Membership Information Leakage in Well-Generalized Auto Speech Recognition Systems

Membership inference attack (MIA) attempts to determine whether a particular data sample has participated in the training process of the target model, and is regarded as basic form of privacy breach in machine learning. This paper provides a label-only membership inference attack to well-generalized automatic speech recognition (ASR) systems, while only being granted black-box access permissions for the target system. Initially, we develop shadow models as substitution of the target ASR model. Subsequently, data augmentation techniques are employed to generate additional speech samples for the member and non-member sets elements of the shadow models. These augmentation techniques include modifying speech speed, cropping, adding noise, and so on. We query the shadow models with all the samples above, and we can derive a series of features from the model's output. All the features and their corresponding membership labels are then utilized to train an audit model. This audit model will be used to judge the membership of a given sample. The experimental results indicate that the performance metrics of this attack are significantly higher when the adversary has knowledge about the data distribution of target model's training set and the target model's architecture. However, if the adversary is lack of this knowledge, the probability of successful MIA is comparable to random guessing. The main contribution is that we investigate the membership leakage in well-generalized auto speech recognition system, and propose a data augmentation-based membership inference attack. We also discuss the transferability of the proposed scheme under various attack uncertainty.