Assessing Membership Leakages via Task-Aligned Divergent Shadow Data Sets in Vehicular Road Cooperation

Deep classification models have been widely utilized in vehicular road cooperation. However, previous work indicates that deep classification models are vulnerable to the privacy risks of membership inference attacks (MIAs). Most existing work of MIAs is based on two different assumptions. One assumes adversary-own shadow data sets with aligned tasks and distributions as private data sets, while this assumption necessitates that the adversary knows the distributions of private data sets. The other assumes adversary-own shadow data sets with distinct tasks and distributions from private data sets, while this assumption requires that the adversary knows the classification boundary between members and nonmembers of the private data set. Hence, these two assumptions do not always hold in real-world scenarios. In this work, we systematically assess the impact of adversary-own shadow data sets with aligned tasks but distinct distributions from private data sets on MIAs. These realistic shadow data sets acknowledge adversaries’ limited insights into the data distribution of the private data set and the decision boundary between members and nonmembers. We divide these practical shadow data sets hosted by adversaries into four types: Data Noise, Label Noise, Imbalanced Data, and Cross-domain Data. We conduct extensive experiments with seven prevalent MIAs and four types of shadow data sets. Experimental results mainly reveal twofold findings. First, MIAs still maintain effectiveness using the shadow data set with the aligned task but distinct distribution from the private data set. Second, different levels of data distribution disparities manifest varying MIAs’ performances under certain types of shadow data sets.