Practical Bayes-Optimal Membership Inference Attacks

2025-05-30

AI Summary

This work addresses membership inference attacks (MIAs) on both image and graph-structured data, proposing the first Bayesian-optimal unified framework. For the open problem of node-level MIA under graph neural networks (GNNs)—where data are not i.i.d.—we derive, for the first time, the theoretically optimal decision rule and design two lightweight, efficient algorithms: BASE (for non-graph data) and G-BASE (tailored to graph data). Theoretically, we establish the first Bayesian optimality foundation for node-level MIA on graph data, revealing that RMIA is a special case and thereby endowing it with rigorous theoretical justification. Methodologically, our approach integrates likelihood ratio testing, gradient/output confidence estimation, and Monte Carlo optimization. Experiments demonstrate that G-BASE significantly outperforms existing node-level MIA methods on graph benchmarks, while BASE matches or exceeds LiRA and RMIA on image data—achieving comparable accuracy with substantially reduced computational overhead.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Reasoning under Uncertainty: Graphical Models
• Constraint Satisfaction and Optimization: Other Foundations of Constraint Satisfaction

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

We develop practical and theoretically grounded membership inference attacks (MIAs) against both independent and identically distributed (i.i.d.) data and graph-structured data. Building on the Bayesian decision-theoretic framework of Sablayrolles et al., we derive the Bayes-optimal membership inference rule for node-level MIAs against graph neural networks, addressing key open questions about optimal query strategies in the graph setting. We introduce BASE and G-BASE, computationally efficient approximations of the Bayes-optimal attack. G-BASE achieves superior performance compared to previously proposed classifier-based node-level MIA attacks. BASE, which is also applicable to non-graph data, matches or exceeds the performance of prior state-of-the-art MIAs, such as LiRA and RMIA, at a significantly lower computational cost. Finally, we show that BASE and RMIA are equivalent under a specific hyperparameter setting, providing a principled, Bayes-optimal justification for the RMIA attack.

Problem

• Develop practical membership inference attacks for i.i.d. and graph data
• Derive Bayes-optimal inference rule for node-level attacks on graph neural networks
• Introduce efficient BASE and G-BASE attacks outperforming prior methods

Innovation

• Bayes-optimal membership inference rule
• BASE and G-BASE efficient approximations
• Equivalent to RMIA under specific setting