# Privacy Auditing in Differential Private Machine Learning:
## 3 Privacy Attacks
### Type of Attacks
#### 3.3.1 Membership Inference Attack  
A membership inference attack (MIA; also known as training data extraction attack) is used to determine whether a particular data point is part of the training dataset or not [103; 51; 104; 52; 103]. In other words, MIA tries to measure how much information about the training data leaks through the model [34; 90; 105]. The success rate of these attacks is influenced by various factors, such as _data properties, model characteristics, attack strategies,_ and _the knowledge of the attacker_[106]. This type of attack is based on the attacker's knowledge in both white-box and black-box settings [96]. The earlier works in MIAs use average-case success metrics, such as the attacker's accuracy in guessing the membership of each sample in the evaluation set [52]. The MIAs typically consist of four main types:  
* [noitemsep,topsep=0 pt]
* White-box membership inference. * Black-box membership inference. * Label-only membership inference. * Transfer membership inference. In **white-box MIAs**, the attacker (also known as a full-knowledge attacker) [84; 107] has access to the internal parameters of the target model (e.g., gradients and weights), along with some additional information [10]. For example, the attacker has access to the internal weights of the model and thus to the activation values of each layer [108]. The goal of the attacker is to gain access to the model parameters and gradients to identify differences in how the model processes training and non-training data. The main techniques are _gradient-based approaches_, which exploit the gradients of ML models [41; 109] to infer whether a specific data point was part of the training dataset, which can reveal training data by examining gradients for target data points, as the gradients for such data can often differ from the activations during training; and _activation analysis_[61], as activations for training data may differ from activations for non-training data in certain layers, which can be used as a signal to detect membership. In addition, introducing white-box MIAs in the ML model, it may also be possible to analyse internal gaps of the model and the use of features by exploiting the internal parameters and hidden layers of a model, as these often reveal training data [96]. In the _black-box setting_, the attacker simply queries the ML model with input data and observes the output, which can return either _confidence-based scores, hard labels_, or _class probabilities_. The attacker exploits the differences in the ML model between training data and unseen data, often leveraging high confidence scores for training data points as a signal of membership. In a black-box setting this type of attack is carried out through techniques such as _shadow model training_[90] or _confidence-based score analysis_[110]. By training a series of shadow models--local surrogate models--attacker obtains an attack model that can infer the membership of a particular record in the training dataset [111]. This is performed by training a model that has the same architecture as the target model but uses its own data samples to approximate the training set of the target model. The attack only requires the exploitation of output prediction vector of the model and is well feasible against supervised machine-learning models. Instead of creating many shadow models [112], use only one to model the loss or logit distributions for members and non-members. In confidence score analysis (also known as confidence-based attacks), the attacker analyzes the confidence scores returned by the model by comparing the confidence in the trained samples with the untrained samples (unseen data). The attacker has access to the labels and prediction vectors to obtain confidence scores (probabilities) for the queried input. This approach is mainly investigated in works such as [52,113]. [PERSON] et al. [103] use a confidence-based analysis that is maximized at low false-positive rates (FPRs). To improve performance at low FPRs, [PERSON] et al.