成员推断还是数据分割偏差？识别合成医学图像隐私审计中的假阳性
Membership Inference or Data Split Bias? Identifying False Positives in Synthetic Medical Image Privacy Audits.
摘要(中文译文)
成员推断攻击(Membership Inference Attacks, MIAs)目前是审计合成医学数据隐私性的标准方法。较高的攻击分数被广泛解读为存在显著的隐私泄露,但这种解读假设MIA正在学习真实的成员信号。我们认为,这些攻击可能实际上是在学习实验伪影,具体而言是数据划分偏倚。为验证这一点,我们对来自StyleGAN3模型的合成脑MRI图像进行了实验。我们设计了一项主MIA(成员数据与非成员数据)以及一项关键对照实验(仅使用成员数据的互不相交子集)。这种仅含成员的设置缺乏类别之间任何真实的成员区分,仅留下数据划分偏倚。我们的结果表明,对照实验的AUC与主MIA相当或更高(在5k池的Small语料库上高0.0205,在30k池的Big语料库上高0.0113)。这一有力证据表明,较高的MIA分数可能是隐私泄露的假阳性,因为分类器仅仅是在学习统计伪影。我们得出结论:如果没有严格的对照实验来验证MIA检测到的是真实的隐私风险而非实验偏倚,那么MIA结果是不可靠的。
Abstract
Membership Inference Attacks (MIAs) are the current standard for auditing the privacy of synthetic medical data. A high attack score is widely interpreted as a significant privacy leak, but this interpretation assumes the MIA is learning a true membership signal. We argue that these attacks may instead be learning experimental artefacts, specifically data split bias. To test this, we conduct experiments on synthetic brain MRI images from a StyleGAN3 model. We design a Primary MIA (member vs. non-member data) and a critical Control Experiment (disjoint subsets of member data alone). This member-only setup lacks any genuine membership distinction between classes, leaving only data split bias. Our results show the Control Experiment's AUCs match or exceed the Primary MIA's (+0.0205 on the 5k-pool Small corpus and +0.0113 on the 30k-pool Big corpus). This compelling evidence demonstrates that a high MIA score can be a false positive for a privacy breach, as the classifier is simply learning statistical artefacts. We conclude that MIA results are unreliable without rigorous control experiments to validate that they are detecting genuine privacy risks, not experimental bias.
如何引用
AMA
Linxue Bai, Omid Pournik, Xuefei Ding, Saadullah Farooq Abbasi, Le Zhang, Theodoros Arvanitis. Membership Inference or Data Split Bias? Identifying False Positives in Synthetic Medical Image Privacy Audits.. Studies in health technology and informatics. 2026; doi:10.3233/SHTI260258.
APA
Linxue Bai, Omid Pournik, Xuefei Ding, Saadullah Farooq Abbasi, Le Zhang, Theodoros Arvanitis (2026). Membership Inference or Data Split Bias? Identifying False Positives in Synthetic Medical Image Privacy Audits.. Studies in health technology and informatics. https://doi.org/10.3233/SHTI260258
GB/T 7714
Linxue Bai, Omid Pournik, Xuefei Ding, Saadullah Farooq Abbasi, Le Zhang, Theodoros Arvanitis. Membership Inference or Data Split Bias? Identifying False Positives in Synthetic Medical Image Privacy Audits.[J]. Studies in health technology and informatics, 2026 doi:10.3233/SHTI260258.
在 PubMed增强版 阅读全文
翻译全文 · AI 文献问答 · PDF 原文下载 · 引用导出