Inference Attacks: A Taxonomy, Survey, and Promising Directions
Not on the map. Why?
Abstract (arXiv)
The prosperity of machine learning has also brought people's concerns about data privacy. Among them, inference attacks can implement privacy breaches in various MLaaS scenarios and model training/prediction phases. Specifically, inference attacks can perform privacy inference on undisclosed target training sets based on outputs of the target model, including but not limited to statistics, membership, semantics, data representation, etc. For instance, infer whether the target data has the characteristics of AIDS. In addition, the rapid development of the machine learning community in recent years, especially the surge of model types and application scenarios, has further stimulated the inference attacks' research. Thus, studying inference attacks and analyzing them in depth is urgent and significant. However, there is still a gap in the systematic discussion of inference attacks from taxonomy, global perspective, attack, and defense perspectives. This survey provides an in-depth and comprehensive inference of attacks and corresponding countermeasures in ML-as-a-service based on taxonomy and the latest researches. Without compromising researchers' intuition, we first propose the 3MP taxonomy based on the community research status, trying to normalize the confusing naming system of inference attacks. Also, we analyze the pros and cons of each type of inference attack, their workflow, countermeasure, and how they interact with other attacks. In the end, we point out several promising directions for researchers from a more comprehensive and novel perspective.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 111 of its 203 references that are in the map. First posted on arXiv 4 Jun 2024.
Builds on
111 of 203 references.
References · 111
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2017Inductive Representation Learning on Large Graphscited by 6,284
- 2022Generative Adversarial Networkscited by 5,603
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2016Deep Learning with Differential Privacycited by 2,682
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2015Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networkscited by 2,048
- 2017Deep Setscited by 1,394
- 2019Deep Leakage from Gradientscited by 1,004
38 more
- 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
- 2021Membership Inference Attacks From First Principlescited by 839
- 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
- 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
- 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
- 2019Modeling Tabular data using Conditional GANcited by 695
- 2016Stealing Machine Learning Models via Prediction APIscited by 602
- 2019Certified Data Removal from Machine Learning Modelscited by 512
- 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
- 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
- 2015Autoencoding beyond pixels using a learned similarity metriccited by 407
- 2020Label-Only Membership Inference Attackscited by 371
- 2020iDLG: Improved Deep Leakage from Gradientscited by 367
- 2016Semi-supervised Knowledge Transfer for Deep Learning from Private Training Datacited by 347
- 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 326
- 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
- 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
- 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
- 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
- 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
- 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 241
- 2020Information Leakage in Embedding Modelscited by 199
- 2017Generating Multi-label Discrete Patient Records using Generative Adversarial Networkscited by 197
- 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
- 2020When Machine Unlearning Jeopardizes Privacycited by 181
- 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
- 2020Threats to Federated Learning: A Surveycited by 171
- 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
- 2017Machine Learning Models that Remember Too Muchcited by 165
- 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
- 2020Membership Leakage in Label-Only Exposurescited by 156
- 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
- 2019Privacy Risks of Securing Machine Learning Models against Adversarial Examplescited by 136
- 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
- 2013Hacking Smart Machines with Smarter Ones: How to Extract Meaningful Data from Machine Learning Classifierscited by 128
- 2021The Distributed Discrete Gaussian Mechanism for Federated Learning with Secure Aggregationcited by 127
- 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
- 2019Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learningcited by 117
50 most cited of 111 All 111 (JSON)
Built on by
Citing papers per year: 2025: 2.
2 papers.