{"type":"ScholarlyArticle","title":"Membership Inference via Backdooring","authors":[{"name":"Hongsheng Hu","slug":"hongsheng-hu","given":"Hongsheng","family":"Hu","affiliation":"University of Auckland"},{"name":"Zoran Salčić","slug":"zoran-salcic","given":"Zoran","family":"Salčić","affiliation":"University of Auckland"},{"name":"Gillian Dobbie","slug":"gillian-dobbie","given":"Gillian","family":"Dobbie","affiliation":"University of Auckland"},{"name":"Jinjun Chen","slug":"jinjun-chen","given":"Jinjun","family":"Chen","affiliation":"Swinburne University of Technology"},{"name":"Lichao Sun","slug":"lichao-sun","given":"Lichao","family":"Sun","affiliation":"Lehigh University"},{"name":"Xuyun Zhang","slug":"xuyun-zhang","given":"Xuyun","family":"Zhang","affiliation":"Macquarie University"}],"abstract":"Recently issued data privacy regulations like GDPR (General Data Protection Regulation) grant individuals the right to be forgotten. In the context of machine learning, this requires a model to forget about a training data sample if requested by the data owner (i.e., machine unlearning). As an essential step prior to machine unlearning, it is still a challenge for a data owner to tell whether or not her data have been used by an unauthorized party to train a machine learning model. Membership inference is a recently emerging technique to identify whether a data sample was used to train a target model, and seems to be a promising solution to this challenge. However, straightforward adoption of existing membership inference approaches fails to address the challenge effectively due to being originally designed for attacking membership privacy and suffering from several severe limitations such as low inference accuracy on well-generalized models. In this paper, we propose a novel membership inference approach inspired by the backdoor technology to address the said challenge. Specifically, our approach of Membership Inference via Backdooring (MIB) leverages the key observation that a backdoored model behaves very differently from a clean model when predicting on deliberately marked samples created by a data owner. Appealingly, MIB requires data owners' marking a small number of samples for membership inference and only black-box access to the target model, with theoretical guarantees for inference results. We perform extensive experiments on various datasets and deep neural network architectures, and the results validate the efficacy of our approach, e.g., marking only 0.1% of the training dataset is practically sufficient for effective membership inference.","doi":"10.24963/ijcai.2022/532","url":"https://ijcai.org/proceedings/2022/532","pdf":"https://ijcai.org/proceedings/2022/0532.pdf","markdown":"https://ijcai.org/proceedings/2022/532.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/532","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Multidisciplinary Topics and Applications","track":"Main Track","number":532,"pages":{"first":3832,"last":3838},"keywords":["Data Mining: Privacy Preserving Data Mining","AI Ethics, Trust, Fairness: AI and Law, Governance, Regulation","Multidisciplinary Topics and Applications: Security and Privacy"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38987003","length_sec":85,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985146","length_sec":693,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Adi et al., 2018] Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural net- works by backdooring. In USENIX Security, 2018.","title":"Turning your weakness into a strength: Watermarking deep neural networks by backdooring","authors":"Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, Joseph Keshet","year":"2018","venue":"USENIX Security","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Bourtoule et al., 2021] Lucas Bourtoule, Varun Chan- drasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In S&P, 2021.","title":"Machine unlearning","authors":"Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, Nicolas Papernot","year":"2021","venue":"S&P","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Carlini et al., 2019] Nicholas Carlini, Chang Liu, Úlfar Er- lingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In USENIX Security, 2019.","title":"The secret sharer: Evaluating and testing unintended memorization in neural networks","authors":"Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, Dawn Song","year":"2019","venue":"USENIX Security","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Chen et al., 2017] Xinyun Chen, Chang Liu, Bo Li, Kim- berly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017.","title":"Targeted backdoor attacks on deep learning systems using data poisoning","authors":"Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, Dawn Song","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Craparo, 2007] Robert M Craparo. Significance level. En- cyclopedia of measurement and statistics, 2007.","title":"Significance level. Encyclopedia of measurement and statistics","authors":"M Robert, Craparo","year":"2007","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[de la Torre, 2018] Lydia de la Torre. A guide to the cali- fornia consumer privacy act of 2018. Available at SSRN 3275571, 2018.","title":"Lydia de la Torre. A guide to the california consumer privacy act of 2018","authors":"Torre De La","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Devlin et al., 2018] Jacob Devlin, Ming-Wei Chang, Ken- ton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understand- ing. arXiv preprint arXiv:1810.04805, 2018.","title":"Bert: Pre-training of deep bidirectional transformers for language understanding","authors":"Jacob Devlin, Ming-Wei Chang, Kenton Lee, Kristina Toutanova","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Dwork et al., 2006] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In TCC, 2006.","title":"Calibrating noise to sensitivity in private data analysis","authors":"Cynthia Dwork, Frank Mcsherry, Kobbi Nissim, Adam Smith","year":"2006","venue":"TCC","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Gu et al., 2019] Tianyu Gu, Kang Liu, Brendan Dolan- Gavitt, and Siddharth Garg. Badnets: Evaluating back- dooring attacks on deep neural networks. IEEE Access, 2019.","title":"Badnets: Evaluating backdooring attacks on deep neural networks","authors":"Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, Siddharth Garg","year":"2019","venue":"IEEE Access","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Guo et al., 2020] Chuan Guo, Tom Goldstein, Awni Han- nun, and Laurens Van Der Maaten. Certified data removal from machine learning models. In ICML, 2020.","title":"Certified data removal from machine learning models","authors":"Chuan Guo, Tom Goldstein, Awni Hannun, Laurens Van Der Maaten","year":"2020","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In CVPR, 2016.","title":"Deep residual learning for image recognition","authors":"Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun","year":"2016","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Hu et al., 2021] Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. Mem- bership inference attacks on machine learning: A survey. ACM Computing Surveys (CSUR), 2021.","title":"Membership inference attacks on machine learning: A survey","authors":"Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, Xuyun Zhang","year":"2021","venue":"ACM Computing Surveys (CSUR)","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Jia et al., 2021] Hengrui Jia, Christopher A Choquette- Choo, Varun Chandrasekaran, and Nicolas Papernot. En- tangled watermarks as a defense against model extraction. In USENIX Security, 2021.","title":"Entangled watermarks as a defense against model extraction","authors":"Jia","year":"2021","venue":"USENIX Security","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Krizhevsky et al., 2009] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny im- ages. Citeseer, 2009.","title":"Learning multiple layers of features from tiny images","authors":"Alex Krizhevsky, Geoffrey Hinton","year":"2009","venue":null,"doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Li et al., 2020] Yiming Li, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A sur- vey. arXiv preprint arXiv:2007.08745, 2020.","title":"Backdoor learning: A survey","authors":"Yiming Li, Baoyuan Wu, Yong Jiang, Zhifeng Li, Shu-Tao Xia","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Liu et al., 2020] Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In ECCV, 2020.","title":"Reflection backdoor: A natural backdoor attack on deep neural networks","authors":"Yunfei Liu, Xingjun Ma, James Bailey, Feng Lu","year":"2020","venue":"ECCV","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Mantelero, 2013] Alessandro Mantelero. The eu proposal for a general data protection regulation and the roots of the 'right to be forgotten'. Computer Law & Security Review, 2013.","title":"The eu proposal for a general data protection regulation and the roots of the 'right to be forgotten","authors":"Alessandro Mantelero","year":"2013","venue":"Computer Law & Security Review","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Montgomery and Runger, 2010] Douglas C Montgomery and George C Runger. Applied statistics and probability for engineers. John Wiley & Sons, 2010.","title":"Applied statistics and probability for engineers","authors":"C Douglas, George C Montgomery, Runger","year":"2010","venue":null,"doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Sablayrolles et al., 2020] Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Hervé Jégou. Radioactive data: tracing through training. In ICML, 2020.","title":"Radioactive data: tracing through training","authors":"Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Hervé Jégou","year":"2020","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Saha et al., 2020] Aniruddha Saha, Akshayvarun Subra- manya, and Hamed Pirsiavash. Hidden trigger backdoor attacks. In AAAI, 2020.","title":"Hidden trigger backdoor attacks","authors":"Aniruddha Saha, Akshayvarun Subramanya, Hamed Pirsiavash","year":"2020","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Salem et al., 2019] Ahmed Salem, Yang Zhang, Mathias Humbert, Mario Fritz, and Michael Backes. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In NDSS, 2019.","title":"Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models","authors":"Ahmed Salem, Yang Zhang, Mathias Humbert, Mario Fritz, Michael Backes","year":"2019","venue":"NDSS","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Schwarzschild et al., 2021] Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P Dickerson, and Tom Goldstein. Just how toxic is data poisoning? a unified benchmark for backdoor and data poisoning attacks. In ICML, 2021.","title":"Just how toxic is data poisoning? a unified benchmark for backdoor and data poisoning attacks","authors":"Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P Dickerson, Tom Goldstein","year":"2021","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Shokri et al., 2017] Reza Shokri, Marco Stronati, Con- gzheng Song, and Vitaly Shmatikov. Membership infer- ence attacks against machine learning models. In S&P, 2017.","title":"Membership inference attacks against machine learning models","authors":"Reza Shokri, Marco Stronati, Congzheng Song, Vitaly Shmatikov","year":"2017","venue":"S&P","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Smith and Miller, 2022] Marcus Smith and Seumas Miller. The ethical application of biometric facial recognition technology. Ai & Society, 2022.","title":"The ethical application of biometric facial recognition technology","authors":"Miller Smith, Marcus Smith, Seumas Miller","year":"2022","venue":null,"doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Song and Mittal, 2021] Liwei Song and Prateek Mittal. Systematic evaluation of privacy risks of machine learn- ing models. In USENIX Security, 2021.","title":"Liwei Song and Prateek Mittal. Systematic evaluation of privacy risks of machine learning models","authors":"Mittal Song","year":"2021","venue":"USENIX Security","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Song and Shmatikov, 2019] Congzheng Song and Vitaly Shmatikov. Auditing data provenance in text-generation models. In KDD, 2019.","title":"Congzheng Song and Vitaly Shmatikov. Auditing data provenance in text-generation models","authors":"Shmatikov Song","year":"2019","venue":"KDD","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Song et al., 2017] Congzheng Song, Thomas Ristenpart, and Vitaly Shmatikov. Machine learning models that re- member too much. In CCS, 2017.","title":"Congzheng Song, Thomas Ristenpart, and Vitaly Shmatikov. Machine learning models that remember too much","authors":"Song","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Wang et al., 2019] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In S&P, 2019.","title":"Neural cleanse: Identifying and mitigating backdoor attacks in neural networks","authors":"Wang","year":"2019","venue":"S&P","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Yeom et al., 2018] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In CSF, 2018.","title":"Privacy risk in machine learning: Analyzing the connection to overfitting","authors":"Yeom","year":"2018","venue":"CSF","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Zou et al., 2021] Zihang Zou, Boqing Gong, and Liqiang Wang. Anti-neuron watermarking: Protecting personal data against unauthorized neural model training. arXiv preprint arXiv:2109.09023, 2021.","title":"Anti-neuron watermarking: Protecting personal data against unauthorized neural model training","authors":"Zou","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}