Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We instead _learn_ query vectors that are maximally discriminative; they separate all models trained with the target data point from all models trained without it.

The evidence to be evaluated is:For a target data point \((x^{*},y^{*})\), its IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{m}^{\text{in}}\}\), and its OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), the attacker's goal is to find a data point \(x_{\text{mal}}\) such that IN models and OUT models have different behaviors (logits/confidence scores/losses). In the simplest case, the attacker can optimize \(x_{\text{mal}}\) so that IN shadow models have high losses on \(x_{\text{mal}}\) and OUT models to have low losses on \(x_{\text{mal}}\).

An attacker can easily find a \(x_{\text{mal}}\) with a very low loss on Equation (3), and perfect separation of confidence scores from IN models and OUT models. However, querying with such a canary \(x_{\text{mal}}\) results in random confidence for the holdout shadow models, which indicates that the canary is also not generalizable to the unseen target model. To solve this, instead of searching for \(x_{\text{mal}}\) on the whole feasible data domain, we initialize the adversarial query with the target image or the target image with a small noise. Meanwhile, we add an \(\varepsilon\) bound to the perturbation between \(x_{\text{mal}}\) and \(x^{*}\).

During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model. Through a series of experiments, we show that Canary attacks reliably enhance both online and offline membership inference algorithms under three different datasets, four different models, and differential privacy.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After reviewing the claim and evidence, the statement that they "learn query vectors that are maximally discriminative" appears to be somewhat overstated. While the evidence shows they can create adversarial queries that separate IN and OUT models, several key points suggest this isn't as absolute as claimed:

1. The evidence indicates they need specific constraints (ε-bound perturbation, initialization near target image) to make queries generalizable
2. Figure 1(c) explicitly shows that unconstrained adversarial queries can overfit and lead to attack failure
3. The text notes they can "easily get very low losses" but doesn't demonstrate "maximal" discrimination
4. The evidence discusses "enhancing" rather than achieving perfect discrimination

The claim would be better stated as "learn constrained query vectors that effectively discriminate between models" to reflect these limitations.

<score>3</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We instead _learn_ query vectors that are maximally discriminative; they separate all models trained with the target data point from all models trained without it.

The review comment to be evaluated is:

Strengths:
1. The idea of using adversarial attacks to optimize the MIA queries is quite novel.
2. Following the recent research in MIAs, the paper uses both AUC and FPR to measure the privacy threats.
3. The Canary attack outperforms the state-of-the-art LiRA attack.
4. The paper investigated practical attack scenarios in online and offline threat models. The effectiveness of the proposed Canary attack has been demonstrated in both threat models.
5. The paper investigates the impact of several critical hyperparameters in Canary attacks.
6. The paper is well-written.

Weaknesses:
1. The optimization process of the query generation introduces additional computational overhead. The attack performance is also related to the number of queries. It would be great to compare the computational cost with LiRA attack. In addition, how do we select perturbation bound ϵ in practice? Does the selection require additional cost?
2. The evaluation only considers differential privacy for privacy protection. The paper could discuss the performance of Canary on other state-of-the-art defenses.

The evidence to be evaluated is:For a target data point \((x^{*},y^{*})\), its IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{m}^{\text{in}}\}\), and its OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), the attacker's goal is to find a data point \(x_{\text{mal}}\) such that IN models and OUT models have different behaviors (logits/confidence scores/losses). In the simplest case, the attacker can optimize \(x_{\text{mal}}\) so that IN shadow models have high losses on \(x_{\text{mal}}\) and OUT models to have low losses on \(x_{\text{mal}}\).

An attacker can easily find a \(x_{\text{mal}}\) with a very low loss on Equation (3), and perfect separation of confidence scores from IN models and OUT models. However, querying with such a canary \(x_{\text{mal}}\) results in random confidence for the holdout shadow models, which indicates that the canary is also not generalizable to the unseen target model. To solve this, instead of searching for \(x_{\text{mal}}\) on the whole feasible data domain, we initialize the adversarial query with the target image or the target image with a small noise. Meanwhile, we add an \(\varepsilon\) bound to the perturbation between \(x_{\text{mal}}\) and \(x^{*}\).

During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model. Through a series of experiments, we show that Canary attacks reliably enhance both online and offline membership inference algorithms under three different datasets, four different models, and differential privacy.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
I'll evaluate the claim "We instead learn query vectors that are maximally discriminative; they separate all models trained with the target data point from all models trained without it."

Summary:
The evidence shows that while the method can create queries that effectively separate training shadow models, perfect separation isn't guaranteed across all cases. The figure illustrates three scenarios, including cases where queries fail to separate models (Fig 1a) and where queries can overfit (Fig 1c). The evidence mentions they can "easily get very low losses" but also discusses the need for constraints and transferability concerns. The claim overstates the effectiveness by implying perfect separation in all cases without acknowledging limitations.

Justification:
1. The claim uses absolute language ("maximally discriminative" and "separate all models") which overstates the actual capabilities shown in the evidence.
2. Figure 1 explicitly shows cases where separation fails.
3. The evidence discusses the need for constraints and transferability considerations, indicating it's not as straightforward as the claim suggests.
4. The review comments, while positive about the method's effectiveness, note computational overhead and parameter selection challenges.

<score>4</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We instead _learn_ query vectors that are maximally discriminative; they separate all models trained with the target data point from all models trained without it.

The review comment to be evaluated is:

Membership inference attacks are of great interest to the privacy and security community, and the paper proposes a method to improve LiRA by learning the query vectors. I find the proposed method interesting, and of potential interest to the community. Paper is clearly written and is easy to understand.

My only comment is that it would be interesting to see the metrics with more stringent privacy budget (for differential privacy), example: $\varepsilon \in [10,20,\cdots,100]$, it will also add another practical dimension to the paper, proving strong DP protections against membership inference.

The evidence to be evaluated is:For a target data point \((x^{*},y^{*})\), its IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{m}^{\text{in}}\}\), and its OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), the attacker's goal is to find a data point \(x_{\text{mal}}\) such that IN models and OUT models have different behaviors (logits/confidence scores/losses). In the simplest case, the attacker can optimize \(x_{\text{mal}}\) so that IN shadow models have high losses on \(x_{\text{mal}}\) and OUT models to have low losses on \(x_{\text{mal}}\).

An attacker can easily find a \(x_{\text{mal}}\) with a very low loss on Equation (3), and perfect separation of confidence scores from IN models and OUT models. However, querying with such a canary \(x_{\text{mal}}\) results in random confidence for the holdout shadow models, which indicates that the canary is also not generalizable to the unseen target model. To solve this, instead of searching for \(x_{\text{mal}}\) on the whole feasible data domain, we initialize the adversarial query with the target image or the target image with a small noise. Meanwhile, we add an \(\varepsilon\) bound to the perturbation between \(x_{\text{mal}}\) and \(x^{*}\).

During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model. Through a series of experiments, we show that Canary attacks reliably enhance both online and offline membership inference algorithms under three different datasets, four different models, and differential privacy.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
I'll evaluate the claim: "We instead learn query vectors that are maximally discriminative; they separate all models trained with the target data point from all models trained without it."

Summary:
The evidence shows that while the method can create discriminative queries, perfect separation is not always guaranteed. The evidence specifically mentions that queries can "perfectly separate the training shadow models," but Figure 1 illustrates three different scenarios, including cases where separation fails (a) or where overfit queries lead to attack failure (c). Only case (b) shows successful separation. Additionally, the evidence discusses the need for constraints and initialization strategies to make queries generalizable, indicating that unconditional perfect separation is not achieved.

<score>3</score>

Justification:
1. The claim overstates the effectiveness by suggesting universal separation ("separate all models"), while the evidence shows cases of both success and failure.
2. The evidence demonstrates that successful separation requires specific conditions:
   - Proper initialization ("initialize the adversarial query with the target image")
   - Constraints ("add an ε bound to the perturbation")
   - Careful optimization to avoid overfitting
3. The reviewer's comment doesn't specifically address this claim's validity, focusing instead on testing with different privacy budgets.

A more accurate claim would acknowledge that the method aims to learn discriminative queries that can separate models under certain conditions, while noting potential limitations.


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We instead _learn_ query vectors that are maximally discriminative; they separate all models trained with the target data point from all models trained without it.

The review comment to be evaluated is:

Strong point:

Perturbing the target data point to boost the membership inference precision is a novel and interesting idea. The core idea behind is to make use of the perturbed variant of the target data point to facilitate the attack. Even though the loss of the target data point may hardly vary if the target data point is considered to be an in- or out-class sample, the perturbed variants within the epsilon-neighbourhood of the target data point can potentially unveil more information to identify the membership.

Weakness:
1. In Table.2, the AUC and the TPR values (given the FPR level) of membership inference attack do not provide a monotonic decreasing as the reproductivity of the target model decreases (as claimed in the paper, the target models in Table.2 are given in a descending order of the model reproductivity.)

2. On page 8, why does the attack performance become worse if the bound epsilon becomes larger or smaller than 2? Any explanation to the observation?  Is there any potential trade-off related to the choice of epsilon ?

3. More theoretical study regarding the effectiveness of the adversarial query could further consolidate this work. The adversarial perturbation added to the target data point may help show the loss distribution within the epsilon-neighborhood of the target data point. Though the loss on the target data point may not be rich enough for a successful membership inference attack, the difference of the loss distribution may provide a better lens to differentiate two different membership classes. For the moment, the reasonability behind Eq.3 is still not very clear.

The evidence to be evaluated is:For a target data point \((x^{*},y^{*})\), its IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{m}^{\text{in}}\}\), and its OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), the attacker's goal is to find a data point \(x_{\text{mal}}\) such that IN models and OUT models have different behaviors (logits/confidence scores/losses). In the simplest case, the attacker can optimize \(x_{\text{mal}}\) so that IN shadow models have high losses on \(x_{\text{mal}}\) and OUT models to have low losses on \(x_{\text{mal}}\).

An attacker can easily find a \(x_{\text{mal}}\) with a very low loss on Equation (3), and perfect separation of confidence scores from IN models and OUT models. However, querying with such a canary \(x_{\text{mal}}\) results in random confidence for the holdout shadow models, which indicates that the canary is also not generalizable to the unseen target model. To solve this, instead of searching for \(x_{\text{mal}}\) on the whole feasible data domain, we initialize the adversarial query with the target image or the target image with a small noise. Meanwhile, we add an \(\varepsilon\) bound to the perturbation between \(x_{\text{mal}}\) and \(x^{*}\).

During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model. Through a series of experiments, we show that Canary attacks reliably enhance both online and offline membership inference algorithms under three different datasets, four different models, and differential privacy.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After reviewing the claim and evidence, I find that it is somewhat overstated. While the evidence shows they can generate queries that separate IN/OUT models during training, several key limitations emerge:

1. The evidence acknowledges that unconstrained queries can lead to overfitting and attack failure (Fig 1c)
2. The reviewers point out there's insufficient theoretical explanation for why this works (weakness point 3)
3. The review notes inconsistent performance patterns (weakness point 1)
4. The evidence indicates they must carefully constrain the queries (ε-bound) to avoid overfitting

The claim states they "learn query vectors that are maximally discriminative" without acknowledging these important limitations and constraints required for success. A more measured statement would better reflect the nuanced reality shown in the evidence.

<score>4</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We show that this strategy reliably results in more precise predictions than the baseline method for three different datasets, four different model architectures, and even models trained with differential privacy.

The evidence to be evaluated is:We also illustrate our reasoning in Figure 1, where we visualize how the adversarially trained queries might alter the original queries' decision boundaries and provide more confident and diverse predictions.

In this section, we first show that the Canary attack can reliably improve LiRA results under different datasets and different models for both online and offline settings.

We follow the setting of Carlini et al. (2022) for our main experiment on CIFAR-10 and CIFAR-100 for full comparability. We first train \(65\) wide ResNets (WRN28-10) (Zagoruyko and Komodakis, 2016) with random even splits of \(50000\) images to reach \(92\%\) and \(71\%\) test accuracy for CIFAR-10 and CIFAR-100 respectively. For MNIST, we train \(65\)\(8\)-layer ResNets (He et al., 2016) with random even splits to reach \(97\%\) test accuracy.

We show our main results in Table 1 for three datasets.

The improvement of TPR\(@1\%\)FPR is significant for all datasets. The difference is especially notable for online CIFAR-10, where we achieve a \(4.14\%\) boost over the baseline LiRA (a relative improvement in TPR of \(23\%\)).

On average, Canary attacks are most powerful in the more realistic offline scenario. We gain over \(3\%\) boost on AUC scores on all datasets and over \(2.75\%\) TPR\(@1\%\)FPR boost for CIFAR-10 and CIFAR-100.

In addition to WRN28-10, we further verify the ability of Canary attacks for three other models architectures in CIFAR-10: ResNet-18 (He et al., 2016), VGG-16 (Simonyan and Zisserman, 2014), and ConvMixer (Trockman and Kolter, 2022). In Table 2, Canary attacks are able to consistently provide enhancement over different models.

Indeed, we see from Table 2 that models with higher reproducibility do correlate with more improvement for the online scenario, especially between WRN28-10 and ConvMixer, where WRN28-10 has higher reproducibility than ConvMixer (Sompealli et al., 2022).

We show the results in Table 3. During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

However, in the offline scenario, only CW/CW and pre-softmax logits provide improvements to TPR\(@1\%\)FPR. We now challenge Canary attacks with differential privacy (Abadi et al., 2016). Differential privacy is designed to prevent the leak of information about the training data. We evaluate Canary attacks in two settings.

Differential privacy is still a very effective defense for membership inference attacks, but Canary attacks reliably increase the success chance of membership inference over LiRA. We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model. Through a series of experiments, we show that Canary attacks reliably enhance both online and offline membership inference algorithms under three different datasets, four different models, and differential privacy.

Input: Table 1: Main Results on Different Datasets. For three datasets, Canary attacks are effective in both online and offline scenarios.

Input: Table 2: Results on Different Models Architecture. Canary attacks are able to consistently outperform LiRA over different models. T@1%F stands for TPR@1%FPR.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input: Table 3: Results with Different Objectives. We evaluate Canary attacks on different objectives. Directly minimizing/maximizing the pre-softmax logits gives the biggest improvement in both the online and offline settings.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After careful review, the claim appears to be well-stated and accurately reflects the evidence provided. The tables show consistent improvements across:
1. Three datasets (CIFAR-10, CIFAR-100, MNIST) as shown in Table 1
2. Four model architectures (WRN28-10, ResNet-18, VGG, ConvMixer) as demonstrated in Table 2
3. Models trained with differential privacy (explicitly mentioned in evidence)

The improvements are modest but consistent, with statistical significance demonstrated through detailed metrics (AUC and TPR@1%FPR). The claim avoids overstating the magnitude of improvements and uses appropriate qualifying language ("reliably results in more precise predictions"). The evidence thoroughly supports each component of the claim.

<score>1</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We show that this strategy reliably results in more precise predictions than the baseline method for three different datasets, four different model architectures, and even models trained with differential privacy.

The review comment to be evaluated is:

Strengths:
1. The idea of using adversarial attacks to optimize the MIA queries is quite novel.
2. Following the recent research in MIAs, the paper uses both AUC and FPR to measure the privacy threats.
3. The Canary attack outperforms the state-of-the-art LiRA attack.
4. The paper investigated practical attack scenarios in online and offline threat models. The effectiveness of the proposed Canary attack has been demonstrated in both threat models.
5. The paper investigates the impact of several critical hyperparameters in Canary attacks.
6. The paper is well-written.

Weaknesses:
1. The optimization process of the query generation introduces additional computational overhead. The attack performance is also related to the number of queries. It would be great to compare the computational cost with LiRA attack. In addition, how do we select perturbation bound ϵ in practice? Does the selection require additional cost?
2. The evaluation only considers differential privacy for privacy protection. The paper could discuss the performance of Canary on other state-of-the-art defenses.

The evidence to be evaluated is:We also illustrate our reasoning in Figure 1, where we visualize how the adversarially trained queries might alter the original queries' decision boundaries and provide more confident and diverse predictions.

In this section, we first show that the Canary attack can reliably improve LiRA results under different datasets and different models for both online and offline settings.

We follow the setting of Carlini et al. (2022) for our main experiment on CIFAR-10 and CIFAR-100 for full comparability. We first train \(65\) wide ResNets (WRN28-10) (Zagoruyko and Komodakis, 2016) with random even splits of \(50000\) images to reach \(92\%\) and \(71\%\) test accuracy for CIFAR-10 and CIFAR-100 respectively. For MNIST, we train \(65\)\(8\)-layer ResNets (He et al., 2016) with random even splits to reach \(97\%\) test accuracy.

We show our main results in Table 1 for three datasets.

The improvement of TPR\(@1\%\)FPR is significant for all datasets. The difference is especially notable for online CIFAR-10, where we achieve a \(4.14\%\) boost over the baseline LiRA (a relative improvement in TPR of \(23\%\)).

On average, Canary attacks are most powerful in the more realistic offline scenario. We gain over \(3\%\) boost on AUC scores on all datasets and over \(2.75\%\) TPR\(@1\%\)FPR boost for CIFAR-10 and CIFAR-100.

In addition to WRN28-10, we further verify the ability of Canary attacks for three other models architectures in CIFAR-10: ResNet-18 (He et al., 2016), VGG-16 (Simonyan and Zisserman, 2014), and ConvMixer (Trockman and Kolter, 2022). In Table 2, Canary attacks are able to consistently provide enhancement over different models.

Indeed, we see from Table 2 that models with higher reproducibility do correlate with more improvement for the online scenario, especially between WRN28-10 and ConvMixer, where WRN28-10 has higher reproducibility than ConvMixer (Sompealli et al., 2022).

We show the results in Table 3. During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

However, in the offline scenario, only CW/CW and pre-softmax logits provide improvements to TPR\(@1\%\)FPR. We now challenge Canary attacks with differential privacy (Abadi et al., 2016). Differential privacy is designed to prevent the leak of information about the training data. We evaluate Canary attacks in two settings.

Differential privacy is still a very effective defense for membership inference attacks, but Canary attacks reliably increase the success chance of membership inference over LiRA. We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model. Through a series of experiments, we show that Canary attacks reliably enhance both online and offline membership inference algorithms under three different datasets, four different models, and differential privacy.

Input: Table 1: Main Results on Different Datasets. For three datasets, Canary attacks are effective in both online and offline scenarios.

Input: Table 2: Results on Different Models Architecture. Canary attacks are able to consistently outperform LiRA over different models. T@1%F stands for TPR@1%FPR.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input: Table 3: Results with Different Objectives. We evaluate Canary attacks on different objectives. Directly minimizing/maximizing the pre-softmax logits gives the biggest improvement in both the online and offline settings.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After reviewing the evidence, the claim appears to be well-stated. The data in Tables 1-3 demonstrates consistent improvements across:
1. Three datasets (CIFAR-10, CIFAR-100, MNIST)
2. Four model architectures (WRN28-10, ResNet-18, VGG, ConvMixer)
3. Models with differential privacy

The improvements are shown through consistent positive deltas in both AUC and TPR@1%FPR metrics across all scenarios. While the magnitude of improvement varies (from modest gains like +0.19 to larger gains like +15.59), the strategy reliably outperforms the baseline LiRA method in all tested configurations. The evidence directly supports each component of the claim without exaggeration.

<score>1</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We show that this strategy reliably results in more precise predictions than the baseline method for three different datasets, four different model architectures, and even models trained with differential privacy.

The review comment to be evaluated is:

Membership inference attacks are of great interest to the privacy and security community, and the paper proposes a method to improve LiRA by learning the query vectors. I find the proposed method interesting, and of potential interest to the community. Paper is clearly written and is easy to understand.

My only comment is that it would be interesting to see the metrics with more stringent privacy budget (for differential privacy), example: $\varepsilon \in [10,20,\cdots,100]$, it will also add another practical dimension to the paper, proving strong DP protections against membership inference.

The evidence to be evaluated is:We also illustrate our reasoning in Figure 1, where we visualize how the adversarially trained queries might alter the original queries' decision boundaries and provide more confident and diverse predictions.

In this section, we first show that the Canary attack can reliably improve LiRA results under different datasets and different models for both online and offline settings.

We follow the setting of Carlini et al. (2022) for our main experiment on CIFAR-10 and CIFAR-100 for full comparability. We first train \(65\) wide ResNets (WRN28-10) (Zagoruyko and Komodakis, 2016) with random even splits of \(50000\) images to reach \(92\%\) and \(71\%\) test accuracy for CIFAR-10 and CIFAR-100 respectively. For MNIST, we train \(65\)\(8\)-layer ResNets (He et al., 2016) with random even splits to reach \(97\%\) test accuracy.

We show our main results in Table 1 for three datasets.

The improvement of TPR\(@1\%\)FPR is significant for all datasets. The difference is especially notable for online CIFAR-10, where we achieve a \(4.14\%\) boost over the baseline LiRA (a relative improvement in TPR of \(23\%\)).

On average, Canary attacks are most powerful in the more realistic offline scenario. We gain over \(3\%\) boost on AUC scores on all datasets and over \(2.75\%\) TPR\(@1\%\)FPR boost for CIFAR-10 and CIFAR-100.

In addition to WRN28-10, we further verify the ability of Canary attacks for three other models architectures in CIFAR-10: ResNet-18 (He et al., 2016), VGG-16 (Simonyan and Zisserman, 2014), and ConvMixer (Trockman and Kolter, 2022). In Table 2, Canary attacks are able to consistently provide enhancement over different models.

Indeed, we see from Table 2 that models with higher reproducibility do correlate with more improvement for the online scenario, especially between WRN28-10 and ConvMixer, where WRN28-10 has higher reproducibility than ConvMixer (Sompealli et al., 2022).

We show the results in Table 3. During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

However, in the offline scenario, only CW/CW and pre-softmax logits provide improvements to TPR\(@1\%\)FPR. We now challenge Canary attacks with differential privacy (Abadi et al., 2016). Differential privacy is designed to prevent the leak of information about the training data. We evaluate Canary attacks in two settings.

Differential privacy is still a very effective defense for membership inference attacks, but Canary attacks reliably increase the success chance of membership inference over LiRA. We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model. Through a series of experiments, we show that Canary attacks reliably enhance both online and offline membership inference algorithms under three different datasets, four different models, and differential privacy.

Input: Table 1: Main Results on Different Datasets. For three datasets, Canary attacks are effective in both online and offline scenarios.

Input: Table 2: Results on Different Models Architecture. Canary attacks are able to consistently outperform LiRA over different models. T@1%F stands for TPR@1%FPR.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input: Table 3: Results with Different Objectives. We evaluate Canary attacks on different objectives. Directly minimizing/maximizing the pre-softmax logits gives the biggest improvement in both the online and offline settings.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After reviewing the claim and evidence, I find that the claim is well-stated and accurately reflects the experimental results. The evidence shows:

1. Results across three datasets (CIFAR-10, CIFAR-100, MNIST) consistently show improvements in both online and offline settings (Table 1)
2. Testing across four model architectures (WRN28-10, ResNet-18, VGG, ConvMixer) demonstrates consistent improvements (Table 2)
3. Results with differential privacy are mentioned, though the specific improvement metrics are not shown in the tables provided

The review comment suggests adding more stringent privacy budgets but doesn't contradict the current claims. The evidence comprehensively supports the statement about reliable improvements across different datasets, architectures, and DP settings.

<score>1</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We show that this strategy reliably results in more precise predictions than the baseline method for three different datasets, four different model architectures, and even models trained with differential privacy.

The review comment to be evaluated is:

Strong point:

Perturbing the target data point to boost the membership inference precision is a novel and interesting idea. The core idea behind is to make use of the perturbed variant of the target data point to facilitate the attack. Even though the loss of the target data point may hardly vary if the target data point is considered to be an in- or out-class sample, the perturbed variants within the epsilon-neighbourhood of the target data point can potentially unveil more information to identify the membership.

Weakness:
1. In Table.2, the AUC and the TPR values (given the FPR level) of membership inference attack do not provide a monotonic decreasing as the reproductivity of the target model decreases (as claimed in the paper, the target models in Table.2 are given in a descending order of the model reproductivity.)

2. On page 8, why does the attack performance become worse if the bound epsilon becomes larger or smaller than 2? Any explanation to the observation?  Is there any potential trade-off related to the choice of epsilon ?

3. More theoretical study regarding the effectiveness of the adversarial query could further consolidate this work. The adversarial perturbation added to the target data point may help show the loss distribution within the epsilon-neighborhood of the target data point. Though the loss on the target data point may not be rich enough for a successful membership inference attack, the difference of the loss distribution may provide a better lens to differentiate two different membership classes. For the moment, the reasonability behind Eq.3 is still not very clear.

The evidence to be evaluated is:We also illustrate our reasoning in Figure 1, where we visualize how the adversarially trained queries might alter the original queries' decision boundaries and provide more confident and diverse predictions.

In this section, we first show that the Canary attack can reliably improve LiRA results under different datasets and different models for both online and offline settings.

We follow the setting of Carlini et al. (2022) for our main experiment on CIFAR-10 and CIFAR-100 for full comparability. We first train \(65\) wide ResNets (WRN28-10) (Zagoruyko and Komodakis, 2016) with random even splits of \(50000\) images to reach \(92\%\) and \(71\%\) test accuracy for CIFAR-10 and CIFAR-100 respectively. For MNIST, we train \(65\)\(8\)-layer ResNets (He et al., 2016) with random even splits to reach \(97\%\) test accuracy.

We show our main results in Table 1 for three datasets.

The improvement of TPR\(@1\%\)FPR is significant for all datasets. The difference is especially notable for online CIFAR-10, where we achieve a \(4.14\%\) boost over the baseline LiRA (a relative improvement in TPR of \(23\%\)).

On average, Canary attacks are most powerful in the more realistic offline scenario. We gain over \(3\%\) boost on AUC scores on all datasets and over \(2.75\%\) TPR\(@1\%\)FPR boost for CIFAR-10 and CIFAR-100.

In addition to WRN28-10, we further verify the ability of Canary attacks for three other models architectures in CIFAR-10: ResNet-18 (He et al., 2016), VGG-16 (Simonyan and Zisserman, 2014), and ConvMixer (Trockman and Kolter, 2022). In Table 2, Canary attacks are able to consistently provide enhancement over different models.

Indeed, we see from Table 2 that models with higher reproducibility do correlate with more improvement for the online scenario, especially between WRN28-10 and ConvMixer, where WRN28-10 has higher reproducibility than ConvMixer (Sompealli et al., 2022).

We show the results in Table 3. During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

However, in the offline scenario, only CW/CW and pre-softmax logits provide improvements to TPR\(@1\%\)FPR. We now challenge Canary attacks with differential privacy (Abadi et al., 2016). Differential privacy is designed to prevent the leak of information about the training data. We evaluate Canary attacks in two settings.

Differential privacy is still a very effective defense for membership inference attacks, but Canary attacks reliably increase the success chance of membership inference over LiRA. We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model. Through a series of experiments, we show that Canary attacks reliably enhance both online and offline membership inference algorithms under three different datasets, four different models, and differential privacy.

Input: Table 1: Main Results on Different Datasets. For three datasets, Canary attacks are effective in both online and offline scenarios.

Input: Table 2: Results on Different Models Architecture. Canary attacks are able to consistently outperform LiRA over different models. T@1%F stands for TPR@1%FPR.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input: Table 3: Results with Different Objectives. We evaluate Canary attacks on different objectives. Directly minimizing/maximizing the pre-softmax logits gives the biggest improvement in both the online and offline settings.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After reviewing the claim and evidence, I find that the claim is largely well-stated but has some minor overstatement issues. The evidence clearly shows consistent improvements across:
- Three datasets (CIFAR-10, CIFAR-100, MNIST) in Table 1
- Four architectures (WRN28-10, ResNet-18, VGG, ConvMixer) in Table 2
- Models with differential privacy (mentioned in text)

However, reviewer points out some non-monotonic behavior in Table 2 and lack of theoretical explanation for certain parameters, suggesting the reliability claim could be slightly overstated. The improvements, while consistent, vary in magnitude (some quite small like +0.39% TPR in VGG online case).

<score>2</score>

Justification:
- The core claim about improvements across different datasets/architectures is well-supported by Tables 1-2
- The word "reliably" is mostly justified by consistent positive deltas across configurations
- However, some improvements are modest and the reviewer raises valid concerns about theoretical understanding
- A score of 2 reflects that while slightly optimistic in tone, the claim remains fundamentally grounded in the evidence presented


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

In this work, we use adversarial tools to directly optimize for queries that are discriminative and diverse.

The evidence to be evaluated is:Our work hinges on the observation that an optimized _canary_ image \(x_{mal}\) can be a more effective litmus test for determining the membership of \(x^{*}\).

We now formally present our strategy to generate adversarial queries. For a target data point \((x^{*},y^{*})\), its IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{m}^{\text{in}}\}\), and its OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), the attacker's goal is to find a data point \(x_{\text{mal}}\) such that IN models and OUT models have different behaviors (logits/confidence scores/losses). In the simplest case, the attacker can optimize \(x_{\text{mal}}\) so that IN shadow models have high losses on \(x_{\text{mal}}\) and OUT models to have low losses on \(x_{\text{mal}}\).

\[\operatorname*{argmin}_{x=i\in I}\frac{1}{n}\sum_{i=1}^{n}\mathcal{L}(x_{ \text{mal}},y^{*},\theta_{i}^{\text{in}})+\frac{1}{m}\sum_{i=1}^{m}\mathcal{ L}_{\text{out}}(x_{\text{mal}},y^{*},\theta_{i}^{\text{out}}), \tag{3}\] where \(I\) is the feasible data point domain, \(\mathcal{L}\) is the main task loss, and \(\mathcal{L}_{\text{out}}\) is \(-\log(1-f_{\theta}(x)_{y})\).

1:Input: IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{n}^{\text{in}}\}\), OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), target data point \((x^{*},y^{*})\), batch size \(b\), optimization steps \(T\), perturbation bound \(\varepsilon\), input domain \(I\) 2:\(\Delta_{\text{mal}}=0\) 3:for\(1,...,T\)do 4: Shuffle the index for \(S_{\text{in}}\) and \(S_{\text{out}}\) 5: Calculate loss on OUT models: 6:\(g_{\Delta_{\text{mal}}}=\nabla_{\Delta_{\text{mal}}}\left[\frac{1}{b}\sum_{ i=1}^{b}\mathcal{L}_{\text{out}}(x^{*}+\Delta_{\text{mal}},y^{*},\theta_{i}^{ \text{out}})\right]\)

Though in principle an attacker can construct a canary query as described above, in practice the optimization problem is intractable.

To alleviate the computational burden and the overfitting problem, we make some modifications to the canary generation process. During optimization, we stochastically sample \(b\) IN shadow models from \(S_{\text{in}}\) and \(b\) OUT shadow models from \(S_{\text{out}}\) for each iteration, where \(b<\min(n,m)\). This is equivalent to stochastic mini-batch training for batch size \(b\), which might be able to help the query generalize better (Geiping et al., 2021). We find that such a mini-batching strategy _does_ reduce the required computation, but it _does_ not completely solve the overfitting problem. An attacker can easily find a \(x_{\text{mal}}\) with a very low loss on Equation (3), and perfect separation of confidence scores from IN models and OUT models. However, querying with such a canary \(x_{\text{mal}}\) results in random confidence for the holdout shadow models, which indicates that the canary is also not generalizable to the unseen target model. To solve this, instead of searching for \(x_{\text{mal}}\) on the whole feasible data domain, we initialize the adversarial query with the target image or the target image with a small noise. Meanwhile, we add an \(\varepsilon\) bound to the perturbation between \(x_{\text{mal}}\) and \(x^{*}\).

We also illustrate our reasoning in Figure 1, where we visualize how the adversarially trained queries might alter the original queries' decision boundaries and provide more confident and diverse predictions.

Optimizing with a smaller batch size prevents the adversarial query from overfitting to the shadow models. Meanwhile, it massively reduces the GPU memory required for the gradient graph, which is a win-win situation for the attacker.

The choice the target objectives \(L\) and \(L_{\text{out}}\) is also crucial to the generalization of Canary attacks. We test six different objectives to create adversarial queries:

5) Directly minimize the scaled log score/maximize the scaled log score. 6) Directly minimize the pre-softmax logits of the true label/maximize the pre-softmax logits of the true label.

During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model.

Furthermore, effective optimization routines for queries could challenging, especially when considering future applications of this approach to discrete data, like text or tabular data. In principle, we believe it should be possible to devise a strategy to make adversarial queries transferable that do not require \(\varepsilon\)-bounds, but so far have found the method detailed in Canary to be the most successful approach.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input: Table 5: Comparison with Random Noise Perturbations. A random noise perturbation in the same ε-ball as the canary does not increase membership success. In this sense, the optimized behavior of the canary attack is crucial.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
Based on the evidence provided, I'll evaluate the claim "In this work, we use adversarial tools to directly optimize for queries that are discriminative and diverse."

Summary:
The evidence strongly supports this claim through:
1. Detailed mathematical formulation showing direct optimization of queries using adversarial tools
2. Clear methodology including IN/OUT shadow models and optimization objectives
3. Figure 1 visually demonstrating how adversarial queries create discriminative boundaries
4. Table 5 empirically showing the optimized queries outperform random noise
5. Evidence of diversity through multiple optimization objectives tested

The claim is well-stated and accurately reflects what the methodology demonstrates without exaggeration. The authors provide comprehensive mathematical foundations, discuss limitations, and demonstrate results through both theoretical and empirical evidence.

<score>1</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

In this work, we use adversarial tools to directly optimize for queries that are discriminative and diverse.

The review comment to be evaluated is:

Strengths:
1. The idea of using adversarial attacks to optimize the MIA queries is quite novel.
2. Following the recent research in MIAs, the paper uses both AUC and FPR to measure the privacy threats.
3. The Canary attack outperforms the state-of-the-art LiRA attack.
4. The paper investigated practical attack scenarios in online and offline threat models. The effectiveness of the proposed Canary attack has been demonstrated in both threat models.
5. The paper investigates the impact of several critical hyperparameters in Canary attacks.
6. The paper is well-written.

Weaknesses:
1. The optimization process of the query generation introduces additional computational overhead. The attack performance is also related to the number of queries. It would be great to compare the computational cost with LiRA attack. In addition, how do we select perturbation bound ϵ in practice? Does the selection require additional cost?
2. The evaluation only considers differential privacy for privacy protection. The paper could discuss the performance of Canary on other state-of-the-art defenses.

The evidence to be evaluated is:Our work hinges on the observation that an optimized _canary_ image \(x_{mal}\) can be a more effective litmus test for determining the membership of \(x^{*}\).

We now formally present our strategy to generate adversarial queries. For a target data point \((x^{*},y^{*})\), its IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{m}^{\text{in}}\}\), and its OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), the attacker's goal is to find a data point \(x_{\text{mal}}\) such that IN models and OUT models have different behaviors (logits/confidence scores/losses). In the simplest case, the attacker can optimize \(x_{\text{mal}}\) so that IN shadow models have high losses on \(x_{\text{mal}}\) and OUT models to have low losses on \(x_{\text{mal}}\).

\[\operatorname*{argmin}_{x=i\in I}\frac{1}{n}\sum_{i=1}^{n}\mathcal{L}(x_{ \text{mal}},y^{*},\theta_{i}^{\text{in}})+\frac{1}{m}\sum_{i=1}^{m}\mathcal{ L}_{\text{out}}(x_{\text{mal}},y^{*},\theta_{i}^{\text{out}}), \tag{3}\] where \(I\) is the feasible data point domain, \(\mathcal{L}\) is the main task loss, and \(\mathcal{L}_{\text{out}}\) is \(-\log(1-f_{\theta}(x)_{y})\).

1:Input: IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{n}^{\text{in}}\}\), OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), target data point \((x^{*},y^{*})\), batch size \(b\), optimization steps \(T\), perturbation bound \(\varepsilon\), input domain \(I\) 2:\(\Delta_{\text{mal}}=0\) 3:for\(1,...,T\)do 4: Shuffle the index for \(S_{\text{in}}\) and \(S_{\text{out}}\) 5: Calculate loss on OUT models: 6:\(g_{\Delta_{\text{mal}}}=\nabla_{\Delta_{\text{mal}}}\left[\frac{1}{b}\sum_{ i=1}^{b}\mathcal{L}_{\text{out}}(x^{*}+\Delta_{\text{mal}},y^{*},\theta_{i}^{ \text{out}})\right]\)

Though in principle an attacker can construct a canary query as described above, in practice the optimization problem is intractable.

To alleviate the computational burden and the overfitting problem, we make some modifications to the canary generation process. During optimization, we stochastically sample \(b\) IN shadow models from \(S_{\text{in}}\) and \(b\) OUT shadow models from \(S_{\text{out}}\) for each iteration, where \(b<\min(n,m)\). This is equivalent to stochastic mini-batch training for batch size \(b\), which might be able to help the query generalize better (Geiping et al., 2021). We find that such a mini-batching strategy _does_ reduce the required computation, but it _does_ not completely solve the overfitting problem. An attacker can easily find a \(x_{\text{mal}}\) with a very low loss on Equation (3), and perfect separation of confidence scores from IN models and OUT models. However, querying with such a canary \(x_{\text{mal}}\) results in random confidence for the holdout shadow models, which indicates that the canary is also not generalizable to the unseen target model. To solve this, instead of searching for \(x_{\text{mal}}\) on the whole feasible data domain, we initialize the adversarial query with the target image or the target image with a small noise. Meanwhile, we add an \(\varepsilon\) bound to the perturbation between \(x_{\text{mal}}\) and \(x^{*}\).

We also illustrate our reasoning in Figure 1, where we visualize how the adversarially trained queries might alter the original queries' decision boundaries and provide more confident and diverse predictions.

Optimizing with a smaller batch size prevents the adversarial query from overfitting to the shadow models. Meanwhile, it massively reduces the GPU memory required for the gradient graph, which is a win-win situation for the attacker.

The choice the target objectives \(L\) and \(L_{\text{out}}\) is also crucial to the generalization of Canary attacks. We test six different objectives to create adversarial queries:

5) Directly minimize the scaled log score/maximize the scaled log score. 6) Directly minimize the pre-softmax logits of the true label/maximize the pre-softmax logits of the true label.

During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model.

Furthermore, effective optimization routines for queries could challenging, especially when considering future applications of this approach to discrete data, like text or tabular data. In principle, we believe it should be possible to devise a strategy to make adversarial queries transferable that do not require \(\varepsilon\)-bounds, but so far have found the method detailed in Canary to be the most successful approach.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input: Table 5: Comparison with Random Noise Perturbations. A random noise perturbation in the same ε-ball as the canary does not increase membership success. In this sense, the optimized behavior of the canary attack is crucial.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
Looking at the claim "In this work, we use adversarial tools to directly optimize for queries that are discriminative and diverse," I find this to be well-stated based on the provided evidence.

The evidence thoroughly demonstrates:
1. The use of adversarial optimization tools through detailed equations and algorithms
2. The focus on discrimination (separating IN/OUT models) as shown in both the mathematical formulation and Figure 1
3. Diversity through mini-batch training and various optimization objectives
4. The practical implementation details and limitations are transparently discussed

The evidence matches the scope of the claim without exaggeration. The review comments also support this assessment, highlighting the novelty of using adversarial attacks while noting practical limitations. Table 5 provides empirical validation showing the optimized queries outperform random noise.

<score>1</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

In this work, we use adversarial tools to directly optimize for queries that are discriminative and diverse.

The review comment to be evaluated is:

Membership inference attacks are of great interest to the privacy and security community, and the paper proposes a method to improve LiRA by learning the query vectors. I find the proposed method interesting, and of potential interest to the community. Paper is clearly written and is easy to understand.

My only comment is that it would be interesting to see the metrics with more stringent privacy budget (for differential privacy), example: $\varepsilon \in [10,20,\cdots,100]$, it will also add another practical dimension to the paper, proving strong DP protections against membership inference.

The evidence to be evaluated is:Our work hinges on the observation that an optimized _canary_ image \(x_{mal}\) can be a more effective litmus test for determining the membership of \(x^{*}\).

We now formally present our strategy to generate adversarial queries. For a target data point \((x^{*},y^{*})\), its IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{m}^{\text{in}}\}\), and its OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), the attacker's goal is to find a data point \(x_{\text{mal}}\) such that IN models and OUT models have different behaviors (logits/confidence scores/losses). In the simplest case, the attacker can optimize \(x_{\text{mal}}\) so that IN shadow models have high losses on \(x_{\text{mal}}\) and OUT models to have low losses on \(x_{\text{mal}}\).

\[\operatorname*{argmin}_{x=i\in I}\frac{1}{n}\sum_{i=1}^{n}\mathcal{L}(x_{ \text{mal}},y^{*},\theta_{i}^{\text{in}})+\frac{1}{m}\sum_{i=1}^{m}\mathcal{ L}_{\text{out}}(x_{\text{mal}},y^{*},\theta_{i}^{\text{out}}), \tag{3}\] where \(I\) is the feasible data point domain, \(\mathcal{L}\) is the main task loss, and \(\mathcal{L}_{\text{out}}\) is \(-\log(1-f_{\theta}(x)_{y})\).

1:Input: IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{n}^{\text{in}}\}\), OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), target data point \((x^{*},y^{*})\), batch size \(b\), optimization steps \(T\), perturbation bound \(\varepsilon\), input domain \(I\) 2:\(\Delta_{\text{mal}}=0\) 3:for\(1,...,T\)do 4: Shuffle the index for \(S_{\text{in}}\) and \(S_{\text{out}}\) 5: Calculate loss on OUT models: 6:\(g_{\Delta_{\text{mal}}}=\nabla_{\Delta_{\text{mal}}}\left[\frac{1}{b}\sum_{ i=1}^{b}\mathcal{L}_{\text{out}}(x^{*}+\Delta_{\text{mal}},y^{*},\theta_{i}^{ \text{out}})\right]\)

Though in principle an attacker can construct a canary query as described above, in practice the optimization problem is intractable.

To alleviate the computational burden and the overfitting problem, we make some modifications to the canary generation process. During optimization, we stochastically sample \(b\) IN shadow models from \(S_{\text{in}}\) and \(b\) OUT shadow models from \(S_{\text{out}}\) for each iteration, where \(b<\min(n,m)\). This is equivalent to stochastic mini-batch training for batch size \(b\), which might be able to help the query generalize better (Geiping et al., 2021). We find that such a mini-batching strategy _does_ reduce the required computation, but it _does_ not completely solve the overfitting problem. An attacker can easily find a \(x_{\text{mal}}\) with a very low loss on Equation (3), and perfect separation of confidence scores from IN models and OUT models. However, querying with such a canary \(x_{\text{mal}}\) results in random confidence for the holdout shadow models, which indicates that the canary is also not generalizable to the unseen target model. To solve this, instead of searching for \(x_{\text{mal}}\) on the whole feasible data domain, we initialize the adversarial query with the target image or the target image with a small noise. Meanwhile, we add an \(\varepsilon\) bound to the perturbation between \(x_{\text{mal}}\) and \(x^{*}\).

We also illustrate our reasoning in Figure 1, where we visualize how the adversarially trained queries might alter the original queries' decision boundaries and provide more confident and diverse predictions.

Optimizing with a smaller batch size prevents the adversarial query from overfitting to the shadow models. Meanwhile, it massively reduces the GPU memory required for the gradient graph, which is a win-win situation for the attacker.

The choice the target objectives \(L\) and \(L_{\text{out}}\) is also crucial to the generalization of Canary attacks. We test six different objectives to create adversarial queries:

5) Directly minimize the scaled log score/maximize the scaled log score. 6) Directly minimize the pre-softmax logits of the true label/maximize the pre-softmax logits of the true label.

During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model.

Furthermore, effective optimization routines for queries could challenging, especially when considering future applications of this approach to discrete data, like text or tabular data. In principle, we believe it should be possible to devise a strategy to make adversarial queries transferable that do not require \(\varepsilon\)-bounds, but so far have found the method detailed in Canary to be the most successful approach.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input: Table 5: Comparison with Random Noise Perturbations. A random noise perturbation in the same ε-ball as the canary does not increase membership success. In this sense, the optimized behavior of the canary attack is crucial.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After reviewing the evidence, the claim "we use adversarial tools to directly optimize for queries that are discriminative and diverse" appears to be well-stated for several reasons:

1. The evidence thoroughly demonstrates the optimization process through formal equations and algorithms for generating adversarial queries.
2. The results in Table 5 show that optimized canary queries outperform random noise, confirming the effectiveness of the optimization.
3. Figure 1 illustrates how the adversarial queries work to separate distributions.
4. The authors acknowledge limitations and challenges, particularly regarding overfitting and transferability.
5. The methodology includes specific techniques to ensure diversity and discriminative power, such as batch size optimization and different objective functions.

The claim directly reflects what is shown in the evidence without exaggeration.

<score>1</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

In this work, we use adversarial tools to directly optimize for queries that are discriminative and diverse.

The review comment to be evaluated is:

Strong point:

Perturbing the target data point to boost the membership inference precision is a novel and interesting idea. The core idea behind is to make use of the perturbed variant of the target data point to facilitate the attack. Even though the loss of the target data point may hardly vary if the target data point is considered to be an in- or out-class sample, the perturbed variants within the epsilon-neighbourhood of the target data point can potentially unveil more information to identify the membership.

Weakness:
1. In Table.2, the AUC and the TPR values (given the FPR level) of membership inference attack do not provide a monotonic decreasing as the reproductivity of the target model decreases (as claimed in the paper, the target models in Table.2 are given in a descending order of the model reproductivity.)

2. On page 8, why does the attack performance become worse if the bound epsilon becomes larger or smaller than 2? Any explanation to the observation?  Is there any potential trade-off related to the choice of epsilon ?

3. More theoretical study regarding the effectiveness of the adversarial query could further consolidate this work. The adversarial perturbation added to the target data point may help show the loss distribution within the epsilon-neighborhood of the target data point. Though the loss on the target data point may not be rich enough for a successful membership inference attack, the difference of the loss distribution may provide a better lens to differentiate two different membership classes. For the moment, the reasonability behind Eq.3 is still not very clear.

The evidence to be evaluated is:Our work hinges on the observation that an optimized _canary_ image \(x_{mal}\) can be a more effective litmus test for determining the membership of \(x^{*}\).

We now formally present our strategy to generate adversarial queries. For a target data point \((x^{*},y^{*})\), its IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{m}^{\text{in}}\}\), and its OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), the attacker's goal is to find a data point \(x_{\text{mal}}\) such that IN models and OUT models have different behaviors (logits/confidence scores/losses). In the simplest case, the attacker can optimize \(x_{\text{mal}}\) so that IN shadow models have high losses on \(x_{\text{mal}}\) and OUT models to have low losses on \(x_{\text{mal}}\).

\[\operatorname*{argmin}_{x=i\in I}\frac{1}{n}\sum_{i=1}^{n}\mathcal{L}(x_{ \text{mal}},y^{*},\theta_{i}^{\text{in}})+\frac{1}{m}\sum_{i=1}^{m}\mathcal{ L}_{\text{out}}(x_{\text{mal}},y^{*},\theta_{i}^{\text{out}}), \tag{3}\] where \(I\) is the feasible data point domain, \(\mathcal{L}\) is the main task loss, and \(\mathcal{L}_{\text{out}}\) is \(-\log(1-f_{\theta}(x)_{y})\).

1:Input: IN shadow models \(S_{\text{in}}=\{\theta_{1}^{\text{in}},...,\theta_{n}^{\text{in}}\}\), OUT shadow models \(S_{\text{out}}=\{\theta_{1}^{\text{out}},...,\theta_{m}^{\text{out}}\}\), target data point \((x^{*},y^{*})\), batch size \(b\), optimization steps \(T\), perturbation bound \(\varepsilon\), input domain \(I\) 2:\(\Delta_{\text{mal}}=0\) 3:for\(1,...,T\)do 4: Shuffle the index for \(S_{\text{in}}\) and \(S_{\text{out}}\) 5: Calculate loss on OUT models: 6:\(g_{\Delta_{\text{mal}}}=\nabla_{\Delta_{\text{mal}}}\left[\frac{1}{b}\sum_{ i=1}^{b}\mathcal{L}_{\text{out}}(x^{*}+\Delta_{\text{mal}},y^{*},\theta_{i}^{ \text{out}})\right]\)

Though in principle an attacker can construct a canary query as described above, in practice the optimization problem is intractable.

To alleviate the computational burden and the overfitting problem, we make some modifications to the canary generation process. During optimization, we stochastically sample \(b\) IN shadow models from \(S_{\text{in}}\) and \(b\) OUT shadow models from \(S_{\text{out}}\) for each iteration, where \(b<\min(n,m)\). This is equivalent to stochastic mini-batch training for batch size \(b\), which might be able to help the query generalize better (Geiping et al., 2021). We find that such a mini-batching strategy _does_ reduce the required computation, but it _does_ not completely solve the overfitting problem. An attacker can easily find a \(x_{\text{mal}}\) with a very low loss on Equation (3), and perfect separation of confidence scores from IN models and OUT models. However, querying with such a canary \(x_{\text{mal}}\) results in random confidence for the holdout shadow models, which indicates that the canary is also not generalizable to the unseen target model. To solve this, instead of searching for \(x_{\text{mal}}\) on the whole feasible data domain, we initialize the adversarial query with the target image or the target image with a small noise. Meanwhile, we add an \(\varepsilon\) bound to the perturbation between \(x_{\text{mal}}\) and \(x^{*}\).

We also illustrate our reasoning in Figure 1, where we visualize how the adversarially trained queries might alter the original queries' decision boundaries and provide more confident and diverse predictions.

Optimizing with a smaller batch size prevents the adversarial query from overfitting to the shadow models. Meanwhile, it massively reduces the GPU memory required for the gradient graph, which is a win-win situation for the attacker.

The choice the target objectives \(L\) and \(L_{\text{out}}\) is also crucial to the generalization of Canary attacks. We test six different objectives to create adversarial queries:

5) Directly minimize the scaled log score/maximize the scaled log score. 6) Directly minimize the pre-softmax logits of the true label/maximize the pre-softmax logits of the true label.

During the experiment, for all objectives above, we can easily get very low losses at the end of the optimization, and create Canary queries that perfectly separate the training shadow models. Surprisingly, minimizing/maximizing the pre-softmax logits gives us the biggest improvement, even though it does not explicitly suppress the logits for other labels like other objectives do.

We explore a novel way to enhance membership inference techniques by creating ensembles of adversarial queries. These adversarial queries are optimized to provide maximally different outcomes for the model trained with/without the target data sample. We also investigate and discuss strategies to make the queries trained on the shadow models transferable to the target model.

Furthermore, effective optimization routines for queries could challenging, especially when considering future applications of this approach to discrete data, like text or tabular data. In principle, we believe it should be possible to devise a strategy to make adversarial queries transferable that do not require \(\varepsilon\)-bounds, but so far have found the method detailed in Canary to be the most successful approach.

Input: Figure 1: Query Decision Boundary in Model Parameter Space. We illustrate our idea by plotting the decision boundaries of two queries x1 and x2 in model parameter space. In this case, the target image is indeed in the training data of (green) target model. We sketch three cases. (a) Both augmented queries are unable to separate both distributions and the membership inference fails. (b) Two optimal adversarial queries are generated that are both diverse and, on average, separate both distributions and the attack succeeds. (c) Without the constraints, adversarial queries can overfit and again lead to attack failure.

Input: Table 5: Comparison with Random Noise Perturbations. A random noise perturbation in the same ε-ball as the canary does not increase membership success. In this sense, the optimized behavior of the canary attack is crucial.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After reviewing the claim "In this work, we use adversarial tools to directly optimize for queries that are discriminative and diverse," I find this to be a well-stated claim based on the following evidence:

1. The paper presents a detailed optimization strategy using adversarial tools (Equation 3 and Algorithm steps)
2. The discriminative aspect is demonstrated through the objective of separating IN and OUT model behaviors
3. Diversity is addressed through stochastic sampling and batch optimization
4. Figure 1 visually illustrates how their adversarial queries create discriminative decision boundaries
5. Table 5 shows the effectiveness of their optimized approach compared to random noise
6. The review comments, while noting some limitations, acknowledge the novel approach of using adversarial perturbations

The claim accurately reflects what is demonstrated in the evidence without overstating capabilities or results.

<score>1</score>