English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Membership Inference attacks (MIAs) aim to predict whether a data sample waspresent in the training data of a machine learning model or not, and are widelyused for assessing the privacy risks of language models. Most existing attacksrely on the observation that models tend to assign higher probabilities totheir training samples than non-training points. However, simple thresholdingof the model score in isolation tends to lead to high false-positive rates asit does not account for the intrinsic complexity of a sample. Recent work hasdemonstrated that reference-based attacks which compare model scores to thoseobtained from a reference model trained on similar data can substantiallyimprove the performance of MIAs. However, in order to train reference models,attacks of this kind make the strong and arguably unrealistic assumption thatan adversary has access to samples closely resembling the original trainingdata. Therefore, we investigate their performance in more realistic scenariosand find that they are highly fragile in relation to the data distribution usedto train reference models. To investigate whether this fragility provides alayer of safety, we propose and evaluate neighbourhood attacks, which comparemodel scores for a given sample to scores of synthetically generated neighbourtexts and therefore eliminate the need for access to the training datadistribution. We show that, in addition to being competitive withreference-based attacks that have perfect knowledge about the training datadistribution, our attack clearly outperforms existing reference-free attacks aswell as reference-based attacks with imperfect knowledge, which demonstratesthe need for a reevaluation of the threat model of adversarial attacks.

Membership Inference Attacks against Language Models via Neighbourhood Comparison