Membership Inference Attacks against Large Vision-Language Models

Summary

This paper focuses on the membership inference attack (MIA) of large vision language models. It creates multiple MIA datasets and proposes a new method to identify whether an image or a text belongs to the training dataset.

Strengths

1. The authors have proposed an intriguing research problem, which focuses on the membership attack of large vision language models. 2. The paper proposes a creative method to verify if the input is a member of the training set. It also creates a new benchmark for evaluation. 3. The overall writing is clear and easy to follow.

Weaknesses

The setting for detecting a description sentence is a little confusing for me. Why do you feed the model with a black image rather than others, like those generated by DALL-E? Also, why do you skip the instructions here? It is less possible to produce the target description for the target VLM just based on a black image and an empty instruction. Why don't skip the input image?

Questions

1. As illustrated in the weakness section, could you please explain the setting of MIA in the description sentence? 2. How to set the threshold value \lambda in the MIA process?

Rating

5

Confidence

2

Soundness

3

Presentation

3

Contribution

3

Limitations

The paper has analyzed its limitations in the Appendix, which I believe is reasonable.

Summary

This paper presents an interesting idea of detecting training data in large vision-language models (VLLMs) through membership inference attacks (MIAs). The authors introduce the following interesting points : - An MIA benchmark, specifically designed for VLLMs, called Vision Language MIA (VL-MIA). This benchmark includes tasks for both image and text detection across various VLLM architectures. - A pipeline for MIAs on VLLMs. This approach does not require both side information as in the prior work. This includes a new detection metric called MaxRényi-K%. - Extensive evaluation results. The authors demonstrate the effectiveness of their approach to diverse VLLMs.

Strengths

This paper is well-written and proposes an interesting approach that can be applicable to one side of information for MIA for VLLMs, which might not be well-studied in prior works. The authors also provide a benchmark for evaluating MIA on VLLMs and present extensive results based on the proposed benchmark.

Weaknesses

This paper requires further clarification regarding the proposed methods and evaluation results. Please see the following questions.

Questions

Regarding dataset generation: If the member data is drawn from LAION_CCS, and non-member data is drawn from the generated dataset, is there any underlying bias caused by the nature of differences between natural and synthetic data (in VL-MIA/DALL-E)? Moreover, why did we choose instruction text for members and generated text for non-members in VT-MIA/Text? Regarding the evaluation: Based on Table 2, it seems that different datasets show different behaviors. For example, for VL-MIA/Flickr, Max_100% shows the best performance in most cases, and the performance gap is quite large. On the other hand, we cannot see a similar observation from VL-MIA/DALL-E. I wonder whether the authors have some insight into why it shows a clear difference between datasets. Moreover, it seems that we need to vary a lot of parameters to find better performance (e.g., different alpha, and different K). How did the authors choose the hyperparameters from other baselines? Since the authors present a new benchmark, it might not be a good choice to use optimal hyperparameters from other sources.

Rating

6

Confidence

3

Soundness

3

Presentation

3

Contribution

3

Limitations

The authors discuss the limitations and broader impacts in the appendix.

Summary

The paper introduced a benchmark for membership inference attack on VLMs, proposed a pipeline for token-level image detection, and proposed a target-free metric for image MIA detections. The pipeline relies on the fixed sequence of the VLM output to obtain the output image, instruction, and description segments of logits and use them for evaluation metrics.

Strengths

1. Novelty: There is no existing MIA benchmark datasets for VLM. The authors also proposed a new metrics for detecting MIA in single modality, especially in images. 2. The paper conducts extensive experiments with their proposed methods.

Weaknesses

1. The explanation of some concepts are not clear. For example, when proposing target-free MIA metrics, the author mentioned that it's because we only have access to the image embeddings but not image tokens. How are these two terms defined here? Why do we not have access to the image tokens? Additionally, image tokens are defined again in line 95. If this is not available, why does the paper need to define the concept again? I think the authors should clarify these assumptions properly in the main text.

Questions

1. For the cross-modal pipeline for detecting images, how do you determine which logits are for image, instructions, or description text, during the attack phase? 2. The proposed metrics can have different K and $\alpha$ values. Are there any ablation studies on when should what K and $\alpha$ values being used?

Rating

6

Confidence

3

Soundness

3

Presentation

2

Contribution

3

Limitations

The authors clarified the limitations in the paper.

Summary

The rise of large vision-language models (VLLMs) has significantly advanced multi-modal tasks but also brought forth concerns about data security and privacy. This paper introduces a novel membership inference attack (MIA) benchmark specifically designed for VLLMs to detect training data, addressing the lack of standardized datasets and methodologies in this domain. The authors propose a new MIA pipeline for token-level image detection and introduce the MaxRényi-K% metric for improved detection. The key contributions include the development of the first VLLM-specific MIA benchmark, a cross-modal MIA pipeline for individual image or description detection, and the new MaxRényi-K% and ModRényi metrics, which show effectiveness in experiments.

Strengths

- The paper introduces the first benchmark specifically tailored for VLLMs in the context of MIAs. - The MaxRényi-K% and ModRényi metrics demonstrate significant effectiveness in detecting training data.

Weaknesses

- **Small Evaluation Dataset**: The MIA evaluation dataset consists of around 600 images for each evaluation, which is relatively small. This limited dataset size can lead to less statistically robust results and may not fully capture the variability and challenges present in real-world scenarios. It would strengthen the paper to include evaluations on larger and more diverse datasets. - **Lack of Standard Metrics**: The paper does not consider the _TPR at low FPR_ (True Positive Rate at low False Positive Rate) metric, which is a standard for evaluating worst-case membership privacy. Including this metric would provide a more comprehensive assessment of the model's privacy risks, especially in high-stakes applications where false positives must be minimized. - **Generalizability**: While the proposed metrics and methods show effectiveness, it's important to discuss their generalizability to other types of vision-language models and datasets. Providing insights or experiments on different architectures or domains could enhance the applicability of the findings.

Questions

- How to choose $K$ for the MaxRényi-K% metric?

Rating

5

Confidence

3

Soundness

3

Presentation

3

Contribution

2

Limitations

The size and the diversity of the benchmark is limited.

Thank you for the response

Thanks for the response and the updated results. Using a validation dataset to tune hyperparameters is a reasonable approach. However, this method assumes that the attacker has collected some member and non-member instances in advance. I’m curious about how practical this assumption is in real-world scenarios. I would appreciate it if the authors could provide further clarification on this point.

response to authors

Thank the authors for your efforts in responding to questions and conducting additional experiments. I still have some questions as follows: In the Text MIA experiments along with DALL-E, the authors compare generated data and real-world data, which might already contain underlying biases that could affect performance. I understand that the authors also used Flickr by splitting the data between the target model's release date, and it has even shown better performance with the authors' proposed method (e.g., Flickr has consistently outperformed results from Renyi) than others. Also, as shown in the additional results from the PDF, the performance difference on synthetic data seems marginal. In this case, which dataset should we rely on more if the two datasets show different trends? For example, if we can find one real-world text pair (before and after the target models' release date), and it also shows better performance with the proposed method, as presented in image experiments, why is there a difference? Which one should we trust more if the authors want to present a benchmark?

Response to authors

Thanks for the detailed response. Although some presentations can still be revised, it is an interesting paper on its threat model design. Therefore, I will maintain my current score.