Follow up
**Time complexity:** We will update the paragraph in section 3.3 to reflect the optimized variant of our attack, as suggested by the reviewer.
**CIFAR-100:** We experimentally verified our intuition over multiple models where we checked the samples that caused 1% FPR for the decision boundary attack. They, indeed, required poisoning for the membership inference attack to be successful.
**Larger models:** After 100 epochs, the ResNet-18 model achieved a test accuracy of approximately 83-84%. Meanwhile, ResNet-50, using the same training setup for 100 epochs, showed lower test accuracy in the range of 79-80%. To ensure a fair comparison, we increased the training epochs to 125 for ResNet-50, resulting in a similar test accuracy of 83-84% comparable to the ResNet-18 model.
**Theoretical attack:** The optimal attack will outperform all attacks that follow the same assumptions as the optimal attack. However, real-world scenarios may not always align perfectly with these assumptions, leading to the observed discrepancies in the plot. The primary aim behind constructing the optimal attack was to provide a better understanding on the behavior of the Chameleon attack rather than solely outperforming it.
**New Concerns:**
**Q1:** We use the random label flipping strategy for poisoning outlined by Truth Serum (Tramer et al., 2022). Their work showed that there was no substantial advantage in using alternative label flipping methods (like selecting the next most likely class or the least likely class) over assigning a random label different from the original. We will add this reasoning in the revised paper.
**Q2:** We adhere to the same data distribution assumption that has been followed in the MI literature, which also includes state-of-the-art Label-Only (LO) attacks that we compare against: Shorki et al., 2017, Yeom et al., 2018, Leino et al., 2020, Choo et al. (LO), 2021, Li et al., 2021 (LO), Carlini et al., 2022, Tramer et al, 2022 and Wen et al., 2023.
**Q3:** We train our models with weight decay regularization, using standard parameters common in training CIFAR-10 models (weight_decay=5e-4). We also run some preliminary experiments with a more aggressive regularization setting (weight_decay=5e-3). This approach appears to partially mitigate our attack, reducing the TPR at 1% FPR from 22.8% to 5.5% and the AUC from 76.2% to 64.1%. Note that our attack still shows 14x improvement over the decision boundary attack, which achieves a TPR of 0.4% at 1% FPR under the same heavy regularization. However this mitigation comes at the cost of training accuracy of the victim model: we observed a decrease of ~ 6% training accuracy. We will investigate in more details the effect of regularization on our attack. We also note that prior work by Kaya et al., 2020 (https://arxiv.org/abs/2006.05336), discourages the exclusive use of regularization methods to defend against membership inference, as it may provide a false sense of security against more powerful threat models.
**Q4:** We observed a minor accuracy drop of less than 2% before and after poisoning across our datasets (when tested on ResNet-18 models) highlighting the stealthiness of our attack. For instance, for the CIFAR-10 dataset, the model's test accuracy marginally decreased from 83.8% before poisoning to 82.4% after.
**Q5:** We follow the same evaluation methodology as established in prior works (Carlini et al., 2022; Tramer et al., 2022; Wen et al., 2023), where we repeat our attack evaluation 64 times and present the average over 64 trials. Each trial involves training a target model on the poisoned dataset and assessing membership inference on the 500 challenge points, which were also chosen randomly in the beginning. The comparison presented in Table 1 against prior works is also averaged over 64 trials to ensure consistency.