Untargeted Poisoning Membership Inference With Sample Selection and Enhancement

Untargeted poisoning membership inference (PMI) attacks are a newly emerging privacy threat that evaluates the impact of poisoned samples on the privacy leakage risk in the model's training dataset. Existing approaches typically select target samples randomly from a candidate dataset to generate poisoned samples, which are then injected into the training dataset. While effective in amplifying privacy leakage risks, this random selection strategy overlooks the fact that each poisoned sample contributes unequally to the attack. In this paper, we first observe that randomly selected target samples may be distant from and dispersed relative to high-confidence benign samples, which restricts the effectiveness of membership inference attacks. We then show that selecting target samples with high confidence in their ground-truth class to generate poisoned samples contributes more significantly to the attack. Therefore, we propose a novel untargeted PMI attack incorporating the target sample selection and enhancement. Specifically, we train shadow models to select the highest-confidence target samples for poison generation. To further enhance the effectiveness of the attack, we introduce a noise generator that adds adversarial perturbations to the selected target samples. Experimental results demonstrate that our approach significantly improves the attack success rate (e.g., <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$85.6\%$</tex-math></inline-formula> compared to the baseline of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$71.9\%$</tex-math></inline-formula>). Notably, the ablation study shows that our noise generator enhances privacy leakage risks even when target samples are selected randomly, highlighting its effectiveness and broad applicability.