Membership Inference Attacks via Dynamic Adversarial Perturbations Reduction

Existing membership inference attacks (MIAs) based on adversarial attacks typically introduce excessively large adversarial perturbations to change the model predictions. However, such methods are not only likely to obscure the characteristic memory of the model regarding member data but also blur the subtle characteristic differences between member and non-member data. To address this issue, we propose a novel dynamic adversarial perturbation reduction MIA (DAPR-MIA), which aims to enhance the ability to identify the membership of samples by reducing the perturbation strength. Specifically, DAPR-MIA first conducts a fine-grained analysis of the gradient components of conventional adversarial examples, assessing the impact of each element on the model decision to generate a sensitivity mask. This mask identifies dimensions within adversarial examples that significantly influence model predictions, referred to as sensitive dimensions. Then, by dynamically reducing the perturbation size in these sensitive dimensions, DAPR-MIA gradually approaches the minimum perturbation required to change the prediction result of samples, maximizing the retention of membership features within the sample. Finally, the deviation of the prediction results between the original sample and the adversarial example after perturbation attenuation on the target model is measured to infer whether the sample belongs to a member data. Experimental results show that DAPR-MIA significantly outperforms existing methods on multiple datasets and deep models, demonstrating state-of-the-art attack accuracy.