论文标题
从分类器中推断培训数据的类标签分布：精确的元分类器攻击
Inferring Class Label Distribution of Training Data from Classifiers: An Accuracy-Augmented Meta-Classifier Attack
论文作者
论文摘要
针对机器学习（ML）模型的属性推理攻击旨在推断培训数据与模型的主要任务无关的属性，并迄今已将其作为二进制决策问题提出，即培训数据是否具有某种属性。但是，在工业和医疗保健应用中，培训数据中标签的比例通常也被视为敏感信息。在本文中，我们介绍了一种与文献中二进制决策问题不同的新型属性推理攻击，旨在从ML分类器模型的参数中推断培训数据的类标签分布。我们提出了一种基于\ emph {阴影训练}的方法和对阴影分类器的参数进行训练的\ emph {meta-clalerifier}，并在辅助数据上以分类器的准确性增强。我们评估具有完全连接的神经网络体系结构的ML分类器的建议方法。我们发现所提出的\ emph {meta分类器}攻击提供了比艺术状态的最大相对改善$ 52 \％$。
Property inference attacks against machine learning (ML) models aim to infer properties of the training data that are unrelated to the primary task of the model, and have so far been formulated as binary decision problems, i.e., whether or not the training data have a certain property. However, in industrial and healthcare applications, the proportion of labels in the training data is quite often also considered sensitive information. In this paper we introduce a new type of property inference attack that unlike binary decision problems in literature, aim at inferring the class label distribution of the training data from parameters of ML classifier models. We propose a method based on \emph{shadow training} and a \emph{meta-classifier} trained on the parameters of the shadow classifiers augmented with the accuracy of the classifiers on auxiliary data. We evaluate the proposed approach for ML classifiers with fully connected neural network architectures. We find that the proposed \emph{meta-classifier} attack provides a maximum relative improvement of $52\%$ over state of the art.
