Holistic risk assessment of inference attacks in machine learning

As machine learning's expanding application, there are more and more unignorable privacy and safety issues. Especially inference attacks against Machine Learning models allow adversaries to infer sensitive information about the target model, such as training data, model parameters, etc. Inference attacks can lead to serious consequences, including violating individuals' privacy, compromising the intellectual property of the owner of the machine learning model. As far as concerned, researchers have studied and analyzed in depth several types of inference attacks, albeit in isolation, but there's still a lack of a holistic rick assessment of inference attacks against machine learning models, such as their application in different scenarios, the common factors affecting the performance of these attacks and the relationship among the attacks. As a result, this paper performs a holistic risk assessment of different inference attacks against Machine Learning models. This paper focuses on three kinds of representative attacks: membership inference attack, attribute inference attack and model stealing attack. And a threat model taxonomy is established. A total of 12 target models using three model architectures, including AlexNet, ResNet18 and Simple CNN, are trained on four datasets, namely CelebA, UTKFace, STL10 and FMNIST. Membership inference attack, attribute attack and model stealing attack are executed against these target models under different threat models respectively, and the performance of inference attacks is evaluated with attack accuracy as an indicator, which demonstrates that the complexity of the training dataset and overfitting level of the target models have a significant impact on the performance of inference attacks, while the effectiveness of the model stealing attack is negatively correlated with the membership inference attack.