Embedding Attack Project (Work Report)
Jiameng Pu Zafar Takhirov
This report summarizes all the MIA experiments (Membership Inference Attacks)
of the Embedding Attack Project, including threat models, experimental setup,
experimental results, findings and discussion. Current results cover the
evaluation of two main MIA strategies (loss-based and embedding-based MIAs) on
6 AI models ranging from Computer Vision to Language Modelling. There are two
ongoing experiments on MIA defense and neighborhood-comparison embedding
attacks. These are ongoing projects.
  The current work on MIA and PIA can be summarized into six conclusions: (1)
Amount of overfitting is directly proportional to model's vulnerability; (2)
early embedding layers in the model are less susceptible to privacy leaks; (3)
Deeper model layers contain more membership information; (4) Models are more
vulnerable to MIA if both embeddings and corresponding training labels are
compromised; (5) it is possible to use pseudo-labels to increase the MIA
success; and (6) although MIA and PIA success rates are proportional, reducing
the MIA does not necessarily reduce the PIA.