OSLO: One-Shot Label-Only Membership Inference Attacks
Authors: Yuefeng Peng
Jaechul Roh
Subhransu Maji
Amir Houmansadr
Venue: NeurIPS 2024 poster (2024)
Keywords: membership inference attack
privacy
leakage
Primary area: privacy
TL;DR: We propose a label-only Membership Inference Attack (MIA) that works by sending only a single shot to the target model.

Abstract: We introduce One-Shot Label-Only (OSLO) membership inference attacks (MIAs), which accurately infer a given sample's membership in a target model's training set with high precision using just a single query, where the target model only returns the predicted hard label. 
  This is in contrast to state-of-the-art label-only attacks which require $\sim6000$ queries, yet get attack precisions lower than OSLO's.
  OSLO leverages transfer-based black-box adversarial attacks. The core idea is that a member sample exhibits more resistance to adversarial perturbations than  a non-member. We compare OSLO against state-of-the-art label-only attacks and demonstrate that, despite requiring only one query, our method significantly outperforms previous attacks in terms of precision and true positive rate (TPR) under the same false positive rates (FPR). For example, compared to previous label-only MIAs, OSLO achieves a TPR that is at least 7$\times$ higher under a 1\% FPR and at least 22$\times$ higher under a 0.1\% FPR on CIFAR100 for a ResNet18 model. We evaluated multiple defense mechanisms against OSLO.

OSLO:
One-Shot Label-Only Membership Inference Attacks
Yuefeng Peng University of Massachusetts Amherst yuefengpeng@e eoseensss.s.mmm..eee.e.e.
Jaechul Roh University of Massachusetts Amherst jroh @um@@uumseee edu
Subhransu Maji
Amir Houmansadr
University of Massachusetts Amherst smaji @ www.eessssss..mmmmmmmmm edu
University of Massachusetts Amherst amir cs. cs..umss.edi
Abstract
We introduce One-Shot Label-Only (OSLO) membership inference attacks (MIAs), which accurately infer given sample's s membership target model's training set with high precision using just single query, where the target model only returns the predicted hard label. This is in contrast to state-of-the-art label-only attacks which require ~ 6000 queries, yet get attack precisions lower than OSLO's. s. OSLO leverages transfer-basee black-box adversarial attacks. The core idea is that member sample exhibits a non-member. We compare OSLO against state-of of-the-art label-only attacks and demonstrate that, despite requiring only one query, our method significantly outperforms previous attacks terms of precision and true positive rate (TPR) under the same false positive rates (FPR). For example, compared previous label-only MIAs, OSLO achieves a TPR that at least 7 x higher under a 1 % FPR and least 22x higher under 0.1% FPR on CIFAR 100 for a ResNet18 model. We evaluated multiple defense mechanisms against OSLO.
resistance to adversarial perturbations than
Introduction
Deep learning (DL) models are vulnerable to membership inference attacks (MIAs), where an attacker attempts to infer whether given sample is in the target model's training set [1]. The success of such MIAS may lead to severe individual privacy breaches as DL models are often trained on private data such medical records (2) and facial images
[]] Existing black-box MIAs fall into two categories: score score-based MIAS I 5 and decision-based MIAS (6 77. also known as label-only MIAs. Score-based attacks assume access the model's output confidence scores, which can be defended against if the model only outputs a label. In contrast, label-only attacks infer membership based the labels returned by the target model, which is stricter and more practical threat model.
State-of-the-an label-only MIAs measure the sample's 's robustness to adversarial perturbations, clas- sifying samples with higher robustness as members. This robustness serves proxy for model confidence, which is typically higher for training samples. These attacks utilize query-based black- box adversarial attacks g to determine the amount of necessary adversarial perturbation for each sample. However, accurately estimating this requires a large number of queries to the model, sometimes up to thousands for each sample. This approach is not only costly but also easily detectable I0 Furthermore, these attacks often lack precision and are unsuccessful in the low false positive rate regime, indicated by previous studies [1 and our evaluations. In summary, existing label-only MIAs are not practical.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Inttiaized Perturbation
Target Model
Queries on /
ang max aa
Partaratton
Momber
Existing State-of-the-Art
Magnitudo(
>> n
Label-Only Attack
Non-Member
Updali Perturtation
arg argmax (1
Suroggele
Mocels
Our One-Shot
Label-Only (OSLO) Attack
Partur teiion
ang max Ratato
Non Member
Figure 1: An illustration of OSLO versus the state-of-the-art boundary attack. Boundary attack requires querying the target model thousands of times, whereas OSLO requires only a single query.
Table I:
Comparison previous label-only attacks. We report the highest attack precision that these attacks can achieve with recall greater than 1 % on CIFAR-10 using a ResNetl 8 model.
Requine no knowledge about target model architecture
Requize no auxiliary data
Num of queries used
Attack precision
Attack method
Transfer Attack 6
X
60.9%
[D [Paksdoo
Augmentation
69 69.2%
Boundary Attack (Ganssian Noise]
61.3%
~700
Boundary Attack (HopSkiplump)
7
64.5%
-6000
Boundary Attack (QEBA) [
V 71.4%
6000
OS1.0 (Ours)
x
96.2%
We propose novel One-Shot Label-Only (OSLO) MIAs that can infer sample's membership in the target model's training set with just single query, even when the target model only returns hard labels for input samples. Table [ compares OSLO previous label-only MIAs. OSLO is based on constructing transfer-basee adversarial example, with just enough magnitude of adversarial perturbation added to each sample to cause misclassification if the sample is non-member (but not enough if it is member) based on set of source and validation models, a technique that was initially proposed in [1]. Prior work has considered using a fixed threshold of adversarial perturbation across all samples to infer membership status, resulting in lower precision
We extensively compared OSLO with state-of-the-ar label-only methods standards, we evaluated the attacks using metrics such as the true positive rate (TPR) under a low false positive rate (FPR) and performed precision/recall analysis. Our results show that previous label-only MIAs perfom poorly, exhibiting high false positive rates. In contrast, OSLO achieves high precision identifying members, outperforming prior work by significant margin. For example. as shown in Figure 2 OSLO is 5x to 67x x more powerful than other label-only MIAS in terms of TPR under 0.1 .11% FPR across three datasets using ResNet18 I3 model. OSLO achieves over 95% precision on all three datasets on ResNet1 8 model with recall greater than 0.01, while the highest precision achieved by other attacks is only 71.4%, 84.2%, and 67.9% respectively. Furthermore, we conduct detailed comparison of OSLO with previous work, exploring why previous label-only attacks fail to achieve high precision.
Following recent
2 Background and preliminaries
2.1 Adversarial attacks
Early works [1 have demonstrated the susceptibility deep neural networks (DNNs) to adver- sarial attacks. These attacks involve crafting subtle perturbations to input data, causing DNN to

---

make incorrect predictions while the perturbations remain almost imperceptible to humans. Adversar- ial attacks can significantly compromise model performance, resulting in issues like misclassification or misgeneration. These attacks are typically classified based on the adversary's 's level of access to the model [6]] white-box and black-box settings. In white-box attacks [7 15 18
19 20 21], adver-
saries have full knowledge of the victim model, including its architecture, parameters, and gradients. In contrast, black-box attacks (22]22) limit adversaries to querying the model and obtaining output labels or confidence scores. We primarily discuss black-box attacks to align with the threat model of our MIA settings.
Black-box adversarial attacks. Black-box, attacks primarily include two methods: (i) Query- based attacks iteratively query the target model to gather information and craft adversarial examples, adjusting perturbations based on the model's feedback. These attacks often require many queries to be effective. (ii) Transfer-based attacks generate adversarial examples using a white-box model and then transfer these examples to attack another model. Previous works have proposed various transfer-based attacks. For instance, Momentum Iterative Fast Gradient Sign Method (MI-FGSM)
21 introduces momentum iterative gradient-based methods for generating adversarial examples to effectively attack both white-box and black-box models. Diverse Inputs Iterative Fast Gradient Sign Method FDI'FFGSM) [24] enhances the transferability of adversarial examples by applying random transformations to input images at each iteration of the attack process. Traansation-Invariiee Gradient Sign Method (TI-FGSM) 25 optimizes perturbations over set of translated images to make the adversarial examples less sensitive to specific model features and improve their transferability. Admix (26) enhances traditional input transformations by mixing the input image with images from other categories to create admixed images. These admixed images are used to compute gradients, helping to create more transferable adversarial examples.
Fast
2.2 Membership inference attacks
aim to determine whether specific data sample member of the training dataset of target model. Existing MIAs often assume that the attacker can access the target model's 's confidence scores to infer membership. These score-based attacks exploit the difference confidence scores for training versus non-training data, as models often exhibit higher confidence for samples they have seen during training [1 [. Such attacks
Membership inference attacks (MIAs) 27
28
29
30
B
32 33
can be easily defended by limiting access to only the predicted labels, which reduces the amount of information available to the attacker.
Label-Only MIAS. Compared to score-based attacks, a more practical and stringent type of attack is decision- or label-only MIAs (7 31). which operate under the constraint of having access only to the final decision labels. Several label-only attacks have been proposed. For example, inspired by the transferability of adversarial examples, transfer attacks [31] explore the transfcrability of membership information. They use a shadow dataset labeled by the target model train a shadow model and perform a score-based attack on the shadow model, expecting that the differences between members and memberrss in the target model will reflect similarly the shadow model. Data augmentation attacks ? exploit the robustness of samples to data augmentation transformations to differentiate members from non-members, with higher robustness indicating membership. Similarly, tfte-offthheart label-only MIAs, known as boundary attacks R 7 use the robustness of samples to strategic input perturbations as label-only proxies for the model's 's confidence, where higher robustness implics higher confidence score. Boundary attacks have different methods for adding perturbations. For example, Gaussian noise is one method where the attacker continuously adds Gaussian noise until the label changes. Attackers also use adversarial attacks to measure the robustness of samples to adversarial perturbations. Specifically, query-based adversarial attacks like HopSkipJump [9] and QEBA 8 algorithms are used to add perturbations to each sample to generate adversarial examples.
Existing label-only MIAs typically require many queries to be effective 6 7 and struggle to achieve high TPRs at low FPRs [II. A recent work YOQO [34] reduced the query budget. However, by design, it cannot adjust the TPR-FPR trade-off and remains ineffective in the low FPR regime, limiting its practicality.
3

---

3 OSLO
3.1 Problem definition
Following Ye et al. [35 and Leemann et al. [36]. we view MIA as a hypothesis testing problem:
Ho (x, & D us H1 (z. v) D
Successfully rejecting the null hypothesis equates to determining that the sample (z, y) is member in the target model's training set D. Given sample for inference, we initially assume that the sample a non-member (H)). Our objective to design an attack method that can reject the null hypothesis with high confidence.
3.2 Threat model
Attacker's capability. Given a target model f. we assume that the attacker can only access f in black-box manner, meaning that means that for any imput x, the attacker can only observe fxx but cannot access the internal parameters 0 or any intermediate outputs of f. Furthermore, we consider a more restrictive scenario: label-only access, where the attacker can only obtain the predicted labels (i.e., Ø arg max fx)) from the target model, not the confidence scores probabilities associated with each class. This label-only, black-bon attack scenario represents one of the most challenging and realistic settings for conducting attacks against DL models. Similar to previous attacks [1 7 it is assumed that the attacker possesses an auxiliary dataset Daux that shares the same distribution as the target model's training set for the purpose of training their surrogate models. However, we do not assume the attacker has any knowledge of the target model, including its architecture.
Attacker's goal. The attacker's objective is to reliably infer whether given sample is member of the target model's training set with high precision. As underscored by Carlini et al. [5). identifying individuals within sensitive datasets with high precision poses a significant privacy risk, even if only a few users are correctly identified. Moreover, the precision of these attacks is not just a concern for individual privacy; it also lays the groundwork for more advanced extraction attacks [37), making the pursuit of high precision in MIAs critical focus for attackers. Additionally, the attacker aims to infer membership with as few queries as possible, as excessive querying not only incurs significant costs but is also detectable by defenders [10]. Our OSLO limits the query budget to single query.
3.3 Intuition of OSLO
Previous work 4 [ has demonstrated that target models tend to be overconfident on members. existing label-only attacks 66 7 suggest that models are more confident about members, making it more diffficult to "caagge their mind" on these samples. Their experiments also show that members usually more robust adversarial perturbations than non- members... We believe that the differences in the required adversarial perturbation between members and non-members can manifest in two ways: (i) on average, members tend require more adversarial perturbation than non non-members; and (ii) for each individual sample, the member status may demand more adversarial perturbation than the non-member status. Previous label-only MIAs 6 7 have exploited the former observation, but this has led to high false positive rates and low precision. Our OSLO based on the latter. We add just enough adversarial perturbation cause a misclassification for the sample if it is non-member but not if it is a member. If the sample is not successfully misclassified, it indicates that the added perturbation was insufficient, and the sample is likely member. Note that here, "sufficient perturbation' refers to a variable standard for each sample, changing with the sample, rather than a uniform standard for all samples.
3.4 Attack method
Previous label-only MIAs face two main issues: low precision and high query budget. We address both issues simultaneously by proposing our transfer-based adversarial attack based attack, which implements the aforementioned hypothesis testing framework. Specifically, we first train a group of surrogate models. For each sample, we construct a transferable adversarial example using the surrogate model(s). Then, input the crafted adversarial example into the target model and obtain

---

the predicted label. If the sample is misclassified, it indicates that the adversarial example has successfully transferred, implying that there is not enough evidence to reject the null hypothesis Ho- Otherwise, we reject Ho and determine the sample as a member. It is worth noting that the perturbation added each sample should be sufficient for it to transfer as a non-member but not as a member. Therefore, carefully controlling the scale of perturbation added to each sample is required. The framework of OSLO is divided into three stages: surrogate model training, transferable adversarial example construction, and membership inference.
Surrogate model training. The attackers first train their own surrogate models to construct adver- sarial examples. As assumed in Section 3.2, we assume that the attacker has an auxiliary dataset with the same distribution as the target model's 's training set. The attacker trains a group of models with different structures on this dataset, training N models for each structure. These models are then divided into source models and validation models based on different purposes in the adversarial example generation stage. Source models are used to calculate gradients for generating adversarial perturbations, while validation models are used to control the magnitude of the added perturbations.
Transferable adversarial example generation. After the source models are trained, the attacker generates adversarial examples on these models using transfer- bassed adversarial attacks. Exist- ing transfer-based attacks typically search for adversarial examples within fixed (y-morm ball and do not minimize the perturbation added. In other words, these attacks allocate uniform per- turbation budget e to all samples, accepting any adversarial examples found within this budget. While this approach is reasonable in the context of general adversarial attacks, it is not suitable for our MIA framework, as OSLO requires finer- grained control over the amount of perturbation added.
Algorithm 1: Transferable adversarial exam- plc generation.
Benign input with label y; source models validation model h; number of tob-procedures K; number of iterations N: step size ar maximum perturbation size and threshold ;; Output: Transfer-based unrestricted
Input:
adversarial example x' with approximately minimum change;
35 + x; for k = 1,2, K do x/ + -k-1;
for i to N do
Compute gradient:
In OSLO, the perturbation budget for each sam- ple is adaptive. Specifically, we utilize the Geometry-Aware (GA) framework proposed in [12). which employs a set of validation models to regulate the amount of perturbation added to each sample. The process of adding perturba- tions is incremental. During this process, vali- dation models are used to monitor the transfer- ability of the sample. The perturbation addition process is terminated carly-referred to as early stopping-when the perturbation added is suf- ficient for the sample to deceive the validation model, and the contidence of the correct class on the validation model drops below specified threshold T:
gi < ( v);
Update adversarial example using the update function:
x/ +- Update(a 1- 9t, at):
Clip x/ ensure it within the kc ke-ball of
x/ + clippp// x R x ;);
exp(h,(a()))
conf ΣS (x)p())(a
if conf < then
return x/; // early-stopping criterion
end end < x
exp(hy(I;0) ()) <T. (2) end P(((x)) =) = (xp(((((1;))
Tk
return ØK:
where (x; 0) denotes the logits for class j produced by the validation model, and y is the ground truth class. Through this method, the process can be terminated when the transferability of each sample reaches a certain level, resulting in tailored perturbations for each sample. This can more effectively distinguish the differences of the sample in the in and worlds.
Algorithm I outlines our method for generating transferable adversarial examples, adapted from Liu et al.'s GA framework [12 to align with our objective. The algorithm inputs with benign sample with its corresponding label y, a set of source models denoted as g, and set of validation models h. The algorithm proceeds through K sub-procedures, each conducting iterative refinement of the
5

---

adversarial example across N iterations, guided by pre-established step size and bounded by maximal perturbation magnitude e, At each iteration, the gradient of the loss function L with respect to the adversarial input is computed, informing the perturbative update. This process is modulated by the validation model h. any step the confidence of the ground-truth class falls below the threshold the early stopping is triggered to prevent werr-perturbation, thus ensuring that the perturbations are precisely calibrated for each sample.
Membership inference. Finally, for each sample z, the attacker inputs the transferable adversarial example x', generated by Algorithm 1, into the target model f. The classification outcome determines the evidence against the null hypothesis Ho. If arg max; f(x'): * y. suggests insufficient evidence to reject Ho- In contrast, a classification of arg max; f(z'); y allows us to reject Ho. hence classifying r as a member. Our membership inference strategy seeks to reject Ho with high confidence, aiming to achieve high precision in the identification of members.
4 Evaluation
4.1 Experimental setup
Datasets. We utilized three datasets commonly used in prior works [5] CIFAR-10 (8). CIFAR- 100 [8]and SVHN [39]. For CIFAR-10 and CIFAR-100, we selected 25,000 samples to train the target model under attack. For SVHN, we randomly selected 2,000 samples to train the target model. For each dataset, we trained the surrogate models used for the attack with set of data that is the same size as the training set of the target model but disjoint. Further details on dataset splits can be found in Appendix [....]]
We adopted the widely used ResNet18 [3] and DenseNet121 40 as the target model architectures. In addition these two, we incorporated five additional model architectures as surrogate models. Detailed training and attack setup are provided in Appendix A.
Models.
Baseline Attacks. We compare OSLO against five state-of-the label-only MIAs, including the transfer attack (6. three boundary attacks [7.. and the data augmentation attack (7]. Detailed settings are provided in Appendix A.1.4 We exclude YOQO 34 from our evaluation, it is not compatible with our evaluation metrics (see (ppendix[A.6)
Metries. We employ the following metrics evaluate the effectiveness of the attacks: (i) attack TPR and FPR (5) Carlini et al. suggest that membership inference attacks should be analyzed using TPR and FPR, especially considering that TPR in low FPR setting is crucial for assessing the success of MIAs. We report the log ROC curve to show the TPR and FPR of the attack, with focus on the low FPR regime: (ii) attack precision and recall: Attack precision reflects how reliably an attack can infer membership. High-precision attacks allow an attacker to credibly violate the privacy of a portion of the samples. Specifically, precision is defined as the proportion of true members correctly identified among all positively predicted members by an adversary. Meanwhile, recall quantifies the proportion of true members that the adversary has correctly identified out of all actual members. We discarded average-cass metrics such as accuracy and AUC, as they have been shown not to accurately reflect the threat of MIAs (5].
4.2 Results
4.2.1
Evaluating attack TPR under Low FPR
We first evaluate six attacks, including OSLO, focusing on TPR under low FPR regime. For OSLO, we control the trade-off between TPR and FPR by adjusting the threshold 7 during the transferable adversarial example generation phase. A lower results in more perturbation added each sample. Consequently, if the samples still fail to deceive the target model, it is more likely that they are members, thereby reducing FPR. For other attacks, we adjust their corresponding parameters to manage TPR and FPR. For instance, in the boundary attack, increasing the perturbation threshold for identifying members ensures that only samples requiring more significant perturbations are classified as members. Based on the assumption that members generally need greater perturbation than membee, this method should minimize the number of samples mistakenly identified as members and enhance the credibility of the attack.

---

10a
10
Tuue Postire Race
Your Natiitu Nara
20-1
10-1
Buralay Abaps
Punatto Alzck
Fander Altz3
10
Scandaryy dntcc (Q00M)
10-2-
Eoardary Mlack (OCBS)
Tue
10-4
Boundary Pracc ICBB)
Doandery /itett (Swundoodiiinal
Enerdayy Pioue (Sececenizhe)
Eni Eoundayy Jiruec Saruer (iple)
Cata (ugreertr
Dara tagrassation
Jugremmation
10
10"2
10n4
10"
104
10
10
10-1
10
10
10"2
10t
10
Taine Posstive Hatt
Taise Postive Hate
Taise Postive Rtae
(a) CIFARIO
(b) CIFARIOO
(C) SVHN
Figure 2: ROC curves for various label-only attacks on three different datasets on ResNet18. Each line represents the TPR of an attack under different FPRs, with emphasis on the low-FPR regime using a logarithmic scale.
10a
102
10"
The Posiivv Rate
Yue Posttve Iade
Posiivv
Pantler Arace
Tondte Mtack
Teatte Atact
Saundiry stuck (Hapsh guavs)
Mour dary BRack Iropetia ura)
Rou slay aracc jecpedgare)
drtck (iieesintiioe Data dxcrentsr osL ster)
(asssinteei))) Dara hapresatonn
lounday Jeusoi
Data bxyressaion
ORID (0
DS jhuss
10
10
10'2
30"
105
10
10 2
10
102
30
10'2
10
10
Palse Posttive
Talse Postave Rate
Talse Postive Rate
(a) CIFARIO
(b) CIFARIO0
(c) SVHN
Figure 3: ROC curves for various label-only attacks on three different datasets on 1en2eN Each line represents the TPR of an attack under different FPRs, with an emphasis on the low-FPR regime using logarithmic scale.
As shown in Figure 2 OSLO outperforms all previous label-only MIAs by large margin. For example, compared to previous attacks, OSLO achieves a TPR that ranges from 5x to 67x higher under 0.1%% % FPR, and from 3x to 16x higher under 1% FPR ResNet18, evaluated across three datasets. On 1en, the improvements range from 2x to 12x under 1 1% FPR. It can be observed that previous attacks were unsuccessful in the low FPR regime, whereas OSLO can successfully identify some members even at low FPR. For example, on CIFAR-100 using ResNet18, 0.1% FPR, the best of the other label-only MIAs achieves only a 0.3% TPR, while OSLO reaches 6.7%. Under a 1 % FPR, OSLO achieves a TPR of 18.9%, with other attacks reaching at most 2.7%. These comparisons show that, although OSLO requires only one query to the target model, it can reliably identify part of the members, while previous attacks, despite needing to perform up to thousands of queries, are almost unable to credibly identify members.
4.2.2 Precision and recall analysis
We then measured the trade-off between attack precision and recall. In MIAs, precision is considered a crucial metric, whereas recall is relatively less important (5). For instance, a precision of 1.0 means that the attacker can be 100% certain that the identified samples are members, leading to significant privacy breaches, even if only a few samples are affected. Conversely, a recall of 1.0 can be achieved by classifying all samples as members, but this does not cause any privacy breach. For MIAs, desired outcome would be the ability to trade recall for increased precision.
As shown in Figure Figure OSLO is the only one that effectively trades recall for precision. For example, by trading recall, OSLO achieves over 90% precision across all three datasets with R as the target model. Specifically, on CIFAR- 10, CIFAR-100, and SVHN with recall rates of 5%, 44.7%, and 9% respectively, OSLO attained precisions of 96.2%, 92.0%, and 90.9%. In contrast, the highest precision achieved by other attacks at similar recall levels was 67. 77.4, 82.5%, and 65.2% respectively. This demonstrates that OSLO can identify members with high precision, capability that all previous label-only attacks could not match. Previous methods could not
7

---

0.8
0.8
0.8
0.6
0.6
2.4
Bourdayy Aback (HgySaagumg))
0.4
Douncery Allakk Drapthidurgs
0."
Scundary Allack pispdkisting:
Boundary Arsctt 10254)
Bouncery Aitacc (00MN)
Soundary Attack (0CBA)
0.2
Boundary ssack Genniantlebal
0.2
Bouncary litacs Naamstarriciee
02"
Isundery Altack (Summantccoo
OGLD
3.0
0.0
0.
Becall
(a) CIFARIO
(b) CO
(c) SVHN
Figure 4: Precision-Recal curves for various label-only attacks on ResNet18. Each line represents
the trade-off between precision and recall for an attack as the attack parameter is varied.
0.8
08
0.
0.4
Bounday Alock (hgplaggump
0.4
Bouncirr Mtack biepthidanpt
0.4
Scundary Alack btspphistangi
Bounkayy Asack (Q284)
Bouncers Mlack (0B3N)
foundery stack (0ESA)
0.2
Baunday Asack standi
0.2
Alack (ostoslafiiiee
02-
Scundery Allck (ocsslariiio
OSLO
05.0
02.0 rount
0.0
0.0
09
(a) CIFARIO
(b) CIFARIO0
(c) SVHN
Figure 5: Precision-Redd Recall curves for various label-only attacks DenseNet121. Each line
represents the trade-off between precision and recall for an attack as the attack parameter is varied.
improve precision by adjusting byper-parameters, due to limitations inherent in their designs. We discuss this further in Section 6.]
5
Ablation study
1.0
5.1 Effect of using different adversarial attacks
Procision
0.6
As introduced Section 3.4 OSLO leverages transfer- based adversarial attacks. We evaluated the member- ship inference performance of OSLO using six different transfer-based adversarial techniques within its framework, specifically TI [25]. DI (24), MI (21), Admix (26), and the combinable methods TDMI and TMDAI. The results are presented in Figure Observations reveal no signifi- cant differences the effectiveness of using these various transfer-based attacks. This may suggest that the efficacy of the attack predominantly relies the inherent design of the OSLO framework rather than the specific choice of the individual transfer techniques.
CS1O (TDM)
CSLO (TDM40
Combinable Abtack
Recall
Figure 6: Precision Recall curve show- ing the attack performance of OSLO using different transfer-band adver- sarial attacks on CIFAR-10.
5.2 Effectiveness of OSLO when target and surrogate models use different training algorithms
We assume that the attacker is unaware of the target model's ' architecture, using surrogate models with different structures. We further explore scenarios where the surrogate and target models are trained with different optimization algorithms. In particular, we evaluated OSLO on CIFAR-10 using ResNet18, where the target models were trained with SGD, while the surrogate models used Adam. The results shown in Table

---

Table OSLO performance on CIFAR-10 with ResNet18 when target and surrogate models are trained using different algorithms.
Target model
Source/validation models Attack precision (Recall > 1%) Attack TPR 1% FPR
SGD, 1=0.001
Adam, Ir=0.001
95.9%
10.0%
SGD, 1r-0.1
Adam, 1r=0.001
95.3%
9.2%
Notably, OSLO achieves over 95% precision, with TPR exceeding 9% at 1% FPR in both settings. These results confirm that OSLO remains effective even when the target models are trained with algorithms different from those of the surrogate models.
5.3 Impact of validation models in OSLO
OSLO uses validation models to adjust the scale of per- turbations added to adversarial examples. To understand the impact of validation models, we conducted ablation study on CIFAR-10 using ResNet18 without the validation models, where uniform perturbation budget was applied to all samples. The results are shown in Table 3
Table 3: Attack TPR and FPR of OSLO without validation models on
CIFAR-10 10 using ResNet18.
Perturbation budget c
TPR
FPR
8/255
20.1
13%
These results indicate that without the validation model, applying a uniform perturbation budget across all samples leads to significantly reduced attack effectiveness. For example, at 32/255, nearly all members and non members were misclassified, resulting in both TPR and FPR being very low. This highlights the critical role of validation models in effectively calibrating perturbations.
16/258
2.3%
1.4%
32/255
0.1%
0.1%
5.4 Effect of using more than one shot
OSLO employs single query the target model deter- mine sample's membership status. We also explore the potential advantages of extending OSLO to utilize multiple queries sample, referred to multi-shot. Specifically, Figure[Jillustee the precision and recall of OSLO under different adversarial example generation thresholds,
1.0
0.8
Practsion
0.6
OSLO
0.4
1-shet
We further report on combining results from the current threshold with those from previous, higher thresholds. For example, 'three shots' represents feeding the current shot and the previous two shots' generated images to the target model, identifying samples members all three adver- sarial examples fail to fool the target model. As shown in Figure 7 we find that using more shots does not yield significant improvement. We attribute this to the observa- tion that even with multiple shots, only the shot with the lowest plays decisive role.
Swhutt
Lishot
11-shot
S-hhot
12-thot
Bwiut
0.2
0.4
Recall
Figure 7: Precision-Recall curve il- lustrating the attack performance of OSLO using more shots.
6 Discussion
6.1
Why OSLO outperforms previous approaches
In this section, we discuss why previous attacks fail to achieve high precision TPR under low FPR conditions, and how OSLO outperforms them. The boundary attack employs global threshold of perturbation magnitude differentiate between members and non-members. However, regardless of the chosen threshold, considerable proportion of non-man non-members are always found among the samples that require perturbations above this threshold (see the cumulative distribution function (CDF) in Figure Sa). On the other hand, by lowering the validation threshold in OSLO, the proportion of non-members among the failed adversarial attack samples significantly decreases, effectively squeezing out the non members. For example, when classifying 4.4% of the samples members, the

---

Boundary Attack (HopSkip)jump
OSLO (Ours)
1.0
Samples
Samples Test Samples
Test Samples
Curruletive fraction
Adveesana
06
92-
00
403
00
CAS
DAR
29
21
055 6:31 1-:30
Magnitude Pee Perturbation
Threshold
(a) Boundary Attack (HopSkip/ump)
OSLO (Ours)
Figure 8: Comparison of boundary attack and OSLO regarding proportions of true positives (accurately identified members) and false positives (misclassified non-members) under varying threshold settings on CIFAR-10.
boundary attack still includes 39% non-members (false positives) among those identified as members, whereas OSLO has only 10% non-ment non-members, resulting in 90% attack precision. We further diseuss this by measuring the magnitude of the adversarial perturbation added to members and non-members in boundary attack versus OSLO on CIFAR-100, details are Appendix A.2
6.2 Mitigation
Undelerted
In addition to demonstrating the effectiveness of OSLO,
Attack TPR @ 1% FPR (9g)
NonGuarrd
we also evaluated six defensive strategies [41 42 43
aimed mitigating membership privacy leakage. These experiments were conducted on the CIFAR-10 dataset using ResNet18 as the target model.
We trained three target models with different hyperparam- eters for each defense mechanism that requires retraining. Detailed configuration settings are provided in Appendix A.1.5 The results presented in Figure It can be ob- served that confidence alteration methods, such as Mem- Guard [4]), are ineffective against OSLO, expected. Other methods that mitigate memorization require strong regularization to effective but result in decrease in the model's 's test accuracy. Additionally, we tested OSLO against target models trained with adversarial training (details Appendix (A.5). and observed that while adversarial training reduces OSLO's effectiveness to some extent, it is not sufficient as standalone defense.
Prediction accuracy delta (%)
Figure 9: Attack TPR under 1% FPR of OSLO against various defense mechanisms.
7 Conclusions and limitations
In this paper, we propose OSLO, One-Shot Label-Only Membership Inference Attack (MIAs). OSLO is based on transfer-based adversarial attacks and identifies members by the different perturbations required when a sample is member versus a non member. We empirically demonstrate that OSLO not only operates under label-only settings with single query but also significantly outperforms all previous label-only attacks by a large margin in terms of true positive rate (TPR) under the same false positive rate (FPR) and attack precision. Thus, OSLO sets new benchmark for label-only MIAs and can serves as an effective measure privacy leakage in these settings. We also delve into why OSLO outperforms existing methods. Furthermore, we evaluate multiple defenses against OSLO, highlighting its robustness.
OSLO requires training surrogate models that need auxiliary dataset from the same distribution as the target model's training set. Although this common assumption MIAs ① 5 and can be alleviated by using synthetic data demonstrated in prior work (1. it remains limitation.
10

---

Acknowledgments
The work was supported in part by the NSF grant 2131910, and by DARPA under Grant DARPA- RA-21--0--9--YYFA9PPP--00
References
[1] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3-18. IEEE, 2017.
[2] Bradley Erickson, Panagiotis Korfiatis, Zeynettin Akkus, and Timothy L Kline. Machine learning for medical imaging. radiographics, 37(2):505-33 515, 2017.
[3] Yaron Gurovich, Yair Hanani, Omri Bar, Guy Nadav, Nicole Fleischer, Dekel Gelbman, Lina Sasel,S Peter M Krawitz, Susanne B Kamphausen, Martin Zenker, et al. Identifying facial phenotypes of genetic disorders using deep learning. Nature medicine, 25(1):60--6) 10166064,,55 2019.
[4] Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. MI-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint 1806: 2018.
[5] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. 2022 IEEE Symposium on Security and Privacy (SP), pages 1897-1914. IEEE, 2022.
[6] Zheng Li and Yang Zhang. Membership leakage in label-only exposures. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 880-895 2021.
[7] Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label- only membership inference attacks. In International conference on machine learning, pages 1964 1974, PMLR, 2021.
[8] Huichen Li, Xiaojun Xu, Xiaolu Zhang, Shuang Yang, and Bo Li. Qeba: Query-efficient boundary- based blackbox attack. In Proceedings the IEEE/CVF conference computer vision and pattern recognition, pages 1221-1230, 2020.
[9] Jianbo Chen, Michael I Jordan, and Martin Wainwright. Hopskipjumpattack: A query-efficient decision-baat based attack. 2020 JEEE symposium on security and privacy (SP), pages 1294. IEEE, 2020.
[10] Huiying Li, Shawn Shan, Emily Wenger, Jiayun Zhang, Haitao Zheng, and Ben Y. Zhao. Blacklight: Scalable defense for neural networks against Query-Based Black-Box attacks. In s1 USENIX Security Symposium (USENIX Security 22), pages 21 277221,,, 2022.
[11] Harsh Chaudhari, Giorgio Severi, Alina Oprea, and Jonathan Ullman. Chameleon: Increasing label-only membership leakage with adaptive poisoning. In International Conference on Learning Representattonns 2024.
[12] Fangcheng Liu, Chao Zhang, and Hongyang Zhang. Towards transferable unrestricted adversar- ial examples with minimum changes. In 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 327-338. IEEE, 2023.
[13] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pultern recognition, pages 770-778, 2016.
[14] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitra Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties neural networks, arXiv preprint arXiv: 1312.6199, 2013.
11

---

[15] lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. arXiv preprint arXiv:1412.6572, 2014.
[16] Joana C Costa, Tiago Roxo, Hugo Proença, and Pedro RM Inácio. How deep learning sees the world: A survey on adversarial attacks & defenses. arXiv preprint arXiv:2305. 10862, 2023.
[17] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, In 2017 IEEE symposium on security and privacy (SP), pages 39-57. leee, 2017.
[18] Seyed-Mohsed Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings the IEEE conference on computer vision and pattern recognition, pages 2574-2582, 2016.
[19] Eric Wong, Leslie Rice, and Zico Kolter. Fast better than free: Revisiting adversarial training. arXiv preprini arXiv:2001.0338 1.33944, 2020.
[20] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint (rXiv:706600083, 2017.
[21] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185-9193, 2018.
[22] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query -fffccenffi black-box adversarial attack via random search. In European conference on computer vision, pages 484-501. Springer, 2020.
[23] Matthew Wicker, Xiaowei Huang, and Marta Kwiatkowska. Feature-guided black-box safety testing of deep neural networks. arXiv preprint arXiv: 2017.
[24] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang. Zhou Ren, and Alan L. Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2730-2737 2739, 2019.
[25] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invarian attacks. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 4312 2019.
[26] Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16158-16167, 2021.
[27] Klas Leino and Matt Fredrikson. Stolen memories: Leveraging model memorization for calibrated white-box membership inference. In 29th USENIX Security Symposium (USENIX Security 20), pages 1605-1622 2020.
[28] Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP), pages 739-753. IEEE, 2019.
[29] Alexandre Sublayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. White-box vs black-box: Bayes optimal strategies for membership inference. In International Conference Machine Learning, pages 5558 -5677 PMLR, 2019.
[30] Bo Hui, Yuchen Yang, Haolin Yuan, Philippe Burlina, Neil Zhenqiang Gong, and Yinzhi Cao. Practical blind membership inference attack via differential comparisons. arXiv preprint 2021.
arXiv:2101.00
[31] Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. Membership inference attacks by exploiting loss trajectory. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 2085-2098, 2022.
12

---

[32] Lauren Watson, Chuan Guo, Graham Cormode, and Alexandre Sablayrolles. On the importance of difficulty calibration in membership inference attacks. In International Conference on Learning Representations, 2022.
[33] Yuxin Wen, Arpit Bansal, Hamid Kazemi, Eitan Borgnia, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Canary in coalmine: Better membership inference with ensembled adversarial queries. In International Conference on Learning Representations, 2023.
[34] Yutong Wu, Han Qiu, Shangwei Guo, Jiwei Li, and Tianwei Zhang. You only query once: An efficient label-only membership inference attack. In International Conference on Learning Representations, 2024.
[35] Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. Enhanced membership inference attacks against machine learning models. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 3093-3106, 2022.
[36] Tobias Leemann, Martin Pawelczyk, and Gjergji Kasneci. Gaussian membership inference privacy. In Thirty-sevnnth Conference Neural Information Processing Systems, 2023.
[37] Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jemnj Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX Security Symposium (USENIX Security 19), pages 267-284, 2019.
[38] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Toronto, ON, Canada, 2009.
[39] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
[40] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 4700-4708, 2017.
[41] Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong. Memguard: Defending against black-box membership inference attacks via adversarial examples. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 259-274, 2019.
[42] Milad Nasr, Reza Shokri, and Amir Houmansadr. Machine learning with membership privacy using adversarial regularization. In Proceedings of the 2018 ACM SIGSAC Conference Computer and Communications Security, pages 644-646,70 2018
[43] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308-318, 2016
[44] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Re- thinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 281 2818-2826, 2016.
[45] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:14099 1556, 2014.
[46] Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1492-1500, 2017.
[47] Ningning Ma, Xiangyu Zhang, Hai-Tao Zheng, and Jian Sun. Shufflenet v2: Practical guidelines for efficient enn architecture design. In Proceedings of the European conference on computer vision (ECCV), pages 116-131, 2018.
[48] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In Proceedings of the European conference on computer vision (ECCV), pages 630-645, 2016.
13

---

A Appendix
A.1
Additional Experimental Details
A.1.1 Dataset Split
For CIFAR-10 and CIFAR- 100, we used half of the training set (25,000 samples) to train the target model and the remaining half (25,00X samples) train the source and validation models. The source and validation models were trained on the same data but remained disjoint from the data used to train the target model. Similarly, for SVHN, we created two disjoint subsets of 5,000 samples each, one for training the target model and the other for the surrogate models.
For the evaluation of the attacks, we randomly selected 1,000 samples from both the target model's training set and the remaining unused samples as target samples. The dataset split is summarized in Table 4
Table 4: Summary of dataset splits for training and evaluation.
Dataset
Target model Source/validation model training
Target
training
samples
CIFAR-10
25,000
25,000
1,000 (members) -1,000 (non-members)
CIFAR- -00
25,000
25,000
1,000 (members) + 11,000 (non-members)
SVHN
5,000
5,000
1,000 (members) -1,000 (non-memhers)
A.1.2 Training setup
We consider ResNet18 and DenseNet121 440 as target models, and additionally, Inception 44
VGG13 Res ShuffleNet 47.. and PreActResNet1 48 are utilized as surrogate models. In our default setup, all models are trained for 100 epochs using the Adam optimizer, with learning rate of 0.001. We apply an weight decay coefficient of 10-6 and use a batch size of 128.
All our models and methods are implemented in Py PyToch. Our experiments are conducted on an NVIDIA GeForee RTX 2080 Ti with 20 GB of memory. The maximum training time for each surrogate or target model does not exceed 1.9 hours.
A.1.3 OSLO Configuration.
The OSLO setup primarily includes the configuration of source and validation models, as well as the parameters for generating adversarial examples. By default, we use Inception 44,, ResNeXt50
46 and NreActResNet18 [8 as the source model architectures. For validation models, we use
DenseNet121 [40), VGG13 45 and ShuffleNetV2 [7] when ResNet18 [I3] is the target model, and ResNet18, VGG13, and ShuffleNetV2 when DenseNet the target model. We follow the assumption that the attacker has no knowledge of the target model architecture and does not include the same architecture the source/validation models. Details on default number of source validation models are summarized in Table 5
Table 5: Source and validation model configurations per dataset in the default OSLO setup.
Dataset
Source models
Validation models
Total surrogate models
Inception
DenseNet121 3
CIFAR-10
ResNeXt50 x 1
VGG13
12
PreActResNNet18 X 1
ShuffleNetV2 x
Inception x
DenseNet121 x 5
CIFAR-100
ResNeXt50 x
VGG13 x
18
PreActResNett18 x
ShuffleNetV2 x 5
Inception
DenseNet121 1
SVHN
ResNeXt50 x
VGG13 x
PreActResNNe118 x
ShuffleNetV2
14

---

More combinations of source and validation models are discussed in Appendix|A.. For generating adversarial examples, we set the maximum perturbation to 80/255 and the number of sub-uuucee sub-procedures to 80, increasing by 1/255 each iteration.
A.1.4 Baseline attack configuration
We summarize the configurations the baseline attacks here. For the transfer attack, we use a relabeled dataset of the same size the target model's training set and follow the original pipeline [6] to label the shadow dataset and train the shadow model. For boundary attacks based on adversarial perturbation (HopSkipJump and QEBA), Gaussian noise-based boundary attack, we set a query budget 700. We use rotation and translation to construct augmented samples for the data augmentation attack, following the original method described in the paper 77]
query budget of 6,000 per sample. For the
A.1.5 Defense Setup
This section outlines the hyperparameters used for the defenses evaluated against OSLO Section 6.2 For each defense, three different hyperparameters were used to train the defended models. as detailed in Table
Table 6: Hyperparameter configurations for defenses evaluated against OSLO.
Defense
Hyperparameter
Values
L2 Regularization
Regularization parameter
(0.01, 0.005, 0.001)
L1 Regularization
Regularization parameter
(5e-6, 1e-5, 5e-5)
Adversarial Regularization
Alpha
[5, 6, 7] (0.3, 0.5, 0.7)
Dropout
Dropout rate
Norm clipping bound
1.2 {0.005, 0.01, 0.05)
DPSGD
Noise multiplier
A.2 Adversarial perturbation magnitude for members and non-members
0.30
Perturtation
0.00
0.55
3.04
0.10
005
PrNdEt Marber
Henber
NET NYWTERY
Merberr
Bay nerber
(a) Boundary Attack (HopSkiplump)
(b) OSLO (Ours)
Figure 10: The magnitude of adversarial perturbations added to samples in the boundary attack and OSLO on CIFAR-100. We adjusted the parameters of two attacks such that they both classify 15.8% of the samples members (marked as yellow). The precision of OSLO is 95.2%, while the precision of boundary attack is 79.3%.
we discussed why OSLO outperforms. We further explore this by measuring the perturbation magnitude added to members versus non-members in both boundary attack and OSLO. The results are presented Figure TO We set 5 = 0.01 for OSLO, which resulted in classifying 15.8% of the samples members. We also adjusted the parameters for the boundary attack to select the same proportion of samples classified as members.
In Section 6.1
From Figure 10a it can be observed that using single threshold to attempt to distinguish members from non-members leads to a significant proportion of non-members among the samples classified members, regardless of the threshold value selected (i.e., drawing a horizontal line in the figure,
15

---

1.0
1.0
0.8
0.8
Precision
Precision
0.6
v=114433 3....1y-12.3...mmm
-=111,=(22311mm [11==12..nmmm-1
0.2
5=(1]y-ff23.6)mmmmmm
5-11.4yyy[2lomme
5-[1.A]V-[[]mumm
0.0
0.0
0.2
0.6
0.8
1.0
0.4
0.6
0.8
Recall
Recall
(a) Comparison of different source and validation model combinations
(b) Comparison of different numbers of models for each validation model architecture
Figure 11: Precision- Recall curve comparing the attack precision and recall for OSLO across various combinations of source and validation models.
with those above the line classified as members). For example, as shown in Figure T0a 20.7% of the samples classified as members by the boundary attack are actually non-members. Conversely, OSLO conducts hypothesis test for each sample, enabling it to accurately identify members even if their perturbations are relatively low compared to other samples. In Figure [0b] only 4.8% of the samples classified members by OSLO are non-members.
A.3 Effect of combinations of different source and validation models
We tested the effect of using different source model architectures and validation model structures on OSLO when ResNet18 I3 is the target model. Specifically, we considered the following model structures: DenseNet121 ("1" 40, Inception-V3s ("2") 44). VGG13 ("3") (55, ResNeXt50
("4") [4)] ShuffeeNe-- V2 ("5") 47 and Pre-Activation ResNet ("6") 48 We selected different combinations from these models source models or validation models. As shown in Figure IIa different combinations have no significant impact on the trade-off between precision and recall, although they may affect the maximum achievable precision. For example, beyond a certain point, becomes impossible to trade recall for additional precision. In such cases, we tested the effect of increasing the number of models (num) trained for each validation model architecture. As depicted in Figure| 1ib increasing the number of validation models helps to make the trade-off curve more complete, as OSLO requires adding more perturbations bypass more validation models. This helps to further reduce recall and increase precision.
A.4 Further discussion on threshold т
A.4.1 Using 7 as the stopping criterion
In OSLO, the generation of adversarial perturbations stops when the confidence of the correct class on the validation model drops below specified threshold, т. An intuitive alternative is to stop at the point of label flipping. However, we found that this approach does not guarantee sufficient perturbation to achieve low FPR. To illustrate this, we compared different stopping criteria, including label flipping, across various thresholds. Table 7 shows the results for ResNet18 CIFAR-10.
Table 7: Comparison of different stopping criteria on OSLO's performance on CIFAR-10 using ResNet18.
Stopping criterion
TPR
FPR
Threshold 0.1
13.1%
3.0%
Threshold T = 0.01
7.8%
0.9%
Label flip
61.0%
30.8%
16

---

As shown in Table / small threshold is required to achieve low FPR, whereas stopping at label flipping leads to high FPR. The use of threshold r provides better control over the TPR-FPR trade-off, which is crucial for OSLO's effectiveness.
A.4.2 Choosing in realistic settings
In real-world scenarios, attackers can adapt based on the desired FPR. OSLO, is calibrated by adjusting the success rate of the transfer-based attack on the target model. For instance, to achieve 5% FPR, can be set reach a 95% success rate. This approach may require access small set of non-members, which is a common assumption in MIAs 4 30)
A.5 Effectiveness of OSLO against models trained with adversarial training
Since OSLO relies on adversarial perturbations, increasing model robustness through adversarial training appears to be a natural defense strategy. To explore this, we evaluated OSLO against target models trained with adversarial training.
First, we tested OSLO's performance when the target models were trained with adversarial training, while the surrogate models not. The results presented in Table We observed that adversarial training reduces OSLO's 's ability to achieve low FPR, but this comes at the cost of decreased model utility and increased training time.
Table 8: OSLO's performance against target models trained with adversarial training on CIFAR-10.
Attack (%)
Model
Threshold
Test ACC (%)
Training time (min)
TPR FPR
ResNet18
0.01
7.8
0.9
82.6
23
(no adversarial training)
0.001
5.0
0.2
ResNet18
0.01
97.8
57.4
73.8
85
(adversarial training, e=4/255)
0.001
95.6
52.7
We then evaluated OSLO's performance when both the target model and the surrogate models trained with adversarial training. The results shown in Table 9 OSLO remains effective, particularly in maintaining low FPR in this setting. These findings suggest that adversarial training alone may not be an adequate defense against OSLO.
Table 9: Comparison of OSLOO's performance when surrogate models are trained with and without adversarial training.
Target model training
Surrogate model training
Attack TPR
Attack FPR
Threshold
Adversarial training (e=4/255)
No adversarial training
0.001
95.6%
52.7%
Adversarial training (e=4/255)
Adversarial training (e=4/255)
0.001
15.7%
0.7%
A.6 Comparison with YOQO
OSLO shares a similar goal with the recent work YOQO 33 in improving query efficiency for label-only MIAs, Below, we discuss the key differences to highlight our contributions.
Effectiveness at low FPR. It widely accepted that MIAs should achieve low FPR to be practical 10 33 However, by design, YOQO cannot adjust the TPR-FPR trade-off, making unable to achieve low FPRs, as noted in their paper [34]. In contrast, OSLO is specifically designed to achieve
17

---

high TPRs under low FPRs and significantly outperforms existing methods in this metric. Thus, we are not able have a fair comparison because YOQO cannot achieve the low FPR that OSLO primarily works on.
Methodology. To the best our knowledge, OSLO is the first to leverage transfer-based adversarial attacks for label-only MIAs. YOQO, the other hand, shares similar approach with LiRA [3], relying on shadow models trained on target samples (IN models) and shadow models not trained on the target samples (OUT models). This approach depends on the similarity between the shadow model and target model architectures and is sensitive architecture differences [34]. In contrast, OSLO is robust variations in surrogate model architecture, demonstrated by experiments.
NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Our claims are made with clearly defined scope, and the contributions of the paper are accurately outlined, ensuring alignment with the documented empirical evidence. For example, the performance claims of our method are precisely specified using the evaluation metrics and settings and are supported by our experimental results.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We describe the necessary conditions for our method in Table I and we discuss limitations and possible solutions in Section
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
18

---

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [NA]
Justification:
Our method does not introduce new theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: The implementation details and the full experimental setup of our method are provided, and we will also release the code for reproducibility.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often good way to accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
19

---

(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g.. a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g.. to registered users), but it should possible for other researchers have some path reproducing verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We will release the code and provide instructions to reproduce our main results. All datasets used publicly available.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.c cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/mippscc/pput http://////llttuiiese/////eeeee CCoeee/mddSSubeeeee itttssummmssiooPooooooo asiionooiccyyy for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/eetails
Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: We describe the experimental setup, including the model and data splits in Section 4.1 The full training and implementation details are provided in the appendix A.]
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, appendix, or as supplemental material.
20

---

7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: For the metries used in our evaluation, error bars are not applicable or necessary.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula. call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative eтror rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer:
[Yes]
Justification: We provide information on the computer resources needed for reproduction in Appendix A.1
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: Our research adheres to the NeurlPS Code Ethics, ensuring that experi- ments were conducted responsibly and ethically.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
21

---

If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid-
eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Our work focuses on membership inference attacks, well-known privacy concern in machine learning. Potential impacts, such as privacy risks, are discussed in the paper, including in the Introduction.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: We are not releasing any new datasets or models, therefore no additional safeguards are necessary.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
22

---

Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes)
Justification: We use datasets that are publicly available with licenses such as the MIT license. For existing code implementations used, we have cited the original papers in our work.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g.. website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/ datasete has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We will release our code and provide documentation and licensing.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/codeemmodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether how consent was obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
23

---

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
24


Reviews:
[{"review_id": "uNZ49iehOt", "reviewer": "Reviewer_uq6v", "summary": "This paper presents a new label-only membership inference attack, which requires only a single query to the target model. Specifically, it leverages transfer-based black-box attacks to generate an adversarial perturbation. This perturbation is then added to the sample and input into the target model, and its prediction is used to judge whether it is a member or non-member. The experiments demonstrate the effectiveness of the proposed methods.", "questions": "- How does your proposed approach perform when tuning the method's components on validation data that is disjoint from the test data on which final performance is reported?\n\n- How many datasets are used to train the source models and validation models?\n\n- How many source models and validation models are trained for the experiments?", "limitations": "Please see my above comments.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The comparison with previous label-only attacks is clear, making it easy to pinpoint the main contributions of this paper.\n\n- The experiments are comprehensive, covering many different datasets and models.\n\n- It is nice to see that the paper evaluates many defense strategies and uses Figure 9 to clearly show the ineffective handling of the model accuracy-attack mitigation trade-off in existing defenses.", "weaknesses": "- While the paper is motivated by improving the attack costs compared to existing works, this method requires training multiple source models and validation models, which could be quite costly. This is especially true when applying it to relatively large-scale models, such as diffusion models, which makes the proposed attacks less practical.\n\n- It is unclear whether the proposed MIA was tuned on the validation data independent of the test set. Given that this method requires tuning threshold $\\tau$, there is no mention of how this tuning is done and whether using the validation data. If test data was used to tune the method instead of validation data, the results reported might be overly optimistic and not reflect the proposed MIA's performance on \"true\" test (held-out) data.\n\n- The experimental setting is unclear. Specifically, it remains uncertain how the data split is implemented. Given that 25,000 samples are used to train the target model, it is important to clarify how many datasets are used to train the source models and validation models. More importantly, how many source models and validation models are trained for the experiments? As this is closely tied to the attack costs.\n\n- It is better to conduct an ablation study. The two main contributions are using transfer-based attacks to improve the query costs and using the validation models to adjust the scale of perturbations added to the adversarial example. The latter design is interesting as it resembles calibration to the sample difficulty in existing membership inference literature. To make each contribution clearer, it is better to conduct an ablation study to investigate the importance of each design. Additionally, an ablation study should investigate the impacts of the number of source models and validation models on the attack performance.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "---\n**To Reviewer uq6v:**\n\n**Response to Weaknesses 1:**\nThank you for your feedback. While we acknowledge that training these surrogate models introduces additional computational overhead, it is a **one-time process** for each target model. Once completed, these models can be used to infer any target sample's membership, unlike previous online attacks [2][3] that require retraining shadow models for each sample.\n\nMoreover, training shadow or surrogate models is a standard practice in MIAs, including well-cited state-of-the-art works [1][2]. It is worth noting that OSLO requires fewer models compared to the related works. For instance, the state-of-the-art score-based MIA LiRA [2] requires training at least 128 shadow models, and the most recent label-only attack YOQO [3] requires training 32 shadow models. However, OSLO needs fewer than 20 surrogate models (e.g., 12 for CIFAR-10, 18 for CIFAR-100, and 6 for SVHN). To our knowledge, OSLO is the first label-only attack to achieve high TPR under low FPR. Therefore, we believe the computational cost is acceptable given the improvements.\n\n**Response to Weaknesses 2 / Question 1:**\nInstead of tuning our method on the test or validation data, we adjust $\\tau$ to obtain and report the complete ROC curve (e.g., in Figures 2 and 3, each point on OSLO's ROC curve corresponds to a different $\\tau$). The primary goal of this adjustment is to capture the trade-off between TPR and FPR rather than setting $\\tau$ to a fixed value derived from any specific data set. This approach is analogous to adjusting loss thresholds to generate the ROC curve, as discussed in previous loss-based MIAs [2]. We are happy to provide further details during the interactive discussion if our explanation does not fully address your question.\n\n**Response to Weaknesses 3 / Question 2:**\nThank you for pointing this out. We apologize for omitting the training details due to page limitations. For CIFAR-10 and CIFAR-100, we use half of the training set (25,000 samples) to train the target model and the remaining half (25,000 samples) to train the source models and validation models. The source models and validation models are trained on the same data but are disjoint from the data used to train the target model. Similarly, for SVHN, we use two disjoint subsets of 5,000 samples each to train the target model and the surrogate models. For the evaluation of the attack, we randomly select 1,000 samples from both the target model's training set and the remaining samples (not used for any model training) as target samples. Here is a summary table to clarify the data split:\n\n| Dataset    | Target Model Training Samples | Source/Validation Model Training Samples | Target Samples                                                 |\n|------------|-------------------------------|------------------------------------------|----------------------------------------------------------------|\n| CIFAR-10   | 25,000                        | 25,000                                   | 1,000 (from target model's training set) + 1,000 (from remaining samples) |\n| CIFAR-100  | 25,000                        | 25,000                                   | 1,000 (from target model's training set) + 1,000 (from remaining samples) |\n| SVHN       | 5,000                         | 5,000                                    | 1,000 (from target model's training set) + 1,000 (from remaining samples) |\n\nWe will clarify these details and add them to the appendix in the revised manuscript.\n\n**Response to Weaknesses 4:**\nThank you for your valuable suggestions. We appreciate your understanding of the innovative aspects of OSLO. Regarding the impact of the number of source models and validation models on the attack performance, We have found that increasing the number of source and validation models does not significantly improve the trade-off between TPR and FPR, or the trade-off between precision and recall, but it allows for further trading TPR to achieve lower FPR. We have included these discussions in Appendix A.3.\n\nRegarding the ablation study on the role of validation models, we are running experiments on that and will post the results once they become available during the interactive discussion.\n\n**Response to Question 3:**\nThank you for your question. In our default settings, we train the following number of source and validation models:\n- CIFAR-10: 3 source models and 9 validation models (3 models per architecture)\n- CIFAR-100: 3 source models and 15 validation models (5 models per architecture)\n- SVHN: 3 source models and 3 validation models (1 model per architecture)\n\nWe will provide a detailed description of the source and validation model configurations in the revised paper.\n\n**References:**\n\n[1] Shokri et al. Membership Inference Attacks against Machine Learning Models. S&P’17  \n[2] Carlini et al. Membership Inference from First Principles. S&P’22  \n[3] Wu et al. You Only Query Once: An Efficient Label-Only Membership Inference Attack. ICLR’24", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "90DtzAIUaO", "reviewer": "Reviewer_B8Vg", "summary": "The paper investigates the vulnerability of deep learning models to membership inference attacks (MIAs), focusing on label-only settings where only the predicted hard label is available. It introduces the One-Shot Label-Only (OSLO) MIA, which infers a sample's membership in the training set with a single query. OSLO leverages transfer-based black-box adversarial attacks, exploiting the characteristic that member samples are more resistant to adversarial perturbations. The paper presents extensive comparisons against state-of-the-art label-only attacks, showing that OSLO significantly outperforms them in terms of precision and true positive rate (TPR) under low false positive rates (FPR). For instance, OSLO achieves a TPR that is 7x to 28x stronger than previous methods under a 0.1% FPR on CIFAR10 for a ResNet model, while maintaining over 95% precision across multiple datasets. Additionally, the paper evaluates various defenses against OSLO, demonstrating its robustness and effectiveness.", "questions": "- How would methods aimed at enhancing model robustness, such as adversarial training, impact the performance of label-only inference attacks?", "limitations": "The authors have adequately summarized the limitations at the end of the paper.", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The research question is important and well-motivated.\n\n- The paper is clearly written and easy to understand.\n\n- The proposed OSLO method significantly outperforms previous approaches.", "weaknesses": "- **Mitigation Strategies**: The discussion on potential countermeasures against OSLO is somewhat limited. A deeper exploration of feasible strategies to mitigate the risks posed by such attacks would enhance the paper's practical utility.\n\n- **Computational Costs**: While OSLO does not rely on uniform perturbations like some existing methods, it requires higher computational resources to calculate specific perturbations for each sample. This could be a significant drawback in scenarios with limited computational capacity.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "---\n**To Reviewer B8Vg:**\n\n**Response to Weakness 1:**\nThank you for your suggestion. We agree that deeper research into defenses against such attacks is a promising direction. However, due to space limitations, we focused our contribution on improving label-only MIAs in terms of query cost and attack performance. We will leave further exploration of defenses for future work.\n\n**Response to Weakness 2:**\nThank you for your insightful feedback. The calculation of perturbations in OSLO occurs locally, and the time required for each sample is limited (less than 3 minutes on CIFAR-10). We believe this computational cost is acceptable for an attack setting. Once the calculations are complete, only one query to the target model is needed by the attacker, making the attack highly practical against target models under almost any resource constraints.\n\nIt is important to note that previous methods, while using uniform thresholds, still require calculating specific perturbations for each sample. This process involves continuous access to the target model, resulting in potentially thousands of queries [1][2]. This can be impractical for resource-limited target models. In contrast, OSLO minimizes the number of queries to the target model, thus offering a more efficient approach.\n\n**Response to Question 1:**\nThank you for your question. We tested OSLO against target models trained with adversarial training. The results are as shown in the table below:\n\n| Model                                    | Threshold $\\tau$ | Test ACC | Training time (min) | Attack TPR | Attack FPR |\n|------------------------------------------|-----------|----------|---------------------|------------|------------|\n| ResNet18 (no adversarial training)       | 0.01      | 82.6%    | 23                  | 7.8%       | 0.9%       |\n|                                          | 0.001     |          |                     | 5%         | 0.2%       |\n| ResNet18 (Adversarial training, ε=4/255) | 0.01      | 73.8%    | 85                  | 97.8%      | 57.4%      |\n|                                          | 0.001     |          |                     | 95.6%      | 52.7%      |\n\nWe observed that adversarial training can reduce OSLO's ability to achieve low FPR, but it **also reduces model utility and increases training overhead**. Additionally, it increases the overall difference in robustness to adversarial examples between members and non-members, potentially leading to improved attack effectiveness on average metrics such as attack accuracy. We will discuss these aspects further in the next version of the paper.\n\n**References:**\n\n[1] Choquette-Choo et al. Label-Only Membership Inference Attacks. ICML’21.  \n[2] Li et al. Membership leakage in label-only exposures. CCS’21", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ZRfVmM7ROr", "reviewer": "Reviewer_Vvp4", "summary": "The paper proposes a new label-only membership inference attack that only needs a single query to the target model to perform the attack. The general idea of the proposed attack is based on the observation that member samples need more adversarial perturbation to force a misclassification than non-member samples.\nThe adversarial perturbation leads to non-members being misclassified while members are more robust and are still correctly classified. Transferable adversarial attacks are used to perform the attack in a single query using several surrogate models. The proposed One-Shot Label Only (OSLO) attack has three phases: 1) surrogate model training 2) creating the transferable adversarial examples on the surrogate models and 3) performing the membership inference on the target model. In contrast to other label-only membership inference attacks, OSLO has a different perturbation budget for each sample.\nThe proposed attack is evaluated on three datasets (CIFAR-10, CIFAR-100, and SVHN), and in an ablation study, it is shown that the attack is model agnostic and also works with other transferable adversarial attack methods. The paper is technically sound, and the results show that OSLO outperforms existing attacks by a large margin.", "questions": "*Q1:* Why is the generation of the adversarial example stopped when the confidence is below a certain threshold $\\tau$? In my understanding, it would make more sense to stop the generation as soon as the label flips.  \n*Q2:* In reality, the attacker has to choose the threshold $\\tau$. How would the attacker choose the threshold in a realistic setting?  \n*Q3:* The perturbation budget is chosen differently for each sample. On the other hand, the threshold $\\tau$ is the same for all the samples. Wouldn't it make sense to choose a different threshold for different samples since a lower threshold means more perturbation is added to the samples?  \n*Q4:* In 6.2, it is mentioned that \"three target models using different hyper-parameters\" were trained. However, the hyperparameters were never mentioned. Which model architectures were trained here, what were the hyper-parameters for training these models, and what parameters were altered?", "limitations": "The limitations are addressed.", "rating": 7, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper is well-written and easy to understand\n- The paper is well organized, and even a reader who is not an expert in privacy attacks can follow the paper easily\n- The proposed approach is novel\n- The approach is quite simple yet apparently highly effective", "weaknesses": "- A recent paper also proposes a label-only attack that needs only a single query [1]. However, OSLO is not mentioned and, more importantly, not compared to YOQO.\n- Equation 2 is presented without introducing any of the variables. It is easier to understand equation 2 if it is mentioned in the text what $h_y(x;\\theta)$ and $h_j(x;\\theta)$ is.\n\n[1] You Only Query Once: An Efficient Label-Only Membership Inference Attack, Wu et al., ICLR 2024\n\nMisc:\n- I think the H_0 and H_1 hypotheses have to be switched in equation 1\n- There seems to be a typo in the heading of 6.1. I think it should be \"Why OSLO outperform[s] previous approaches\".", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "---\n**To Reviewer Vvp4:**\n\n**Response to Weaknesses 1:**\nThank you for your insightful feedback. We apologize for not including a comparison with YOQO in our paper. Please note that the accepted norm in the MIA community is that achieving low FPR is key for MIAs to be practical [1][2]. Although YOQO also requires only a single query, it is designed in a way that it cannot adjust the TPR and FPR trade-off, and thus **cannot achieve low FPRs** (as acknowledged in their paper [3]), making YOQO highly impractical. For example, we reproduced YOQO's experiments on ResNet18 using 2,500 training samples (as per their settings), and although the attack accuracy was over 80%, the FPR was 26%. In contrast, OSLO is primarily designed to achieve high TPR under low FPR conditions. Therefore, we are not able to have a fair comparison because YOQO cannot achieve the low FPRs that OSLO achieves.\n\n**Response to Weaknesses 2/3/4:**\nThank you for pointing these out. We will clarify and fix these issues in our paper, including the introduction of variables in Equation 2 and correcting the typos.\n\n**Response to Question 1:**\nThank you for your suggestion. In our experiments, we found that stopping the generation of the adversarial example as soon as the label flips does not ensure that enough perturbation is added to achieve a sufficiently low FPR. For example, with ResNet18:\n\n| Threshold $\\tau$ | TPR  | FPR  |\n|------------------|------|------|\n| 0.1              | 13.1%| 3.0% |\n| 0.01             | 7.8% | 0.9% |\n| Label Flip       | 61.0%| 30.8%|\n\nWe observed that a small $\\tau$ is needed to achieve a low FPR. We will include experimental comparisons regarding this in the final version of the paper. Thank you for bringing this up.\n\n**Response to Question 2:**\nThank you for your question. We believe the attacker can choose $\\tau$ based on the desired FPR. By adjusting the success rate of the transfer-based adversarial attack on the target model, the attacker can set $\\tau$ accordingly. For example, if the attacker tolerates an FPR of 5%, they can adjust $\\tau$ to achieve a 95% success rate on the target model. This may introduce an additional assumption by requiring a small set of non-members to detect the success rate of the adversarial attack; however, access to some non-members is a common assumption in MIAs [4][5]. We will include this discussion in the next version of the paper.\n\n**Response to Question 3:**\nWe agree that dynamic adjustment of the threshold is a promising direction for improving OSLO. However, it is challenging to determine how to adjust the threshold without prior knowledge of the target sample's membership. The high-level idea of OSLO is to choose a sufficiently small $\\tau$ to ensure all non-members are misclassified, thus identifying members who are correctly classified. Currently, we use the same threshold for all samples based on this intuition.\n\n**Response to Question 4:**\nThank you for pointing this out. In our experiments, we used ResNet18 on CIFAR-10. The following hyperparameters were varied:\n\n| Defense Method                    | Hyperparameter                          | Values                              |\n|-----------------------------------|-----------------------------------------|-------------------------------------|\n| L2 Regularization       | Regularization parameter                | {0.01, 0.005, 0.001}                |\n| L1 Regularization       | Regularization parameter                | {5e-6, 1e-5, 5e-5}                  |\n| Adversarial Regularization | Alpha                                  | {5, 6, 7}                           |\n| Dropout                           | Dropout rate                            | {0.3, 0.5, 0.7}                     |\n| DPSGD| Norm clipping bound                     | 1.2                                 |\n|                                   | Noise multiplier                        | {0.005, 0.01, 0.05}                 |\n\n\nWe will further clarify the model structures and hyperparameters used in the defenses mentioned in Section 6.2 of the revised paper.\n\n**References:**\n\n[1] Carlini et al. Membership Inference from First Principles. S&P’22  \n[2] Chaudhari et al. Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning. ICLR’24  \n[3] Wu et al. You Only Query Once: An Efficient Label-Only Membership Inference Attack. ICLR’24  \n[4] Salem et al. ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. NDSS’19  \n[5] Hui et al. Practical Blind Membership Inference Attack via Differential Comparisons. NDSS’21", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MMGe2Vfge7", "reviewer": "Reviewer_CtKQ", "summary": "In this work, the authors propose a novel label-only membership inference attack. This method involves adding an adversarial perturbation to compel a model, trained without the target data point, to misclassify the image. This approach requires only a single query to the model and achieves SOTA performance for label-only attacks.", "questions": "- What if the target model has a different training algorithm, like SGD? Would this make the attack less effective?\n- How to apply this attack to a new target data point? Does the attacker have to retrain some of the models?", "limitations": "The authors mention limitations at the end of the paper which I appreciate.", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "- The paper is well-written, with a strong and compelling motivation.\n- The results are very promising.", "weaknesses": "The main concern for me is that this paper lacks important related works, like [1] and [2]. In particular, [1] uses a similar strategy to conduct a one-shot label-only inference attack. While the method proposed in this paper is quite similar to [1], it seems to improve the transferability of the adversarial perturbation by checking holdout models. However, the overall contribution is not clear to me. I am not sure if the contribution is significant enough for NeurIPS, but I would appreciate hearing the authors' perspectives on this.\n\n[1] WU, YUTONG et al. You Only Query Once: An Efficient Label-Only Membership Inference Attack. In The Twelfth International Conference on Learning Representations. https://openreview.net/forum?id=7WsivwyHrS&referrer=%5Bthe%20profile%20of%20Jiwei%20Li%5D(%2Fprofile%3Fid%3D~Jiwei_Li1)\n\n[2] Wen, Yuxin et al. Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries. ArXiv abs/2210.10750 (2022): n. pag.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "---\n**To Reviewer CtKQ:**\n\n**Response to Weaknesses 1:**\nThank you for your feedback. We apologize for not including a comparison with YOQO [1] in our initial submission. Please note that OSLO and YOQO differ in several key aspects:\n\n- **Effectiveness on Low FPR Settings:** The accepted norm in the MIA community is that achieving low FPR is key for MIAs to be practical [2][3][4]. By design, YOQO cannot adjust the TPR and FPR trade-off and thus **cannot achieve low FPRs**, which is also acknowledged in their paper [1]. We reproduced YOQO's results on ResNet18 with 2,500 training samples (as used in their paper), and although it achieved over 80% attack accuracy, its FPR was 26%, which makes it highly impractical. On the other hand, OSLO is designed to achieve high attack TPR under low FPR conditions and significantly outperforms previous methods on this metric. Thus, we are not able to have a fair comparison because YOQO cannot achieve the low FPR that OSLO primarily works on.\n\n- **Methodology:** To our knowledge, OSLO is the first to use transfer-based adversarial attacks to create label-only attack samples. In contrast, YOQO is a variant of the previous work LIRA [3] in a label-only setting, requiring the training of models on the target sample (IN models) and models not trained on the target sample (OUT models). It optimizes the differences between IN and OUT models to construct attack samples.\n\n- **Assumptions about the Attacker:** OSLO does not assume that the attacker knows the target model's architecture. In our experiments, the surrogate model used has a different architecture from the target model. YOQO, however, relies on the similarity between shadow models and the target model, and the difference in architecture significantly impacts its effectiveness [1].\n\nWe will include these comparisons in the revised version of our paper.\n\nRegarding the comparison with [2], [2] and OSLO operate in different settings. [2] requires access to the target model's logits, whereas OSLO operates in a label-only context. In this paper, we only compare with label-only MIAs, but we will include a discussion of [2] in the related work section. We hope this clarifies our contributions and the significance of our work. \n\n**Response to Question 1:**\nThank you for your question. We tested the effectiveness of OSLO against target models trained with different algorithms and found that OSLO remains highly effective. Below are the results for CIFAR-10 using ResNet18, where the target model was trained with SGD, and the surrogate models were trained with Adam:\n\n| Target Model | Source and Validation Models | Attack Precision (Recall > 1%) | Attack TPR @ 1% FPR |\n|-----------------------------|------------------------------------------------|-------------------------------|--------------------|\n| SGD, lr=0.01                     | Adam, lr=0.001                                 | 95.9%                         | 10.0%              |\n| SGD, lr=0.1                      | Adam, lr=0.001                                 | 95.3%                         | 9.2%               |\n\nThese results demonstrate that **OSLO is effective even when the target model is trained using a different algorithm**. We will include these findings in the revised version of the paper.\n\n**Response to Question 2:**\nThank you for your question. OSLO does not require retraining any models when applied to a new target data point. For a given target model, OSLO trains the source models and validation models **only once**. These models can then be used to add perturbations to all target samples. For a new target data point, we compute gradient updates on the source models and validate using the pre-trained validation models. This process uses the already trained models, so no retraining is needed.\n\n**References:**\n\n[1] Wu et al. You Only Query Once: An Efficient Label-Only Membership Inference Attack. ICLR’24  \n[2] Wen et al. Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries. ICLR’23  \n[3] Carlini et al. Membership Inference from First Principles. S&P’22  \n[4] Chaudhari et al. Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning. ICLR’24", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank the reviewers for their insightful feedback and constructive suggestions, which have helped us enhance the clarity and robustness of our paper. We are committed to addressing all concerns and providing a comprehensive and well-documented study in the revised version. Our responses to each of the reviewers' questions are detailed below.

Meta-review: This paper proposes a new membership inference attack called OSLO, inspired by the empirical phenomenon of black-box adversarial attack transfer. Reviewers appreciated the clarity of writing and the empirical results, and the authors engaged with reviewers extensively during the rebuttal period in order to address most of the relevant concerns. I would strongly encourage the authors to include the additional experiments in the paper and additionally implement other suggested edits.
Decision: Accept (poster)