Transfer learning is a popular method for tuning pretrained (upstream) models for different downstream tasks using limited data and computational resources. We study how an adversary with control over an upstream model used in transfer learning can conduct property inference attacks on a victim's tuned downstream model. For example, to infer the presence of images of a specific individual in the downstream training set. We demonstrate attacks in which an adversary can manipulate the upstream model to conduct highly effective and specific property inference attacks (AUC score $> 0.9$), without incurring significant performance loss on the main task. The main idea of the manipulation is to make the upstream model generate activations (intermediate features) with different distributions for samples with and without a target property, thus enabling the adversary to distinguish easily between downstream models trained with and without training examples that have the target property. Our code is available at https://github.com/yulongt23/Transfer-Inference.

翻译：迁移学习是一种利用有限数据和计算资源，将预训练（上游）模型调整至不同下游任务的流行方法。我们研究了在迁移学习中，控制上游模型的 adversary（对手）如何对受害者的微调下游模型实施属性推断攻击，例如推断下游训练集中是否存在某个特定个体的图像。我们展示了攻击方法，其中 adversary 可通过操控上游模型，执行高效且针对性极强的属性推断攻击（AUC 分数 > 0.9），同时不会在主任务上造成显著性能损失。操控的核心思路是使上游模型针对包含与不包含目标属性的样本生成具有不同分布的激活值（中间特征），从而让 adversary 能够轻松区分下游模型是否使用具有目标属性的训练样本进行训练。我们的代码已公开于 https://github.com/yulongt23/Transfer-Inference。