the adversary has to generate the corre- sponding in-datasets D and in-models fin which costly for training models. To address the efficiency issue, we propose an offline attack which only requires the out-datasets and out-models infer the membership. This inspired by (Elliott al., 2021) which generates counterfactual explanation for sample
We still use the out-models to enforce the specificity property. For sensitivity, instead of using the in-models, we adopt a simple normalization term to restrict the distance between and x'. Then the generated z' has a higher chance to be assigned with the same label as x by any in-model. The final optimization goal is as follows:
N Σ CE(fer + +T)
arg min
(5)
where MSE(.,) stands for mean square error, and y is hyper-parameter to balance the two terms. The adversary only needs to remove the operations in Lines and 3 Algorithm (which are costly), and replace Eq. with Eq. 5 in Line to conduct the efficient offline attack.
EVALUATION
We evaluate our online and offline attacks under various settings to prove their effectiveness and efficiency. We compare our attacks with SOTA MIAs show our superiority. Datasets. YOQO is general to different tasks. Without loss of generality, we follow (Choquette-Choo al., 2021: Carlini et al., 2022: Li & Zhang, 2021) test YOOO on several classical visual tasks such as CIFAR-10, CIFAR-100 (Krizhevsky et al., 2009), GTSRB, SVHN (Netzer et al., 2011) and Tmne-ImageNet. We also test YOQO on two tabular datasets: Location (Yang et al., 2015) and Texas. Model architectures. Following prior works (Carlini et al., 2022; Choquette-Choo et al., 2021; Li Zhang, 2021), we use CNN7, ResNet18, ResNet34, DenseNet121, Inceptionv3 and VGGI6 for image datasets. For tabular datasets, we follow (Yuan & Zhang, 2022) to use fully connected network consisting of two hidden layers, with the size of 256 and 128, respectively.
Baseline attacks. We consider three label-only MIAs discussed in Section 2.1: gap attack (Yeom et al., 2018), boundary attack (Choquette-Co Choo et al., 2021: Li & Zhang, 2021), and data augmen- tation attack CChqquete-Chooe al., 2021). We follow the settings in CChouuete-Choo al., 2021)
5

---

Published as a conference paper at ICLR 2024
to implement the gap attack and data augmentation attack. For the later, translation strategies to craft the augmented queries. For the boundary attack, we train 16 pairs of shadow models to select the best thresholds models, we randomly split the dataset to be inferred into two halves, and blend one of them with the training set before we train the shadow models. Then conduct the boundary attack on these models, and determine the best threshold that can achieve the best performance.
the rotation and
to conduct fair comparison. To craft the shadow
Table shows the query budgets of the three label-only at- tacks and YOQO. We can see YOQO is much more efficient than the boundary attack. The data augmentation attack re- quires more information about the victim, which is not prac- tical and beyond the scope of our threat model. The gap attack also just needs query, but the inference accuracy is much lower than YOQO (see Section 4.1).
Attack
Queries
Boundary attack Data augmentation attack Gap attack
20,000+
10+
YOOO
Table Query budget comparisons between different label-only MIAs.
MIA Defenses. Five state-of-the-art defense strategies are implemented to test the robustness of our attacks: ADV, PPB, DP-SGD, LDL, and MemGuard (Section 2.2). For ADV and PPB, we pre-train the victim model to have up to 64.3% accuracy on the validation set and then fine-tune the model for 50 epochs. For LDL, we set the sample times for each query as 200. We set all the hyper-parametee in these defenses following (Yuan & Zhang, 2022).
Implementations. We train all the networks until they achieve more than 98% accuracy on the training set. We use Adam as the optimizer with all the hyper-parameters default in its PyTorch implementation. To conduct the online attack, we train 16 in-out model pairs and set a = 2. For the offline attack, we only use 16 out-models with y 5. The gradient descent algorithm is used to optimize v'. For the two attacks, we set the stop threshold to 4 and 8, and the maximum number of iterations 30 and 35 respectively.
Metries. We use the membership inference accu- racy our metric evaluate the performance of all referred MIAs. It equals the accuracy of the bi- nary classification task that tells non non-meebers from members. We also use Precision and Recall for more detailed investigations. We use 500 data points for all the evaluations, in which 250 samples are mem- bers and the other 250 are non-members The result is mainly the average accuracy of five repeated ex- periments.
Inference Accuracy (95)
Offire
Deta Augmortat Bn Ale
2000
4000
6000
8000
10000
Dataset Size
Figure 3: Membership inference accuracy of label-only MIAS on CIFAR-10.
Note that we do not the metric proposed in (Car- lini et al., 2022), which measures the true postive rate (TPR) of MIAs at low false positive rate (FPR). Unlike other MIAS whose TPR and FPR can be easily controlled by choosing the threshold, YOQO only has one hard label as the output and cannot adjust TPR/FPR, making this metric inapplicable.
4.1 ATTACK EFFECTIVENESS
Comparisons with prior attacks. Fig. 3 shows the membership inference accuracy of different attacks on CIFAR-10. We use CNN7 as both shadow and victim models and change the size of their training achieves almost the same inference accuracy as the boundary attack, while the latter requires over 20,000 queries per sample. Despite the offline attack being less powerful, it still surpasses the gap attack by approximately 10% in terms of inference accuracy. Our two attacks can also beat the data augmentation attack. We also notice that the inference accuracy of all the attacks dwindles when the size of victim model's training set increases. This is because the model trained bigger training set tends to be less overfitting, and has less membership privacy leakage.
see its impact on the attack performance. We observe that our online attack
Impact of model architectures. We test the performance of YOQO on different architectures for the shadow model and victim model, and the results are in Fig. 4. All the victim models are trained on subsets consisting of 2,500 training data from 100 Here "Assembly" means use the models of all the tested architectures, including CNN7, VGG18, ResNet18, DenseNet121, Inceptionv3, and SeResNet18. 8, form model ensemble for the generation of the query sample w'. We train four

---

Published as a conference paper at ICLR 2024
in-out pairs for each architecture, leading to total of 40 models in the ensemble (20 in- in-models and 20 out-models). Intuitively, the membership inference accuracy should be the highest when the shadow model is of the same structure the victim one. However, different model architectures is diverse, their overfitring degree on the datasets varies. This gives the counter-intuitive results in Fig. 4: the inference accuracy of some architectures is constantly higher than others. For example, the inference accuracy of SeResNet18 is higher than other models in most cases, while the accuracy of DenseNet121 is always the lowest. Table further compares the inference accuracy of YOQO with the gap attack and boundary attack (lu, 41 12, loo stand for different norms to represent the distance). The training set of the victim model contains 2,500 training samples and the shadow models are trained on the shadow training set of the same size. The results show that our attacks tend to have stably higher attack accuracy than the other two attacks.
the performance of
Vorta
2
CMITT
Assembly
Vidl6
CNR7
Rochects
Asserby
(a) YODO Online
(b) YOOO Offline
Figure 4: Membership inference accuracy of YOQO on CIFAR-10 10 against different victim models.
Vietim Model
CNN7
VGG16
DenseNet121 ResNet18
SeResNet18 Inceptionv3
Gap Attack
67.85
62.7
72.71
66.50
60.15
72.2
Boundary (o)
69.56
73.06
74.25
68.13
71.65
73.06
Boundary (4))
81.25
63.81
83.38
68.14
60.75
74.37
Boundary (12)
81.38
63.82
83.88
68.19
61.06
76.50
Boundary (lx.)
81.50
67.44
83.88
73.19
68.12
86,00
Yogo Online
81.65
76.20
78.50
75.00
77.56
81.87
YOQO Offline
79.19
76.69
79.31
73.75
75.06
81.68
Table 2: Membership inference accuracy of MIAs with various model structures. The experiment is conducted on CNN7 models with the CIFAR-10 dataset of 2,500 samples.
Attack effectiveness on various tasks. We examine the adaptability of our attacks to different tasks and datasets. Table 3 shows the results. Generally, our attacks more effective than the gap attack on all the investigated tasks. However, YOQO performs relatively poorer on tabular data than image ones. We hypothesize it is because the tabular data are of much lower dimensions than the images. While YOQO is able to generate more fine-grained membership query data on visual tasks, the tabular data may have more restrictions is that the model architectures may also have an impact on privacy leakage, making our methods less suitable for full-connected neural networks.
it, leading to worse results. Another possible reason
Task Name
CITARIO
CIFARTOO
GTSRB CNN7
SVIN
Tiny ImageNe ResNe134
Tiny ImageNet ResNeL54
Location ColumuPC
Purchusel (00)
Model Arch
CNN7
CNN7
CNN7
ColumaFC
Size Training Set
2,500
9,00
1,000
3,500
75,000
75,000
1,000
6,000
Boundary Atlack
81,38
87.59
59.90
71.33
73.21
81,03
82.27
74.17
Gap Attack
67.85
79.75
54.12
63.09
65.20
75.70
70.94
63.89
YOOO Online
81.65
86.10
67.16
73.94
73.15
80.94
77.50
68.28
YOgO Offinne
79.19
84.75
67.15
71.75
70.47
77.65
83.25
70.00
Table 3: Membership inference accuracy of MIAs on various tasks. *** means the models are pre- trained on ImageNet.
From the above experiments, conclude that YOQO is effective boundary attack and much better than data augmentation attack on models with different overfitting levels. It only requires to query once and does need extra information about victim's 's training details. YOGO is also adaptive to different tasks and network architectures for both the victim and shadow models.
Conclusion.
4.2 ABLATION STUDY
We perform ablation studies to disclose the influence of different factors. We use CIFARIO for all the evaluations and train CNN7 as shadow models to generate membership query samples. The size of the training datasets is 2,500 by default.
7

---

Published as a conference paper at ICLR 2024
Size of the shadow training sets. Fig. 5 shows the attack results with different sizes of the victim model's 's training set (z-axis) and shadow training set (y-axis). Intuitively, we expect to find the best performance the diagonal, as the adversary has more information about the victim model. For the online attack (Fig. 5(a)), the results are aligned with this intuition when the victim models are trained on datasets of 1 1,500, 5,000, and 10,000 samples. Yet the facts contradict when it comes to 2,500, 3,500, and 7,500 samples. This shows the size of the shadow training set has little impact on the online attack performance. For the offline attack (Fig. 5(b)), generally the left bottom corner has higher accuracy than the right top, revealing that the offline attack performs better when the shadow models are trained on bigger shadow sets. This is because the adversary can only generate the query sample x' according to the gradient of the out-models, which cannot guarantee the sensitivity requirement. When the training set is smaller, it likely to be more unbalanced, resulting a more inaccurate direction for the adversary to optimize x', so the attack performance is degraded.
of Shaste Wotess wat.se/iissssiiiiii Taihig Stt
15:0
25.6
85.2
22.2
78.5
77.7
76.8
SIS Shaedow Modde Paising S44
1500
75.
17.5
25.6
71.
60.3
68.5
84
03.0
63
00.4
76.0
03.6
28.7
3500
03.2
6266
61.2
78.0
79.2
77.0
2500
60.
00.0
23.0
74.7
72.7
71.2
62.3
1500
01.5
80.9
02.0
27.6
78.0
76.5
1500
607
00.2
00.3
76.5
74.
49.3
82.5
80.0
77.0
1500
2500
3500
5000
7500 10000
1500
2500
3500
5:00
7500 10000
Thrget Models Traiting Set
ofrarget Midels Tgainin
(a) YOOO Online
(b) YOOD Offline
Figure 5: Membership inference accuracy of YOQO with varied sizes of shadow/victim training sets.
Hyper-parameter in loss functions. We now investigate the hyper-parameters in the attack's 's loss functions, i.e., in Eq. 4 and 7 in Eq. 5, which scale the specificity and sensitivity terms. Fig. 6(a) shows the online attack performance trend with a. With a larger a, the precision increases as there are fewer false positive samples, whereas the recall decreases because the influence of the sensitivity term is enervated, leading to more false negatives. Fig. 6(b) shows the offline attack performance. When increasing Y, the recall increases and the precision decreases, indicating more false negatives and fewer true positives. However, both a and y have a small influence on the inference accuracy when they fall in most parts of the given intervals.
Prcciann
doundaryy
Beusday Mark
73
4.5
0.38
0.39
1.21
2.00
(a) Adjusting a
(b) Adjusting
Figure 6: Performance of YOOO as a/y changes.
Number of in-out model pairs. We use different numbers of in-out pairs to generate the query sam- ple x', and the corresponding inference accuracy shown in Fig. 7. The accuracy of both online and offline attacks increase when we use more models in the generation process. When there are more in- out pairs, x' can better meet the two requirements Section 3.1, which leads to stronger transfcrability according to (Liu et al., 2016). Note that the attack accuracy increases marginally with more than 16 in- out model pairs. So we set this hyper- parameter as 16 to off the efficiency and performance.
60
78
Brarday Alack
Figure 7: Membership inference accuracy of YOQO versus the number of in-out pairs.
Selection of I,. In Section 3.2, we select the nearest class as & for the specificity term. Table 4 compares
8

---

Published as a conference paper at ICLR 2024
the attack performance with this selection, and randomly choosing label. The attacks evaluated over CIFARIO. It is obvious that selecting the nearest class can better facilitate the attack than selecting random label for f/- This is aligned with the hypothesis in (Nast et al., 2018). As the models tend to give relatively high and stable prediction scores to members (Liu et al., 2022: Yeom al., 2018; Yuan & Zhang, 2022), significant impact of converting non-member sample the member is the plummet of the second biggest prediction score, as the prediction logits are scaled by the softmax layer and always sum up to In other words, the decision boundary is mostly changed between the class with the second biggest confidence and the ground-trute class. The boundary of random class other than that may remain the same, leading to a smaller improvement area. This makes it harder to search for query sample.
4.3 ROBUSTNESS AGAINST DIFFERENT DEFENSES
We evaluate the robustness YOQO against vari- state-of-the-art MIA defenses. All the attacks are conducted on CIFARIO and CNN7, with 2,500 samples in the training set. Fig. presents the vic- tim model's 's clean accuracy (и-axix) and adversary's s inference accuracy (æ-axis) when we vary the hyper- parameter values in these defenses. Ideally, good defense can reduce the inference accuracy while pre- serving the model's clean accuracy. We observe that some defenses (e.g.. PPB and ADV) can have effects on our attacks, but cannot satisfactorily mitigate them while keeping the functionality of the victim model simultaneously. Other defenses like MemGuard have negligible effects YOOO, as they are mainly targeting the posterior basterior-based attacks.
Attacks
Choose randomly
Choose the nearest
Gup Attack
67.85
67.85
YOOO
75.15
81.65
Offline 73.42
79.19
Table 4: Membership inference accuracy of YOOO using different ways choose !/.
ACC Victim Model (96)
10
60
ACC Victimm Model
20-
30
UBs (BOUTERRY!
LOL
LBL (Buuddar)
AbV
AGV (ounddrn
Namruard
Mammuar
Horduard (isunday
Mendusrn (heandor))
50
15
20
70
35
00
52
55
20
75
50
Inferece Accuracy of YOQO (%)
Inference Accuracy of YOQO (%)
(a) YOQO Online
(b) YOQO Offline
Figure 8: Membership inference accuracy against different defenses.
LDL is a defense solution specifically designed for label-only MIAs. From the evaluation, we observe that LDL can significantly reduce the inference accuracy of the boundary and gap attacks in most cases. In contrast, the accuracy of our two YOOO attacks remain high and stable. We hypothesize that this is because YOQO is less dependent on the concrete distances than the other attacks, so LDI. can hardly influence the improvement area.
CONCLUSION
We propose YOQO, novel label-only membership inference attack to reduce the heavy query bud- get. We demonstrate that privacy leakage can still take place when the adversary is allowed to query the model just once. We introduce the concept of improvement area to analyze the label-only MIAs and design two novel techniques to effectively generate the query sample and accurately make the membership decision. Evaluations demonstrate that YOQO can achieve comparable inference curacy as the state-of-the-ar boundary attack, which requires more than 1000 x queries. Besides, YOQO is robust against different MIA defenses compared the boundary attack.

---

Published as a conference paper at ICLR 2024
6 ACKNOWLEDGEMENT
Thi work is supported by National Natural Science Foundation of China No. 62106127 and the Na- tional Research Foundation, Singapore, the Cyber Security Agency under its National Cybersecurity R&D Programme MOE-T2EP20111-000
the Singapore Ministry of Education (MOE) AcRF Tier
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Yang Bai, Yuyuan Zeng, Yong Jiang. Yisen Wang, Shu-Tao Xia, and Weiwei Guo. Improving query efficiency of black-box adversarial attack. In Computer Vision-ECCV 2020: 16th European Con- ference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXV 16, pp. 101-116. Springer, 2020.
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Mem- bership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pp. 1897-1914. IEEE, 2022.
Jianbo Chen, Michael I Jordan, and Martin J Wainwright. Hopskipjumpattack: A query-efficient decision-basee attack. In 2020 ieee symposium on security and privacy (sp), pp. 1277-1294. IEEE, 2020,
Christopher Choquette-Chore Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. In International conference machine learning, pp. 1964-1974. PMLR, 2021.
Andrew Elliott, Stephen Law, and Chris Russell. Explaining classifiers using adversarial perturba- tions on the perceptual ball. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattem Recognition, pp. 10693-10702, 2021.
The Apache Software Foundation. Predictionio. Website, 2021. https://attic. http://oojectts/peddiitttee
.tml.
Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. Logan: Membership infer- ence attacks against generative models. arXiv preprint arXiv:1705.07663. 2017.
Hailong Hu and Jun Pang. Membership inference of diffusion models. MrXiv:2301.09956. 2023.
arXiv preprint
Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong. Memguard: Defending against black-box membership inference attacks via adversarial examples. In Pro- ceedings of the 2019 ACM SIGSAC conference on computer and communications security, pp- 259-274 2019.
Mika Juuti, Sebastian Szyller, Samuel Marchal, and Asokan. Prada: protecting against dnn model stealing attacks. In 2019 IEEE European Symposium Security and Privacy (EuroS&P), pp- 512-527. IEEF, 2019.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Huichen Li, Xiaojun Xu, Xiaolu Zhang, Shuang Yang, and Bo Li. Qeba: Query-efficient boundary- based blackbox attack. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pp. 1221-1230, 2020.
Zheng Li and Yang Zhang. Membership leakage in label-only exposures. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 880-895. 2021.
10

---

Published as a conference paper at ICLR 2024
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. arXiv preprint arXiv:1611.02770 2016.
Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. Membership inference attacks by exploiting loss trajectory. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and 2022.
Communications Security, pp.
Yunhui Long, Vincent Bindschaedler, Lei Wang, Diyue Bu, Xiaofeng Wang, Haixu Tang. Carl A Gunter, and Kai Chen. Understanding membership inferences well-generalized learning mod- cls. arXiv preprint arXiv: 04889, 2018.
Milad Nasr, Reza Shokri, and Amir Houmansadr. Machine learning with membership privacy using adversarial regularization. Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, pp. 634-646, 2018.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Shadi Rahimian, Tribhuvanesh Orekondy, and Mario Fritz. Differential privacy defenses and sam- pling attacks for membership inference. In Proceedings of the 14th ACM Workshop Artificial Intelligence and Security, pp. 193-202, 2021.
Arezoo Rajabi, Dinuka Sahabandu, Luyao Niu, Bhaskar Ramasubramanian, and Radha Poovendran. Ldl: A defense for label-based membership inference attacks. arXiv preprint arXiv:2212.01688 2022.
Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. White- box vs black-box: Bayes optimal strategies for membership inference. In International Confer- ence on Machine Learning, pp. 5558-5567. PMLR, 2019.
Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. MI-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint /806vv/806.0/// 2018.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference at- tacks against machine learning models. In 2017 IEEE symposium security and privacy (SP), pp. 3-18. IEEE, 2017.
Liwei Song, Reza Shokri, and Prateck Mittal. Privacy risks of securing machine learning models against adversarial examples. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 241-25112 2019.
Stacey Truex, Ling Liu, Mehmet Emre Gursoy, Wenqi Wei, and Lei Yu. Effects differential pri- vacy and data skewness membership inference vulnerability. In 2019 First IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), pp- 82 91. IEEE, 2019.
Yuxin Wen, Arpit Bansal, Hamid Kazemi, Eitan Borgnia, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Canary in coalmine: Better membership inference with ensembled adversarial queries. arXiv preprint arXiv:2210. 2022.
Dingqi Yang, Daqing Zhang, Longbiao Chen, and Bingqing Qu. Nationtelescope: Monitoring and visualizing large-scale collective behavior in lbsns. Journal of Network and Computer Applica- fions, 55: 55:170-180. 2015.
Ziqi Yang, Bin Shao, Bohan Xuan, Ee-Chien Chang, and Fan Zhang. Defending model inversion and membership inference attacks via prediction purification. arXiv preprint 1.XXv:2005003913 2020.
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine leamn ing: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pp. 268 282. IEEF, 2018.
11

---

Published as a conference paper at ICLR 2024
Xiaoyong Yuan and Lan Zhang. Membership inference attacks and defenses in neural network pruning. In 31 USENIX Security Symposium (USENIX Security 22), pp. 4561-4578, 2022.
Yang Zou, Zhikun Zhang, Michael Backes, and Yang Zhang. Privacy analysis of deep learning the wild: Membership inference attacks against transfer learning. arXiv preprint (rxii:2009.04877, 2020.
A APPENDIX
A.1 THE TRAINING RECIPES OF THE MODELS EVALUATED
In Table A.1 provide the training recipes of the models tested in $ 4. The training settings basically follow such recipe unless specially referred.
Model
Learning
Optimizer
Batch
Training Epoch
CNN7
0.001
Adam
VGGI6
0.001
Adam
64
50
CICARII/C 100gss/A
ResNer18 8
0.001
Adam
64
20
DenseNet121
0.001
Adam
128
InceptionV3
0.001
Adam
128
ScResNet18
0.001
Adam
128
20
Purchase 100/ocation
ColumnFC
0.001
Adam
32
30
Table A.l: Training recipes for models evaluated.
A.2 WORST-CASE STUDY
We further perform the worst-case study to show the feasibility of YOQO. Specifically, we use the distance of sample from the decision boundary yielded by the boundary attack Choquette-Choo et al. (2021) as criterion, and select the samples with 10% longest distance in terms of lo 4 12. and 4o0 respectively from the This makes the set of the target samples be composed of 200 samples (100 out samples and 100 in samples). We evaluate the distance of each sample on victim models, and use the average distance as the criterion. The models being tested are CNN7 model trained on CIFAR10 of 2,500 samples. Table A.2 we show the results:
the target samples evenly from all the out and in samples.
Norm
1g
12
[x
Boundary Attack
52.7%
54.0%
54.1% 1%
53.3%
Gap Attack
50.0%
50.0%
50.0%
50.0%
YOQO Online
65.3%
61.0%
61.22%
61.5%
XOgO Offline
60.0%
57.7%
56.5%
59.5%
Table A.2: Worst-case study
We observe that methods tend to have better performance than the boundary attack. This indi- cates that YOQO can be more effective to infer the membership of the worst-case samples which the boundary attack is hard deal with.
A.3 INFLUENCE OF L2 REGULATIONS WHILE TRAINING THE VICTIM MODELS.
To demonstrate the effectiveness of YOQO on less overfitting models, we further perform evalua- tions on models trained with stronger L2 regulations. Specifically, we use CNN7 both the shadow and victim model, over 2,500 CIFAR- 10 images as the training set. The results are shown below. As increases, the effect the L2 regulations get stronger, resulting in performance degradations in all attacks. Nevertheless, YOQO still keeps comparable performance as the Boundary attack. Ad- ditionally we also notice that strong L2 regulation makes the training very unstable, and also causes performance degradations the test accuracy.
A.4 ADDITIONAL RESULTS ON BIGGER DATASETS AND PRETRAINED MODELS
We turn to use larger dataset or models pre-trained on large dataset to further strenthen the utility of the attack. Particularly, larger training datasets with higher resolutions and more samples
12

---

Published as a conference paper at ICLR 2024
Regulation Param X
Gap Atk
YOOO Online
YogO Offline
Boundary Atk
0.01
60.10%
72.34%%
69.91% %
71.75%
0.02
54.13%
18%
66.47%
70.03%
0.04
52.32%
57.71%
55.70%
55.65%
Table A.3: Studies on varying the weight decay of L.2 regulations minimize the overfitting.
(75k Tiny-Im Imageee, 25k CIFAR-10); 2) consider both training from scratch and fine-tuning public model pre-trained on ImageNet. The inference accuracy of different attacks are shown in the Table A.4. We can observe that our attacks maintain comparable accuracy as SOTA attacks, but much more efficient (only query once). This conclusion is consistent with the previous evaluations in demonstrating the practicality and utility of our attacks in a wider of configurations.
Dataset
Model
Dataset Size
Gap
Boundary
Online
Offlinc
CIFARIO CIFARIO
CNN7 from Scratch
25k
61.62%
74.34%
75.03%
73.88%
ResNet34 Pretrained Imagenet
25k
56.2%
63.01%
62.27%
60.34%
Tiny- Imagenet
ResNet 34 Pretrained on Imagenet
75k
65.2%
73.21%
73.13%
70.47%
Tiny-Immn Imagenett
ResNet 34 From Scratch
75k
75.7%
81.03%
80.94%
77.65%
Table A.4: Membership inference accuracy of MIAs on bigger datasets and fine-tuned models.
A.5 ADDITIONAL EXPERIMENTS ON TRANSFERABILIT
We conduct experiments using victim models trained with various settings that are different from the shadow models. Specifically, experiments are conducted using the same setting in the ablation studies. The results are shown in Table A.5.
different optimizers, batch sizes, and learning rate. All the
Optimizer of shadow models
Optimizer of larget models
Batch Size
Learning Rate
Gap Alk
Online Alk
Offline Atk
Adam
SGD
128
0.01
68.70%
80.97%
78.35%
Adam
SGD
64
0.005
69.50%
79.22%
77.59%
80.01%
Adam
AdamW
64
0.005
68.38%
80.94%
76.929:
Table A.5: Transfcrability between different training settings.
We observe that the different training details such as batch size and optimizer have slight impacts on the effectiveness of our methods. The crafted query samples from YOQO have high transferability.
A.6 COMPARISON TO METHOD IN WEN ET AL. (2022)
We noticed that our work shares a similar idea to that in (Wen et al. (2022)). Here we discuss the differences between our work and (Wen et al. (2022)) to justify contribution.
The method proposed in (Wen et al. (2022)) is to work in the circumstances where the attacker is able to obtain the logits of the model, whereas method is exclusively designed for the label-only situations. The difference the threat model leads to the difference the loss function design.
To further the differences, migrate the method in (Wen et al. (2022)) to the hard label see- nario, and measure the attack effectiveness. We adopt the method in (Wen et al. (2022)) for the muery-sample-generatee
(Algorithm in our paper). while the rest parts are the same. We perform evaluations on CIFAR10 (2,500 samples) using CNN7. The rest of the settings are the same as the experiments in $ 4. The results are shown in Table A.6 It clear that our methods are much more effective than (Wen et al. (2022)) in terms of label-only MIA.
13

---

Published as a conference paper at ICLR 2024
1
Inference Accuracy
YOQC Online
81.65%
Canary Online
73.27%
YOCO Offline
79.19%
Canary Offline
71.54%
Table A.6: Comparison between Canary and YOQO.
14


Reviews:
[{"review_id": "DNFSmv7RMy", "reviewer": "Reviewer_bo89", "summary": "The paper proposes YOQO a label-only MIA which, unlike prior SOTA label-only MIAs, queries the target model only once using a specific sample x’ derived from the target sample (x, l) with the goal of determining the membership of (x, l). YOQO finds the query sample x’ in the improvement region which is the difference in the decision boundaries due to insertion of (x, l) in the training data. YOQO proposes an optimization to find x’ that maximizes the error of OUT models on x’ and minimize the error of IN models on x’, and solves it using gradient decent. Evaluations show that YOQO is as effective or better than the existing label only MIAs on multiple datasets/model architectures.", "questions": "This paper proposes a very novel YOQO attack and I think the paper also does a good job of explaining and evaluating the attack. The evaluations clearly show that YOQO is the new SOTA label only MIA. I have the following few concerns about the paper:\n\n- Although the experimental setup considered is the common setup in most prior works, it contains mostly small datasets with very small training dataset sizes. Can authors perform experiments on larger datasets, e.g., Imagenet? \n- I could not figure out the training recipe from the main paper. In particular does the training ensure that the models don’t overfit to the training data, e.g., using L2 regularization or any other common regularization techniques? I feel the criterion that training goes on until a model has >98% accuracy on training data may lead to overfitting that will lead to unnecessarily stronger MIAs.\n- On the same lines as the above comment, can authors add a few more details of various dataset sizes used in training with/without defenses, e.g., adversarial regularization? Also can they add details of training procedure? These are important given that MIA efficacy is greatly affected by these factors.\n- Utility of the attack: I could not understand from the current evaluations how the attack will perform in the real world. The dataset sizes are quite small which is seldom the case now a days, unless if model is fine-tuned using a small dataset. Can authors provide results for some real-world settings? Some suggestions: 1) use larger datasets 2) fine-tune a model pre-trained on large datasets?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "- YOQO is a novel idea that reduces query budget required for MI\n- Idea is well explained and paper is easy to read.\n- Experiments are well designed to demonstrate the efficacy of the attack", "weaknesses": "- YOQO evaluations consider very small datasets and training data sizes\n- Models might be overfitted on training data\n- Unclear how this attack will work in practical settings", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "3Ma6AHWhWQ", "reviewer": "Reviewer_1cwK", "summary": "The paper introduces YOQO, a novel label-only membership inference attack designed to address privacy threats in machine learning models. YOQO's key innovation lies in its identification of an \"improvement area\" around a target sample, enabling the crafting of query samples with hard labels that effectively determine the target sample's membership, significantly reducing the query budget required from over 1,000 queries to just one query. The study demonstrates that YOQO exhibits effectiveness comparable to state-of-the-art Membership Inference Attacks (MIA) while demonstrating greater resilience against various defense mechanisms. This underscores its significance in the context of privacy attacks on machine learning models.", "questions": "Two noteworthy concerns arise in the evaluation of the paper.\n\nFirst, in terms of the chosen evaluation metric, the authors have opted for accuracy to assess the performance of their attack. However, there are concerns about the appropriateness of this choice. While I agree that using a log-scale ROC curve may not be practical for this case, the fundamental issue at hand pertains to the need for evaluating the worst-case scenario for MIA. Based on my understanding, samples closer to the decision boundary should have a higher probability of being classified as members, while those significantly distant from this boundary may exhibit a lower likelihood of membership. Consequently, assessing accuracy across all samples may not effectively unveil the worst-case performance. To address this, a suggestion is made to focus on accuracy calculations for samples located farthest from the decision boundary, even though the attacker may lack knowledge of the specific location of such samples. The presence of ground truth information during the evaluation phase supports the feasibility of this approach.\n\nSecond, the experimental setting raises concerns regarding overfitting. The target model is trained with a relatively small dataset of 2,500 samples, which could potentially result in severe overfitting. Although the paper does not explicitly state the training and testing accuracy gap for the target model, it can be inferred from the GAP attack that the overfitting level exceeds 40%, potentially impacting the reliability of the conclusions. I would like to see the authors conduct experiments on well-generalized models, involving a larger training dataset to mitigate the risk of overfitting.\n\nIn Section 3.2, when the authors optimize the x to get the improvement area, they believe that Equation 3 won’t work since scalars in both in models and out models are in [0,1]. I agree, and to address this constraint, the authors adapt Equation 1 into a minimization problem, which is a common practice in finding adversarial examples. Just out of curiosity, I wonder whether adding a weight term $\\lambda$ to Equation 2 could achieve the same result, that is, turn the output of in models to [0,$\\lambda$].", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- YOQO introduces a label-only membership inference attack, reducing the query budget from over 1,000 queries to just one query.\n- The attack demonstrates effectiveness on par with state-of-the-art MIA methods, indicating its practical relevance.\n- YOQO exhibits greater robustness against various defense mechanisms, underlining its potential for real-world applications.", "weaknesses": "- The use of accuracy as the primary evaluation metric is questioned, as it may not reflect worst-case performance in MIA.\n- The potential for overfitting in the experimental setting due to a small training dataset (2,500 samples) raises concerns about the generalizability of the results.\n- While the transformation of Equation 1 into a minimization problem is justified, the exploration of alternative techniques, such as introducing a weight term, could enhance the paper's depth and robustness.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "TeoM8R72U4", "reviewer": "Reviewer_1W2d", "summary": "In this paper, the authors propose a novel label-only membership inference attack named YOQO. Before querying the target model, the attacker first perturbs the target image in such a way that it produces differing predictions between shadow models trained with and without the target image. Subsequently, the attacker queries the target model with the perturbed image and examines the predicted label. Remarkably, YOQO can achieve state-of-the-art performance with just a single query.", "questions": "- As mentioned in the weaknesses section, what would be the main difference between the proposed method and the approach outlined in [1]?\n- It's encouraging that the crafted query is transferable. However, if the training algorithm of the target model differs from that of the shadow model, such as having different learning rates or optimizers, would the attack still retain its potency?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper is well-written, making it easy to follow.\n- The results are promising. The method requires only one query yet achieves results comparable to state-of-the-art methods.\n- The extensive ablation studies presented in the paper are commendable, particularly the experiments under multiple defenses.\n- The offline attack demonstrates impressive performance without necessitating the retraining of any shadow models, which is advantageous for practical applications.", "weaknesses": "While I'm impressed with the paper, a primary concern is the apparent similarity between the proposed method and the method in [1] from ICLR 2023. The latter utilizes a similar loss to craft queries, enhancing membership inference attacks. Their emphasis is on the threat model that extracts logits from the target model. However, [1] is absent from the paper's references.\n\n[1] Wen, Y., Bansal, A., Kazemi, H., Borgnia, E., Goldblum, M., Geiping, J., & Goldstein, T. (2022). Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries. arXiv preprint arXiv:2210.10750.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)