We introduce One-Shot Label-Only (OSLO) membership inference attacks (MIAs), which accurately infer a given sample's membership in a target model's training set with high precision using just \emph{a single query}, where the target model only returns the predicted hard label. This is in contrast to state-of-the-art label-only attacks which require $\sim6000$ queries, yet get attack precisions lower than OSLO's. OSLO leverages transfer-based black-box adversarial attacks. The core idea is that a member sample exhibits more resistance to adversarial perturbations than a non-member. We compare OSLO against state-of-the-art label-only attacks and demonstrate that, despite requiring only one query, our method significantly outperforms previous attacks in terms of precision and true positive rate (TPR) under the same false positive rates (FPR). For example, compared to previous label-only MIAs, OSLO achieves a TPR that is 7$\times$ to 28$\times$ stronger under a 0.1\% FPR on CIFAR10 for a ResNet model. We evaluated multiple defense mechanisms against OSLO.

翻译：我们提出了单次查询仅标签（OSLO）成员推理攻击（MIAs），该方法仅通过*单次查询*，即可高精度地推断给定样本是否属于目标模型的训练集，而目标模型仅返回预测的硬标签。这与当前最先进的仅标签攻击形成鲜明对比，后者需要约6000次查询，但其攻击精度却低于OSLO。OSLO利用了基于迁移的黑盒对抗攻击。其核心思想是：成员样本比非成员样本表现出更强的对抗扰动抵抗性。我们将OSLO与当前最先进的仅标签攻击进行了比较，结果表明，尽管仅需一次查询，我们的方法在相同误报率（FPR）下的精度和真正例率（TPR）方面均显著优于先前的攻击。例如，在CIFAR10数据集上针对ResNet模型，在0.1%的FPR下，与先前的仅标签MIAs相比，OSLO实现的TPR强出7倍至28倍。我们评估了多种针对OSLO的防御机制。