Modern AI models are not static. They go through multiple updates in their lifecycles. Thus, exploiting the model dynamics to create stronger Membership Inference (MI) attacks and tighter privacy audits are timely questions. Though the literature empirically shows that using a sequence of model updates can increase the power of MI attacks, rigorous analysis of the `optimal' MI attacks is limited to static models with infinite samples. Hence, we develop an `optimal' MI attack, SeMI*, that uses the sequence of model updates to identify the presence of a target inserted at a certain update step. For the empirical mean computation, we derive the optimal power of SeMI*, while accessing a finite number of samples with or without privacy. Our results retrieve the existing asymptotic analysis. We observe that having access to the model sequence avoids the dilution of MI signals unlike the existing attacks on the final model, where the MI signal vanishes as training data accumulates. Furthermore, an adversary can use SeMI* to tune both the insertion time and the canary to yield tighter privacy audits. Finally, we conduct experiments across data distributions and models trained or fine-tuned with DP-SGD demonstrating that practical variants of SeMI* lead to tighter privacy audits than the baselines.

翻译：现代AI模型并非静态存在。在其生命周期中，它们会经历多次更新。因此，如何利用模型动态性构建更强大的成员推断（MI）攻击并实施更严格的隐私审计，已成为亟待解决的问题。尽管现有研究通过实证表明，利用模型更新序列可增强MI攻击能力，但对"最优"MI攻击的严格分析目前仅限于具有无限样本的静态模型。为此，我们开发了一种"最优"MI攻击方法SeMI*，该方法利用模型更新序列来检测在特定更新步骤中插入的目标数据是否存在。针对经验均值计算，我们推导出SeMI*在访问有限数量样本（无论是否包含隐私保护机制）时的最优攻击效能。我们的研究结果与现有渐近分析结论一致。研究发现，与现有仅针对最终模型的攻击方法（其MI信号会随着训练数据积累而逐渐消失）不同，获取模型序列可避免MI信号的稀释效应。此外，攻击者可通过SeMI*同时调整数据插入时间和测试样本，从而实施更严格的隐私审计。最后，我们在多种数据分布和模型（包括使用DP-SGD训练或微调的模型）上进行实验，结果表明SeMI*的实际变体相较于基线方法能实现更严格的隐私审计。