Formalizing and Estimating Distribution Inference Risks

Distribution inference, sometimes called property infers statistical properties about a training set from access to model trained on that data. inference attacks can pose serious risks when models are private data, but difficult distinguish the intrinsic purpose of machine learning—namely, produce capture distribution. Motivated by Yeom et al.’s membership framework, we propose formal definition distribution general enough describe broad class distinguishing between possible distributions. We show how our captures previous ratio-based as well new kinds attack including revealing average node degree or clustering coefficient graphs. To understand risks, introduce metric quantifies observed leakage relating it would occur if samples were provided directly adversary. report series experiments across range different distributions using both novel black-box and improved versions state-of-the-art white-box attacks. Our results inexpensive often effective expensive meta-classifier attacks, there surprising asymmetries in effectiveness