What Really is a Member? Discrediting Membership Inference via Poisoning
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866912417328398336 |
|---|---|
| author | Mangaokar, Neal Hooda, Ashish Li, Zhuohang Malin, Bradley A. Fawaz, Kassem Jha, Somesh Prakash, Atul Chowdhury, Amrita Roy |
| author_facet | Mangaokar, Neal Hooda, Ashish Li, Zhuohang Malin, Bradley A. Fawaz, Kassem Jha, Somesh Prakash, Atul Chowdhury, Amrita Roy |
| contents | Membership inference tests aim to determine whether a particular data point was included in a language model's training set. However, recent works have shown that such tests often fail under the strict definition of membership based on exact matching, and have suggested relaxing this definition to include semantic neighbors as members as well. In this work, we show that membership inference tests are still unreliable under this relaxation - it is possible to poison the training dataset in a way that causes the test to produce incorrect predictions for a target point. We theoretically reveal a trade-off between a test's accuracy and its robustness to poisoning. We also present a concrete instantiation of this poisoning attack and empirically validate its effectiveness. Our results show that it can degrade the performance of existing tests to well below random. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2506_06003 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | What Really is a Member? Discrediting Membership Inference via Poisoning Mangaokar, Neal Hooda, Ashish Li, Zhuohang Malin, Bradley A. Fawaz, Kassem Jha, Somesh Prakash, Atul Chowdhury, Amrita Roy Machine Learning Cryptography and Security Membership inference tests aim to determine whether a particular data point was included in a language model's training set. However, recent works have shown that such tests often fail under the strict definition of membership based on exact matching, and have suggested relaxing this definition to include semantic neighbors as members as well. In this work, we show that membership inference tests are still unreliable under this relaxation - it is possible to poison the training dataset in a way that causes the test to produce incorrect predictions for a target point. We theoretically reveal a trade-off between a test's accuracy and its robustness to poisoning. We also present a concrete instantiation of this poisoning attack and empirically validate its effectiveness. Our results show that it can degrade the performance of existing tests to well below random. |
| title | What Really is a Member? Discrediting Membership Inference via Poisoning |
| topic | Machine Learning Cryptography and Security |
| url | https://arxiv.org/abs/2506.06003 |