Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

\texttt{ReproMIA}: A Comprehensive Analysis of Model Reprogramming for Proactive Membership Inference Attacks

Chihan Huang, Huaijin Wang, Shuai Wang

Abstract

The pervasive deployment of deep learning models across critical domains has concurrently intensified privacy concerns due to their inherent propensity for data memorization. While Membership Inference Attacks (MIAs) serve as the gold standard for auditing these privacy vulnerabilities, conventional MIA paradigms are increasingly constrained by the prohibitive computational costs of shadow model training and a precipitous performance degradation under low False Positive Rate constraints. To overcome these challenges, we introduce a novel perspective by leveraging the principles of model reprogramming as an active signal amplifier for privacy leakage. Building upon this insight, we present \texttt{ReproMIA}, a unified and efficient proactive framework for membership inference. We rigorously substantiate, both theoretically and empirically, how our methodology proactively induces and magnifies latent privacy footprints embedded within the model's representations. We provide specialized instantiations of \texttt{ReproMIA} across diverse architectural paradigms, including LLMs, Diffusion Models, and Classification Models. Comprehensive experimental evaluations across more than ten benchmarks and a variety of model architectures demonstrate that \texttt{ReproMIA} consistently and substantially outperforms existing state-of-the-art baselines, achieving a transformative leap in performance specifically within low-FPR regimes, such as an average of 5.25\% AUC and 10.68\% TPR@1\%FPR increase over the runner-up for LLMs, as well as 3.70\% and 12.40\% respectively for Diffusion Models.

\texttt{ReproMIA}: A Comprehensive Analysis of Model Reprogramming for Proactive Membership Inference Attacks

Abstract

The pervasive deployment of deep learning models across critical domains has concurrently intensified privacy concerns due to their inherent propensity for data memorization. While Membership Inference Attacks (MIAs) serve as the gold standard for auditing these privacy vulnerabilities, conventional MIA paradigms are increasingly constrained by the prohibitive computational costs of shadow model training and a precipitous performance degradation under low False Positive Rate constraints. To overcome these challenges, we introduce a novel perspective by leveraging the principles of model reprogramming as an active signal amplifier for privacy leakage. Building upon this insight, we present \texttt{ReproMIA}, a unified and efficient proactive framework for membership inference. We rigorously substantiate, both theoretically and empirically, how our methodology proactively induces and magnifies latent privacy footprints embedded within the model's representations. We provide specialized instantiations of \texttt{ReproMIA} across diverse architectural paradigms, including LLMs, Diffusion Models, and Classification Models. Comprehensive experimental evaluations across more than ten benchmarks and a variety of model architectures demonstrate that \texttt{ReproMIA} consistently and substantially outperforms existing state-of-the-art baselines, achieving a transformative leap in performance specifically within low-FPR regimes, such as an average of 5.25\% AUC and 10.68\% TPR@1\%FPR increase over the runner-up for LLMs, as well as 3.70\% and 12.40\% respectively for Diffusion Models.

Paper Structure

This paper contains 66 sections, 6 theorems, 41 equations, 8 figures, 17 tables.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Model Reprogramming
  4. Model Reprogramming Definition
  5. Model Reprogramming Example
  6. Membership Inference Attacks
  7. Metrics for MIA
  8. Threat Model
  9. Attacker's Objective
  10. Attacker's Capabilities
  11. Theoretical Foundation
  12. Overall Framework
  13. Core Hypothesis
  14. Loss Landscape Curvature
  15. Empirical Validation
  16. ...and 51 more sections

Key Result

Proposition 1

Let $\mathcal{M}_\theta$ be a model with an overfitting ratio $\rho=\mathcal{L}_{test}/\mathcal{L}_{train} > 1$. Under moderate regularity conditions of the loss function, the spectral gap between the Hessians of members and non-members satisfies:

Figures (8)

  • Figure 1: An example of the process of reprogramming an Inception V3 ImageNet model as an MNIST classifier, referred from elsayed2018-adversarial.
  • Figure 2: The overall framework of our ReproMIA, which includes the difference between it and the traditional MIA methods, and the process of our theoretical overview.
  • Figure 3: The loss difference with and without model reprogramming on different target models.
  • Figure 4: The separation scores with and without model reprogramming on LLaMA-30B.
  • Figure 5: The log-scaled ROC curves of different methods on different datasets.
  • ...and 3 more figures

Theorems & Definitions (10)

  • Proposition 1
  • Proposition 2
  • Lemma 1: Hessian matrix decomposition
  • Proposition : 1. Spectral Gap of Hessian Eigenvalues
  • Remark 1: Practical Validity of Assumption A2
  • Remark 2: Practical Validity of Assumption A4
  • Proposition : Non-Member Stream Dominance
  • Remark 4
  • Proposition : 2. Mutual Information Improvement
  • Remark 6: Practical Validity of Assumption A2