Membership Inference Attacks (MIAs) are currently a dominant approach for evaluating privacy in machine learning applications. Despite their significance in identifying records belonging to the training dataset, several concerns remain unexplored, particularly with regard to tabular data. In this paper, first, we provide an extensive review and analysis of MIAs considering two main learning paradigms: centralized and federated learning. We extend and refine the taxonomy for both. Second, we demonstrate the efficacy of MIAs in tabular data using several attack strategies, also including defenses. Furthermore, in a federated learning scenario, we consider the threat posed by an outsider adversary, which is often neglected. Third, we demonstrate the high vulnerability of single-outs (records with a unique signature) to MIAs. Lastly, we explore how MIAs transfer across model architectures. Our results point towards a general poor performance of these attacks in tabular data which contrasts with previous state-of-the-art. Notably, even attacks with limited attack performance can still successfully expose a large portion of single-outs. Moreover, our findings suggest that using different surrogate models makes MIAs more effective.

翻译：成员推断攻击（MIAs）当前是评估机器学习应用隐私性的主流方法。尽管其在识别属于训练数据集的记录方面具有重要意义，但若干问题仍未得到充分探索，特别是在表格数据领域。本文首先对MIAs进行了全面综述与分析，涵盖两种主要学习范式：集中式学习与联邦学习。我们扩展并完善了二者的分类体系。其次，我们通过多种攻击策略（包括防御措施）展示了MIAs在表格数据中的有效性。此外，在联邦学习场景中，我们考虑了常被忽视的外部攻击者威胁。第三，我们证明了具有唯一特征的单一样本对MIAs的高度脆弱性。最后，我们探究了MIAs在不同模型架构间的迁移性。我们的结果表明，这些攻击在表格数据中普遍表现不佳，这与先前最先进的研究形成对比。值得注意的是，即使是攻击性能有限的攻击仍能成功暴露大量单一样本。此外，我们的研究结果表明，使用不同的代理模型可提升MIAs的有效性。