MIA metric reference

[AwesomeLemon]

Hi,

I'm curious about the Membership Inference Attack metric. Are you basing the MIA on any reference?

The relevant subsection in the appendix of your paper cites (https://academic.oup.com/jamiaopen/article/5/4/ooac083/6758492) but I do not immediately see that they used the same procedure you use (e.g., they seem to focus on F1 while you recommend recall).

I'd appreciate any clarification.

[THyrup]

Hi,

Thank you for your question. I understand the confusion. The cited paper implements one variation of membership inference attacks (MIAs), but numerous similar approaches can be found in the literature. The implementation in SynthEval takes a slightly different approach compared to the cited paper. Specifically, SynthEval assumes a black-box scenario where an adversary has access only to synthetic data and some auxiliary data, which may or may not have been part of the training data. This is a common assumption for black-box MIAs.

It is important to note that the SynthEval implementation evaluates the adversarial model using the training data, but the adversarial model itself is not trained on it. This ensures that the evaluation reflects the re-identification risk associated with the synthetic data without giving the adversary any direct advantage from access to the original training data during their model training.

The effectiveness of the adversarial model is often reported using the F1 score. However, while F1 provides a balanced view of model performance, it tells little about the vulnerability of the training data. To better capture this aspect, recall has been reported in some cases as it measures the proportion of true members correctly identified. This can be roughly interpreted as a form of re-identification risk. Following a recent update, SynthEval now also returns precision by default. Precision, which measures the proportion of predicted memberships that are true members, can be seen as the adversary's confidence in their attack. In this context, the F1 score serves as an aggregate metric that balances re-identification risk and the adversary’s confidence.

I hope this clarifies your question.

[AwesomeLemon]

Thank you for the explanation.

A popular paper by Carlini et al (2022) provides good argumentation for reporting True Positive Rate at low FPR (0.1%) instead of the conventional metrics. I'm curious if you considered this approach?

I'm also wondering if you have done any empirical validation of your attack implementation?

Ref:

Carlini, Nicholas, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. 2022. “Membership Inference Attacks From First Principles.” In 2022 IEEE Symposium on Security and Privacy (SP), 1897–1914. https://doi.org/10.1109/SP46214.2022.9833649.