paper for implementation of blackbox attribute inference attack

[SlokomManel]

Hi,

Thank you for the implementation of the toolbox.
I am interested in using black-box attribute inference attack model blackbox model . But I have difficulty in understanding how it works and how to use the implementation in my case. I am wondering if this just attribute inference attack or model inversion attribute inference attack since it makes use of predicted labels from a model and values (marginals).

Could you please share with me the reference?

looking forward to hearing back from you.
Thank you.
Bests,
Manel.

[beat-buesser]

Hi @SlokomManel Thank you for using ART! @abigailgold What do you think?

[abigailgold]

Hi @SlokomManel I'm not sure I understand the distinction you're making between attribute inference attack and model inversion attribute inference attack. The idea is to use n-1 features along with the model's output to predict the value of a missing feature. It is the same kind of attack as in https://dl.acm.org/doi/10.1145/2810103.2813677 but with a different implementation which is more similar to the black-box inference attack of Shokri et al (https://arxiv.org/abs/1610.05820).
If you have any specific questions about how to use it you're welcome to ask. There is also a notebook available: https://github.com/Trusted-AI/adversarial-robustness-toolbox/blob/main/notebooks/attack_attribute_inference.ipynb

Hope this helps.

[SlokomManel]

Hi,
Thank you so much for your reply.
I am actually looking at the code of blackbox attribute inference in https://github.com/Trusted-AI/adversarial-robustness-toolbox/blob/main/art/attacks/inference/attribute_inference/black_box.py .

In line 327, we have "predictions = np.array([self._values[np.argmax(arr)] for arr in predictions])".
Values is a vector with target attribute (to be attacked) classes sorted in ascending order. Predictions are the output predictions of the classifier.
I am not able to get what sort of aggregation or combination function that is used here. It looks like the success of inference here heavily depends on the "values" vector. I was not able to find in literature how this combination of values vector and predictions vector is done.

Thank you,
Bests.

[abigailgold]

In this line, predictions is actually the output of the attack. So these are the attack model's predicted values for the attacked feature (not the predictions of the original/attacked/target model).
The values vector is just used to translate those predictions back to the original values (if they are different from just 0, 1, 2, etc.). So as a simple example, let's assume the attacked feature has three possible values: -1, 0 and 1. The attack model will output those as 0, 1, 2 (sequential labels starting at 0). But if you supply a values vector of [-1, 0, 1], then in the output of the attack, 0 will be translated to -1, 1 to 0 and 2 to 1 so that you get back values in the original domain of the feature.

[SlokomManel]

But remember that the vector values are required to be sorted in ascending order such that -1 class is less appearing then, 0, then 1 is the most appearing. How would this impact the success of inference? Why should we impose a specific order?

[abigailgold]

Ascending order of the values themselves. Not their frequency.

[SlokomManel]

Right. So if we go back to this example :
values = [-1, 0, 1] # ascending order
predictions = [0,0,1]
This means that the final prediction will be class "1".

But if values = [1, -1, 0], the final prediction will change. So there is a sort of link/connection between values and prediction. At the end, let's assume we have three categories in the target attribute: c1, c2, c3. if there are the same naming of classes in the prediction vector returned by the attacker classifier and values vector. But the only difference is that values vector has a different order. Classifier is trained to say for a specific user, the inferred class is c2 but if we use values vector it becomes c3.

Sorry that i am trying to reformulate this multiple times in different ways but my main concern is about "the shift in prediction of classifier". Does it make sense to you?

[abigailgold]

If you look at the code in the fit() method, the attacked feature is always one-hot-encoded after applying one of the methods float_to_categorical or floats_to_one_hot. Both of these methods sort the unique values in the data in ascending order before one-hot encoding them. So if 'values' is always sent in ascending order of the values, these two will match and you will get the correct prediction. This is exactly why it is required to send them in ascending order.