| Author: | Bai, Li |
| Title: | Privacy vulnerabilities in machine learning : from inference attacks to risk assessment |
| Advisors: | Hu, Haibo (EEE) |
| Degree: | Ph.D. |
| Year: | 2026 |
| Department: | Department of Electrical and Electronic Engineering |
| Pages: | xiii, 127 pages : color illustrations |
| Language: | English |
| Abstract: | Machine learning (ML) has emerged as a fundamental driver of technological progress across diverse domains, powering accurate predictions and data-driven decision-making. However, as ML models are increasingly learned on sensitive data such as medical records and private images, concerns over data privacy have grown significantly. A growing body of research indicates that these models may inadvertently reveal information about their training data through inference attacks. Within this context, we investigate how membership and property inference attacks exploit model behaviors to leak sensitive information at both the sample and distribution levels, and subsequently propose a risk measure to evaluate privacy risks across different models. First, we improve the efficiency of shadow model-based inference attacks in an attack-agnostic manner. While shadow models are a common component in inference attacks, their reliance on training a large number of models incurs substantial computational overhead and limits their practicality. Such inefficiency mainly stems from the independent training and use of these shadow models. Regarding this problem, we present a novel shadow pool training framework, which constructs multiple shared models and trains them jointly within a single process. In particular, we leverage the Mixture-of-Experts mechanism as the shadow pool to interconnect individual models, enabling them to share sub-networks and improving efficiency. Secondly, we investigate a new attack surface in vertical federated learning (VFL), highlighting previously underexplored privacy leakage risks inherent to this setting. While various attacks, including label and feature inference, focus on record-level privacy risks in VFL, few studies delve into the distribution-level privacy threat. To fill this gap, we focus on a new attack scenario, where an adversarial party seeks to deduce global distribution information about a target property in the victim party's training set. Our key observation is that the Lp-norm distribution of intermediate results in VFL could reflect the fraction of the target property in a training set. Inspired by this, we present a novel property inference framework involving distribution comparison and correlation augmentation modules, which poses the immediate threat of property information leakage from private training data in VFL. Thirdly, we develop a theoretical measure to assess the membership privacy risk of ML models. Privacy leakage poses a critical risk when ML foundation models trained on private data are released. Rather than proposing new attack algorithms, our focus is on evaluating model vulnerability to membership leakage by introducing a novel measure from a comparative perspective. We calculate the difference in prediction loss for training examples relative to a predefined reference model, enabling risk comparison across models without needing to delve into details like training strategy, architecture, or data distribution. In summary, this thesis investigates and evaluates inference attacks in ML models, thereby shedding light on privacy risks and providing insights to guide the design of privacy-preserving models in future work. |
| Rights: | All rights reserved |
| Access: | open access |
Copyright Undertaking
As a bona fide Library user, I declare that:
- I will abide by the rules and legal ordinances governing copyright regarding the use of the Database.
- I will use the Database for the purpose of my research or private study only and not for circulation or further reproduction or any other purpose.
- I agree to indemnify and hold the University harmless from and against any loss, damage, cost, liability or expenses arising from copyright infringement or unauthorized usage.
By downloading any item(s) listed above, you acknowledge that you have read and understood the copyright undertaking as stated above, and agree to be bound by all of its terms.
Please use this identifier to cite or link to this item:
https://theses.lib.polyu.edu.hk/handle/200/14385