Attribute inference attack and shadow model improvements #2006

abigailgold · 2023-01-26T17:16:35Z

Description

Support for categorical non-numeric (i.e. string) features as well as continuous features.

Fixes #1983
Fixes #1543

Type of change

Improvement (non-breaking)
Bug fix (non-breaking)
New feature (non-breaking)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

Testing

New test cases to check both continuous and string features.

Test Configuration:

OS: MacOS 12.6.2 (M1)
Python version: 3.9

Checklist

My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes

…ributeInferenceBaseline attack Signed-off-by: abigailt <abigailt@il.ibm.com>

Signed-off-by: abigailt <abigailt@il.ibm.com>

…uteInferenceBaselineTrueLabel Signed-off-by: abigailt <abigailt@il.ibm.com>

codecov-commenter · 2023-01-26T17:37:20Z

Codecov Report

Merging #2006 (9e0277a) into dev_1.14.0 (dc64e4c) will increase coverage by 3.22%.
The diff coverage is 89.74%.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@              Coverage Diff               @@
##           dev_1.14.0    #2006      +/-   ##
==============================================
+ Coverage       82.32%   85.54%   +3.22%     
==============================================
  Files             291      291              
  Lines           25464    25564     +100     
  Branches         4590     4621      +31     
==============================================
+ Hits            20963    21870     +907     
+ Misses           3353     2530     -823     
- Partials         1148     1164      +16

Impacted Files	Coverage Δ
art/estimators/classification/scikitlearn.py	`90.66% <ø> (+23.55%)`	⬆️
.../attacks/inference/attribute_inference/baseline.py	`88.54% <87.93%> (+43.38%)`	⬆️
...ference/attribute_inference/true_label_baseline.py	`83.18% <87.93%> (+46.93%)`	⬆️
...attacks/inference/attribute_inference/black_box.py	`84.02% <89.28%> (+45.97%)`	⬆️
art/attacks/attack.py	`92.59% <100.00%> (+0.59%)`	⬆️
...acks/inference/attribute_inference/meminf_based.py	`86.48% <100.00%> (+29.52%)`	⬆️
...nce/attribute_inference/white_box_decision_tree.py	`92.85% <100.00%> (+60.29%)`	⬆️
...ute_inference/white_box_lifestyle_decision_tree.py	`100.00% <100.00%> (+63.63%)`	⬆️
...ks/inference/membership_inference/shadow_models.py	`93.96% <100.00%> (+81.03%)`	⬆️
art/utils.py	`73.41% <100.00%> (+5.69%)`	⬆️
... and 24 more

Signed-off-by: abigailt <abigailt@il.ibm.com>

beat-buesser · 2023-02-08T17:05:50Z

tests/attacks/inference/attribute_inference/test_white_box_decision_tree.py

@@ -59,9 +59,10 @@ def test_white_box(art_warning, decision_tree_estimator, get_iris_dataset):
        art_warning(e)


-def test_check_params(art_warning, image_dl_estimator_for_attack):
+@pytest.mark.skip_framework("dl_frameworks")


Why do deep learning frameworks get excluded?

This attack only works on decision trees (it's a whitebox attack).

beat-buesser · 2023-02-08T17:06:05Z

tests/attacks/inference/attribute_inference/test_white_box_lifestyle_decision_tree.py

@@ -116,9 +116,10 @@ def transform_feature(x):
        art_warning(e)


-def test_check_params(art_warning, image_dl_estimator_for_attack):
+@pytest.mark.skip_framework("dl_frameworks")


Similar as above, why do deep learning frameworks get excluded?

This attack only works on decision trees (it's a whitebox attack).

beat-buesser · 2023-02-08T17:18:58Z

art/attacks/inference/attribute_inference/meminf_based.py

-            raise ValueError("Attack feature must be either an integer or a slice object.")
-        if isinstance(self.attack_feature, int) and self.attack_feature < 0:
-            raise ValueError("Attack feature index must be positive.")
+        self._check_attack_feature(self.attack_feature)


Do all attribute inference attack have to call self._check_attack_feature? I'm wondering if we should generalize and autoamte it by moving it to super._check_params.

beat-buesser

Hi @abigailgold Looks great, the support for regression models should be very useful. I have added a few question, what do you think?

…ck_params() Signed-off-by: abigailt <abigailt@il.ibm.com>

beat-buesser

Hi @abigailgold Thank you very much! The changes look good to me.

abigailgold added 8 commits January 15, 2023 19:36

Initial implementation of categorical (string) feature support in Att…

515ec33

…ributeInferenceBaseline attack Signed-off-by: abigailt <abigailt@il.ibm.com>

Support for sklearn pipelines and non-numeric features in shadow models

2172635

Signed-off-by: abigailt <abigailt@il.ibm.com>

Typing and formatting

fbcb2a6

Signed-off-by: abigailt <abigailt@il.ibm.com>

Support for non-numeric features in AttributeInferenceBaselineTrueLabel

406747a

Signed-off-by: abigailt <abigailt@il.ibm.com>

Support for non-numeric features in AttributeInferenceBlackbox

732b592

Signed-off-by: abigailt <abigailt@il.ibm.com>

Formatting

e768b81

Signed-off-by: abigailt <abigailt@il.ibm.com>

Support continuous features in AttributeInferenceBlackBox

cf9fdd5

Signed-off-by: abigailt <abigailt@il.ibm.com>

Support continuous features for AttributeInferenceBaseline and Attrib…

c605081

…uteInferenceBaselineTrueLabel Signed-off-by: abigailt <abigailt@il.ibm.com>

beat-buesser self-requested a review January 26, 2023 18:41

beat-buesser self-assigned this Jan 26, 2023

beat-buesser added the improvement Improve implementation label Jan 26, 2023

beat-buesser added this to the ART 1.14.0 milestone Jan 26, 2023

beat-buesser linked an issue Jan 26, 2023 that may be closed by this pull request

Support categorical (string) features in attribute inference attacks #1983

Closed

abigailgold added 11 commits January 29, 2023 11:12

Fix tests + warnings

44e3613

Signed-off-by: abigailt <abigailt@il.ibm.com>

Formatting

cd15e9a

Signed-off-by: abigailt <abigailt@il.ibm.com>

Fix test

4982ee8

Signed-off-by: abigailt <abigailt@il.ibm.com>

Improve documentation of new params

85bfabb

Signed-off-by: abigailt <abigailt@il.ibm.com>

Fix param and tests

f1994a9

Signed-off-by: abigailt <abigailt@il.ibm.com>

Remove attacked feature from list of non-numeric features

70a10d2

Signed-off-by: abigailt <abigailt@il.ibm.com>

Skip tests for dl frameworks

bb73ce0

Signed-off-by: abigailt <abigailt@il.ibm.com>

Fix mypy errors

95a92c2

Signed-off-by: abigailt <abigailt@il.ibm.com>

Fix tests + formatting

4d2971b

Signed-off-by: abigailt <abigailt@il.ibm.com>

Formatting

7d50684

Signed-off-by: abigailt <abigailt@il.ibm.com>

Fix assert

16011f4

Signed-off-by: abigailt <abigailt@il.ibm.com>

beat-buesser reviewed Feb 8, 2023

View reviewed changes

beat-buesser requested changes Feb 8, 2023

View reviewed changes

abigailgold and others added 2 commits February 9, 2023 14:38

Move call to _check_attack_feature() to AttributeInferenceAttack._che…

147ac5b

…ck_params() Signed-off-by: abigailt <abigailt@il.ibm.com>

Merge branch 'dev_1.14.0' into dev_1.14.0_attribute_improvements

9e0277a

beat-buesser approved these changes Feb 27, 2023

View reviewed changes

beat-buesser merged commit e73c1e9 into Trusted-AI:dev_1.14.0 Feb 27, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Attribute inference attack and shadow model improvements #2006

Attribute inference attack and shadow model improvements #2006

abigailgold commented Jan 26, 2023 •

edited

Loading

codecov-commenter commented Jan 26, 2023 •

edited

Loading

beat-buesser Feb 8, 2023

abigailgold Feb 9, 2023

beat-buesser Feb 8, 2023

abigailgold Feb 9, 2023

beat-buesser Feb 8, 2023

abigailgold Feb 9, 2023

beat-buesser left a comment

beat-buesser left a comment

Attribute inference attack and shadow model improvements #2006

Attribute inference attack and shadow model improvements #2006

Conversation

abigailgold commented Jan 26, 2023 • edited Loading

Description

Type of change

Testing

Checklist

codecov-commenter commented Jan 26, 2023 • edited Loading

Codecov Report

beat-buesser Feb 8, 2023

Choose a reason for hiding this comment

abigailgold Feb 9, 2023

Choose a reason for hiding this comment

beat-buesser Feb 8, 2023

Choose a reason for hiding this comment

abigailgold Feb 9, 2023

Choose a reason for hiding this comment

beat-buesser Feb 8, 2023

Choose a reason for hiding this comment

abigailgold Feb 9, 2023

Choose a reason for hiding this comment

beat-buesser left a comment

Choose a reason for hiding this comment

beat-buesser left a comment

Choose a reason for hiding this comment

abigailgold commented Jan 26, 2023 •

edited

Loading

codecov-commenter commented Jan 26, 2023 •

edited

Loading