We propose a novel and practical privacy notion called $f$-Membership Inference Privacy ($f$-MIP), which explicitly considers the capabilities of realistic adversaries under the membership inference attack threat model. Consequently, $f$-MIP offers interpretable privacy guarantees and improved utility (e.g., better classification accuracy). In particular, we derive a parametric family of $f$-MIP guarantees that we refer to as $\mu$-Gaussian Membership Inference Privacy ($\mu$-GMIP) by theoretically analyzing likelihood ratio-based membership inference attacks on stochastic gradient descent (SGD). Our analysis highlights that models trained with standard SGD already offer an elementary level of MIP. Additionally, we show how $f$-MIP can be amplified by adding noise to gradient updates. Our analysis further yields an analytical membership inference attack that offers two distinct advantages over previous approaches. First, unlike existing state-of-the-art attacks that require training hundreds of shadow models, our attack does not require any shadow model. Second, our analytical attack enables straightforward auditing of our privacy notion $f$-MIP. Finally, we quantify how various hyperparameters (e.g., batch size, number of model parameters) and specific data characteristics determine an attacker's ability to accurately infer a point's membership in the training set. We demonstrate the effectiveness of our method on models trained on vision and tabular datasets.

翻译：我们提出了一种新颖且实用的隐私概念，称为$f$-成员推断隐私（$f$-MIP），该概念明确考虑了在成员推断攻击威胁模型下现实对手的能力。由此，$f$-MIP提供了可解释的隐私保证并提升了实用性（例如更好的分类准确率）。具体而言，我们通过对随机梯度下降（SGD）上基于似然比的成员推断攻击进行理论分析，推导出一个参数化的$f$-MIP保证族，即$\mu$-高斯成员推断隐私（$\mu$-GMIP）。我们的分析表明，使用标准SGD训练的模型已具备基础的MIP水平。此外，我们还展示了如何通过向梯度更新添加噪声来增强$f$-MIP。进一步的分析得出了一种解析式成员推断攻击方法，该方法相比先前方法具有两个显著优势：第一，现有最先进的攻击需要训练数百个影子模型，而我们的攻击无需任何影子模型；第二，我们的解析攻击能够直接对我们的隐私概念$f$-MIP进行审计。最后，我们量化了各种超参数（如批次大小、模型参数数量）及特定数据特征如何决定攻击者准确推断训练集中数据点成员身份的能力。我们在基于视觉和表格数据集训练的模型上验证了本方法的有效性。