# An Understanding of the Vulnerability of Datasets to Disparate Membership Inference Attacks
### Previous Work  
The following section details the previous work understanding vulnerabilities of minority subgroups of data to membership inference attack and vulnerabilities to disparate membership inference attack. This work highlights the some of the vulnerabilities that these subgroups face, shows improved attack performance when using pragmatic attacks, and sets the stage for the discussion of the need for an understanding of dataset vulnerability to these disparate membership inference attacks. [PERSON] et al. utilized the disparate vulnerabilities in order to show a pragmatic approach to membership inference, in which they were able to show increases in precision over nondeterministic methods on the order of 44% for the MNIST dataset [17, 18]. In particular, they were able to show an increase in precision from 51.7% to 95.05% by targeting the more vulnerable subgroups. [PERSON] selected vulnerable records by first estimating the number of neighbors of a potential record within the sample space available to the adversary, and deemed those with fewer neighbors as more vulnerable due to their potential to uniquely influence the target algorithm. To determine the neighbors of a potentially vulnerable record, the group trained shadow models to mimic the behavior of the target model. These shadow models were then trained both with and without the target record in order to determine the influence of that record on the shadow model. The group utilized the intermediate outputs of the shadow models on the record, which implies the record's influence, as a new feature vector for the record. For classification models without intermediate layers, the new feature vectors were created by concatenating the model's prediction vectors. The neighbor/not neighbor classification was evaluated based on the cosine distance between their feature vectors in comparison to a neighborhood. [PERSON] et al. provided a study on data and model dependencies of membership inference attacks [19]. In agreement with the studies discussed above, they found that class imbalance resulted in increased accuracy of membership inference attacks. They also found an increase in accuracy of the attack with more feature imbalance, and a decrease in accuracy with an increase in the entropy of the training dataset. The feature balance is the probability ratio of one feature versus all the other feature values in \(C_{j}\) where \(C_{j}=\{\cup_{x_{i}\in c}x_{i}\cdot a_{j}\}_{\
eq}\). Therefore, for a dataset \(D(X,y)\), the set of distinct feature vectors for the features set \(A\), where a single feature is defined as \(a_{j}\in A\), is \(C=\{\cup_{x_{i}\in X}x_{i}\}_{\
eq}\), and the probability ratio is defined as  
\[\frac{P[x_{i}=c|c\in C]}{P[x_{i}\
eq c|c\in C]} \tag{1}\]  
The entropy of the training dataset \(H_{D}\) was measured by taking the mean entropy over the \(n\) number of features,  
\[H_{D}=\frac{1}{n}\sum_{j}H[a_{j}] \tag{2}\]  
where \(a_{j}\in A\) are the features of the dataset \(D\). [PERSON] et al. compiled a study that evaluated the importance of datasets, target models, and federated learning in relationship to the success of a membership inference attack [20]. This work indicated that the uniqueness of the class boundary definition is a main contributing factor to the vulnerability of an algorithm to membership inference attacks. The number of classes was deemed important through its characterization of the number of regions into which the input space \(\mathbb{R}^{m}\) is divided, where \(m\) is the number of features. With more classes, each region is smaller, and therefore each region will more tightly surround the provided training instances, allowing for a more successful attack. The in-class standard deviation provided insight into the similarity of feature vectors within the dataset. The more similar a particular observation is to other observations, the less likely it is to significantly impact the decision boundary and, therefore. be inferred through the attack.