Skip to Main content Skip to Navigation
Conference papers

White-box vs Black-box: Bayes Optimal Strategies for Membership Inference

Abstract : Membership inference determines, given a sample and trained parameters of a machine learning model, whether the sample was part of the training set. In this paper, we derive the optimal strategy for membership inference with a few assumptions on the distribution of the parameters. We show that optimal attacks only depend on the loss function, and thus black-box attacks are as good as white-box attacks. As the optimal strategy is not tractable, we provide approximations of it leading to several inference methods, and show that existing membership inference methods are coarser approximations of this optimal strategy. Our membership attacks outperform the state of the art in various settings, ranging from a simple logistic regression to more complex architectures and datasets, such as ResNet-101 and Imagenet.
Document type :
Conference papers
Complete list of metadata
Contributor : Alexandre Sablayrolles Connect in order to contact the contributor
Submitted on : Wednesday, September 4, 2019 - 5:41:34 PM
Last modification on : Wednesday, November 3, 2021 - 8:41:36 AM

Links full text


  • HAL Id : hal-02278902, version 1
  • ARXIV : 1908.11229



Alexandre Sablayrolles, Matthijs Douze, Yann Ollivier, Cordelia Schmid, Hervé Jégou. White-box vs Black-box: Bayes Optimal Strategies for Membership Inference. ICML 2019 - 36th International Conference on Machine Learning, Jun 2019, Long Beach, United States. pp.5558-5567. ⟨hal-02278902⟩



Les métriques sont temporairement indisponibles