Previous studies have developed fairness methods for biased models that exhibit discriminatory behaviors towards specific subgroups. While these models have shown promise in achieving fair predictions, recent research has identified their potential vulnerability to score-based membership inference attacks (MIAs). In these attacks, adversaries can infer whether a particular data sample was used during training by analyzing the model's prediction scores. However, our investigations reveal that these score-based MIAs are ineffective when targeting fairness-enhanced models in binary classifications. The attack models trained to launch the MIAs degrade into simplistic threshold models, resulting in lower attack performance. Meanwhile, we observe that fairness methods often lead to prediction performance degradation for the majority subgroups of the training data. This raises the barrier to successful attacks and widens the prediction gaps between member and non-member data. Building upon these insights, we propose an efficient MIA method against fairness-enhanced models based on fairness discrepancy results (FD-MIA). It leverages the difference in the predictions from both the original and fairness-enhanced models and exploits the observed prediction gaps as attack clues. We also explore potential strategies for mitigating privacy leakages. Extensive experiments validate our findings and demonstrate the efficacy of the proposed method.

翻译：先前研究已开发出针对存在特定子群歧视行为的偏置模型的公平性方法。尽管这些模型在实现公平预测方面展现出潜力，但近期研究发现其存在对基于分数的成员推断攻击（MIAs）的潜在脆弱性。在这类攻击中，攻击者可通过分析模型的预测分数推断特定数据样本是否被用于训练。然而，我们的研究表明，在针对二分类任务中的公平性增强模型时，这些基于分数的MIAs效果不彰。为发起攻击而训练的攻击模型退化为简单的阈值模型，导致攻击性能降低。同时，我们观察到公平性方法常导致训练数据中多数子群预测性能下降，这提高了成功攻击的门槛，并扩大了成员与非成员数据之间的预测差距。基于这些发现，我们提出一种针对公平性增强模型的高效成员推断攻击方法——基于公平性差异结果的FD-MIA。该方法利用原始模型与公平性增强模型预测结果的差异，并将观测到的预测差距作为攻击线索。我们还探索了减轻隐私泄露的潜在策略。大量实验验证了我们的发现，并证明了所提出方法的有效性。