论文标题
会员推断攻击和概括：因果观点
Membership Inference Attacks and Generalization: A Causal Perspective
论文作者
论文摘要
会员推理（MI）攻击突出了当前神经网络随机培训方法中的隐私弱点。然而，这并不是很好的理解。它们仅是不完美概括的自然结果吗？在培训期间，我们应该解决哪些根本原因以减轻这些攻击？为了回答此类问题，我们提出了第一种方法来解释MI攻击及其基于原则性因果推理与概括的联系。我们提供因果图，以定量解释以$ 6 $攻击变种的观察到的MI攻击性能。我们驳斥了几个先前的非量化假设，这些假设过于简化或过度估计潜在原因的影响，从而未能捕获几个因素之间的复杂相互作用。我们的因果模型还通过共同的因果因素显示了概括和MI攻击之间的新联系。我们的因果模型具有很高的预测能力（$ 0.90 $），即它们的分析预测与经常看不见的实验中的观察结果相匹配，这使得通过它们的分析成为务实的替代方案。
Membership inference (MI) attacks highlight a privacy weakness in present stochastic training methods for neural networks. It is not well understood, however, why they arise. Are they a natural consequence of imperfect generalization only? Which underlying causes should we address during training to mitigate these attacks? Towards answering such questions, we propose the first approach to explain MI attacks and their connection to generalization based on principled causal reasoning. We offer causal graphs that quantitatively explain the observed MI attack performance achieved for $6$ attack variants. We refute several prior non-quantitative hypotheses that over-simplify or over-estimate the influence of underlying causes, thereby failing to capture the complex interplay between several factors. Our causal models also show a new connection between generalization and MI attacks via their shared causal factors. Our causal models have high predictive power ($0.90$), i.e., their analytical predictions match with observations in unseen experiments often, which makes analysis via them a pragmatic alternative.
