GLiRA: Closed-Box Membership Inference Attack via Knowledge Distillation

While Deep Neural Networks demonstrate remarkable performance in practical tasks, they are vulnerable to membership inference attacks aimed at identifying whether a certain object belongs to the training dataset. To conduct a membership inference attack on a target model, an adversary has to train a set of shadow models and conduct a statistical test to determine the membership status of the particular input object. Usually, shadow models are trained without taking into account the target model; we argue that utilizing the predictions of the target model can guide the training process of the shadow model. To improve the efficiency of shadow model-based membership inference attacks, we propose GLiRA, a knowledge distillation-guided approach to membership inference attacks. We observe that the knowledge distillation significantly improves the efficiency of a likelihood ratio membership inference attack when the architecture of the target model is both known and unknown to an attacker. We evaluate the proposed method across multiple image classification datasets and model architectures and demonstrate that knowledge distillation-guided likelihood ratio attack outperforms the current state-of-the-art membership inference attacks in the majority of experimental settings.