# Better Membership Inference Privacy Measurement through Discrepancy

Ruihan Wu
University of California, San Diego
<EMAIL_ADDRESS>
&Pengrun Huang∗
University of California, San Diego
<EMAIL_ADDRESS>
&Kamalika Chaudhuri
University of California, San Diego
<EMAIL_ADDRESS>
Equal contribution

###### Abstract

Membership Inference Attacks have emerged as a dominant method for empirically
measuring privacy leakage from machine learning models. Here, privacy is
measured by the advantage or gap between a score or a function computed on the
training and the test data. A major barrier to the practical deployment of
these attacks is that they do not scale to large well-generalized models –
either the advantage is relatively low, or the attack involves training
multiple shadow models which is high compute-intensive. In this work, inspired
by discrepancy theory, we propose a new empirical privacy metric that is an
upper bound on the advantage of a specific family of membership inference
attacks. We introduce an easy-to-compute approximation CPM to the upper bound.
We empirically validate CPM is higher than the advantage of most popular
existing attacks and because of its light computation, it can be applied to
large ImageNet classification models in-the-wild. More interestingly, we find
the gaps between the new metric and the advantage of existing attacks are
larger on advanced models trained with sophisticated training recipes.
Motivated by this empirical result, we propose new membership inference
attacks tailored to those advanced models.

##  1 Introduction

Many machine-learning models are now trained on highly sensitive data, such as
medical records, browsing history and financial information, and leakage of
training data from these models would cause serious concern [14, 40, 3].
Consequently, there has been a body of technical literature on how to measure
privacy leakage from the training data of machine learning models [45, 53, 59,
34]. One of the most dominant methods for empirically measuring privacy
leakage is Membership Inference [45, 53, 25, 49, 46, 4, 60], that has been
designated as a potential confidentiality violation by government
organizations such as NIST (US) as well as the ICO (UK), and deployed in
industry applications, such as the privacy auditing library of Tensorflow
[47]. Given a model, a data point, and possibly some auxiliary information, a
Membership Inference Attack (MIA) predicts whether the given data point is
included in the training data of the model or not. Privacy leakage is measured
by the gap between the accuracy of a membership inference attack on the
training data and the test data of a model; this gap is called the advantage
and higher advantage indicates more privacy leakage.

The current literature on MIA falls into two main categories. The first one is
score-based MIA, which is motivated by the idea that certain scoring functions
computed on a model and a data point, such as the cross-entropy loss, are
quite different on average when evaluated on training and test data points.
This idea has led to a proliferation of a number of score functions [45, 53,
46, 44]; this class of MIAs are computationally efficient, but tend to have a
low advantage on large well-generalized models. The second category also uses
scoring functions, but adjusts them per data point using “shadow models” [45,
49, 4], which are models very similar to the model in question, but trained on
a different auxiliary dataset. These MIAs require the attacker to train
multiple shadow models which makes them computationally infeasible for large-
scale models.

In this work, inspired by discrepancy theory, we propose a new metric for
empirically measuring privacy leakage from models. We observe that the
discrepancy between the training and test data with respect to a class of sets
$\mathcal{Q}$ is an upper bound on the advantage of any score-based MIA whose
discriminative set lies in $\mathcal{Q}$. An advantage upper bound is stronger
than the advantage of any single MIA to ensure a model is privacy-preserving –
the advantage of any MIA in this family would not exceed this upper bound.
Thus, we propose the discrepancy with respect to all convex sets in the
probability space of a neural network as an empirical privacy metric. We prove
that this metric is a upper bound on the advantage of four popular score-based
MIAs – entropy, maximum-softmax-probability, cross-entropy and modified
entropy [46] –and is hence at least as strong as either of them. Additionally,
our numerical experiments show that this metric has discriminative power, and
is able to distinguish between a large number of models. Finally, even though
the exact computation of our metric may be hard, we propose a new algorithm
for approximating it using a surrogate loss function – a metric that we call
CPM, and we show the value of CPM is reachable by some score-based MIA.
Comparing our new metric to the two categories of existing MIAs, it is
stronger than the popular score-based MIAs and more computational-feasible
than the MIAs leveraging “shadow models".

We then extensively evaluate CPM by comparing it with score-based MIAs on
various models and several datasets, where we follow the setups in the MIA
literature, as well as out-of-the-box ImageNet pre-trained models released by
the PyTorch Torchvision library [42]. We observe that existing MIAs are upper-
bounded by the CPM, which supports that it is a stronger privacy metric.
Interestingly, we find the gap between CPM and existing score-based MIAs is
small for standard models trained with cross-entropy loss, but considerably
larger for models trained with more sophisticated generalization methods or an
MIA defense. Because CPM is reachable by some score-based MIA, this suggests
that the design of existing scoring-based MIAs may be overfitting to standard
models, and other better scoring functions may be needed to measure membership
inference properly in the more modern models. This is also corroborated by our
findings on the Pytorch ImageNet pre-trained models, where CPM outperforms the
baselines significantly in the Resnetv2 models that use a complicated training
recipe, and not as much in the simpler Resnetv1 models.

A natural question suggested by these experimental results is whether there
are scoring functions that perform better on models trained in a more
sophisticated way. This is an interesting question; for example, prior work
[11] has shown that currents MIAs do not work for really large language
models. One possible solution is to design training-procedure aware scores.
Motivated from this, for the model trained by the generalization technique
MixUp [56] or the MIA defense algorithm RelaxLoss [6], we propose two new
score-based MIAs, the MixUp score and the RelaxLoss score, that mimic their
training procedure respectively. We empirically observe that the advantage of
the training procedure aligned MIA score is the highest. This suggests that a
plausible reason why MIAs do not work as well on really large models might be
the use of incorrect scores; we leave the design of more training-aware MIA
scores for these modern models for future work.

##  2 Preliminaries

Membership inference attack (MIA; [45]) is a privacy attack where the goal is
to predict whether a specific data point is included in the training data.
This membership information can be sensitive – for example, the membership to
a medical dataset indicates whether a person has a medical record or not.
These attacks have been studied for a variety of machine learning models
including classification [53], generative models [5], multi-modal models [28]
and large language models [50].

Suppose we have a model $f$ that is trained on a training dataset $S$ drawn
from an underlying data distribution $\mathcal{D}$. The input to an MIA $m$ is
a data point $z=(x,y)$ and a trained model $f$, and the output is a $0/1$
value. $m(z,f)=1$ means that the MIA predicts that the data point $z$ is in
the training set $S$ of $f$. The advantage of an MIA $m$ w.r.t. the model $f$,
training data $S$, and data distribution $\mathcal{D}$ is defined as the
difference between how frequently $m$ predicts $1$ on a point in the training
set, and how frequently it predicts $1$ on points drawn from an independent
test set:

${\rm Adv}(m;f,S,\mathcal{D}):=\mathbb{P}_{z\sim
S}(m(z,f)=1)-\mathbb{P}_{z\sim\mathcal{D}}(m(z,f)=1)\in[-1,1].$ (1)

Observe that the advantage is an empirical measure of privacy; if it is high,
then it is easier to distinguish between training and test data points, which
may, in turn, lead to the leakage of other private training data information
even beyond the membership inference, such as attribute inference attack [53].
We also observe that we need both training and some test data to calculate the
advantage and evaluate how private a model is.

Finally, we note that contrary to some of the literature [53, 38], our
definition of advantage does not require multiple runs of training; this
allows us to scale to large datasets and models where training multiple models
for the purpose of evaluating privacy is too expensive.

Existing MIA literature has two classes of MIA. The first, which we call
score-based MIA, is motivated by the intuition that certain functions of a
model $f$, such as training loss, are lower for training data points than test
on average. Accordingly, they use a scoring function $h(z,f)\in\mathbb{R}$
[45, 53], where $z$ is the input data and a threshold to determine membership
– specifically,

$m_{h,\tau}(z,f)=\mathds{1}\left[h(z,f)<\tau\right].$ (2)

In addition to the training loss, prior work has proposed several probability-
based scoring functions for classification models. Suppose
$f(x)\in\Delta_{C-1}$ is the softmax vector of probabilities output by a
$C$-class classification model, and suppose the label $y$ is in one-hot
format. Then, we summarize some popular probability-based scoring functions in
the literature in Table 1. The gradient-based scoring function is another
popular choice [44], which is the norm of the gradient of $x$ or the gradient
of parameters in $f$ w.r.t. the loss.

While score-based MIA attacks are computationally efficient, they may have
lower advantage; more recent work [45, 49, 4] has sought to improve the
advantage of the MIAs by leveraging “shadow models” – which are essentially
similar models (to the input model $f$) trained on auxiliary data drawn from
the same distribution. With these additional models, one can design a more
elaborate attack: instead of sharing one threshold $\tau$ for all data $z$ as
defined in Equation 2, one can now design a data-dependent threshold $\tau(z)$
or even a more complicated data-dependent decision boundary for $h(z,f)$ than
just a threshold. Watson et al. [49] trains multiple shadow models by
following the same training procedure of the target model $f$ on the auxiliary
dataset. It then calibrates the score of $z$ by subtracting the average score
of $z$ among shadow models. Another representative method LiRA [4] is to
estimate density functions for the two distributions of scores of z when the
model is trained _with_ / _without_ the input data $z$, where the scoring
function is pre-defined. After calculating the score of $z$ and $f$, it
computes the ratio of density values of the two distributions and thresholds
this ratio.

While MIAs that use shadow models tend to have higher advantage than score-
based ones, they can be impractical because of two reasons. First, their
performance is very sensitive to the knowledge of the adversary, including the
distribution of auxiliary datasets and the details of the learning procedure
[4, 11]. The second and more important aspect is computational cost. For
modern models, training even a single model can take multiple GPUs and many
days – Llama2-70B takes 1720320 GPU hours for example [48] – which makes it
infeasible to train multiple (or even one) shadow model. With this in mind, we
focus our attention to pure score-based MIAs in this paper.

Table 1: MIA scores in the literature.

Name | Definition
---|---
Maximum-Softmax-Probability (MSP) [53] |  $-\max_{c\in[C]}f(x)_{c}$111We take the negative sign here because the smaller score implies the data more likely belonging to the training data as defined in Equation 2.
Entropy (ENT) [45] | $\sum_{c\in[C]}-f(z)_{c}\log(f(x)_{c})$
Cross-Entropy Loss (CE) [53] | $\sum_{c\in[C]}-y_{c}\log(f(x)_{c})$
Modified Entropy (ME) [46] | $-\sum_{c\in[C]}\left((1-f(x)_{c})\log(f(x)_{c})y_{c}+f(x)_{c}\log(1-f(x)_{c})(1-y_{c})\right)$

##  3 A Better Empirical Privacy Metric

Recall from Section 2 that the advantage of an MIA on a model $f$ is an
empirical privacy metric that measures how much $f$ “leaks” its training data,
and that different scoring functions yield different empirical privacy metric
values depending on the model and dataset. This raises a natural question: can
we find an empirical privacy metric that encompasses all these scores-based
advantages?

Before defining the metric, let us first discuss three properties that we
expect from it. First, it should be an upper bound on the advantage of a
family of score-based MIAs and this indicates that it is a reasonably strict
privacy metric to ensure a model is privacy-preserving – the advantage of any
MIA in this family would not exceed this upper bound. Second, the metric
should be able to distinguish between different models so that we can use it
to compare models by their privacy leakage; one counter-example is that the
family of score-based MIAs are so expressive that training and test data can
always be perfectly separated. Finally, it should be efficiently computable,
or at the very least, approximately computable with relative ease.

###  3.1 Better Privacy Metric through Discrepancy Distance

#### Connecting MIA to discrepancy distance.

Yeom et al. [53] showed that the advantage of a loss-function-based MIA is
equal to the generalization gap between the training and test loss. But what
happens when we look at, not a single score, but a family of scores?

Suppose $(x,y)$ is a labeled data and $f(x)\in\Delta_{C-1}$ is the softmax
vector of probabilities output by a $C$-class classification model. For any
MIA $m$ that is a post-hoc function of $(f(x),y)$, we can define the
discriminative set of $m$ as

$Q_{m}:=\\{(f(x),y)|(x,y)\in\mathrm{supp}(\mathcal{D})\text{ and
}m((x,y),f)=1\\},$

where $\mathrm{supp}(\mathcal{D})$ is the support of data distribution
$\mathcal{D}$. This is essentially the set where the scoring function
underlying the MIA predicts that $(x,y)$ lies in the training set. We can now
rewrite the advantage of a MIA $m$ in terms of its discriminative set as
follows:

$\displaystyle{\rm Adv}(m;f,S,\mathcal{D})=\mathbb{P}_{(x,y)\sim
S}((f(x),y)\in Q_{m})-\mathbb{P}_{(x,y)\sim\mathcal{D}}((f(x),y)\in Q_{m}).$

Now, suppose $\mathcal{Q}$ is a family of discriminative sets and
$Q_{m}\in\mathcal{Q}$; then, the advantage of $m$ is naturally bounded by the
discrepancy distance [31, 9] between the training set $S$ and the test
distribution $\mathcal{D}$ with respect to $\mathcal{Q}$, which is defined as

$D_{\mathcal{Q}}(S,\mathcal{D}):=\sup_{Q\in\mathcal{Q}}D(S,\mathcal{D}|Q),$

where $D(S,\mathcal{D}|Q)=\left|\mathbb{P}_{(x,y)\sim S}((f(x),y)\in
Q)-\mathbb{P}_{(x,y)\sim\mathcal{D}}((f(x),y)\in Q)\right|.$ Formally, we
state the relation between the advantage and discrepancy in the following
proposition.

######  Proposition 1.

For any MIA $m$, if $Q_{m}\in\mathcal{Q}$, ${\rm Adv}(m;f,S,\mathcal{D})\leq
D_{\mathcal{Q}}(S,\mathcal{D})$.

#### Choosing a discriminative set family $\mathcal{Q}$.

What are some of the popular scoring functions for MIA? Two of the most
popular ones are MSP and ENT, both of which are based on scores that are
convex or concave functions of $(f(x),y)$ and hence have convex discriminative
sets. This suggests convex discriminative sets
$\mathcal{Q}_{cvx}=\\{Q|Q\subseteq\mathbb{R}^{2C},Q\text{ is a convex set}\\}$
as a potential candidate. Are there any more such scoring functions? It turns
out that two other popular ones – CE and ME – while not based on convex
functions – can be shown to have advantages that are equal to that of a convex
or concave scoring function; hence, the discrepancy over convex discriminative
sets is an upper bound on their advantage as well. This is encapsulated by the
following theorem.

######  Theorem 1.

For an arbitrary threshold $\tau\in\mathbb{R}$ and any of
$m\in\\{m_{msp,\tau},m_{ent,\tau},m_{ce,\tau},m_{me,\tau}\\}$, ${\rm
Adv}(m;f,S,\mathcal{D})\leq D_{\mathcal{Q}_{cvx}}(S,\mathcal{D}).$

###### Proof sketch of Theorem 1.

The proof for $m_{msp,\tau}$ and $m_{ent,\tau}$ is straightforward because the
MSP score and the ENT score are convex/concave in $(f(x),y)$, hence
thresholding the convex/concave function gives a convex/concave discriminative
set. The proof for $m_{ce,\tau}$ and $m_{me,\tau}$ takes more effort because
the cross-entropy score and modified-entropy score are indeed not
convex/concave in $(f(x),y)$. For each of $m_{ce,\tau}$ and $m_{me,\tau}$, we
can construct another function $g(f,z)$ such that 1. it agrees with the score
(CE or ME) for any $(f,z)$ and 2. it is convex or concave in $(f(x),y)$,
$\forall$ $f(x),y\in(0,1]^{C}\times[0,1]^{C}$. Hence, the discriminative set
of $g(f,z)$ is the same as the discriminative set of the score (CE or ME) in
domain $(0,1]^{C}\times\\{0,1\\}^{C}$ and is convex in domain
$(0,1]^{C}\times[0,1]^{C}$. This is possible because by definition the label
$y$ of $z$ should be a one-hot vector and the convexity is discussed for a
larger domain. With this construction, ${\rm
Adv}(m_{\mathrm{score},\tau};f,S,\mathcal{D})={\rm
Adv}(m_{g,\tau};f,S,\mathcal{D})=\mathbb{P}_{z\sim S}((f(x),y)\in
Q_{m_{g,\tau}})-\mathbb{P}_{z\sim\mathcal{D}}((f(x),y)\in Q_{m_{g,\tau}})\leq
D_{\mathcal{Q}_{cvx}}(S,\mathcal{D})$ for $\mathrm{score}\in\\{ce,me\\}$. ∎

It is worthwhile to highlight from the theorem that ${\rm
Adv}(\mathcal{M}_{cvx};f,S,\mathcal{D})$ can be proved to be an upper bound
for the advantage of an MIA $m$ even when $Q_{m}$ is neither convex nor
concave — $Q_{m_{CE}}$ and $Q_{m_{ME}}$ are the examples as proved in Theorem
1.

We propose $D_{\mathcal{Q}_{cvx}}(S,\mathcal{D})$ as a new privacy metric and
now we turn to the three criteria discussed at the beginning of Section 3.
First, from Proposition 1, $D_{\mathcal{Q}_{cvx}}(S,\mathcal{D})$ is an upper
bound for all MIA, whose discriminative sets are convex or concave; Theorem 1
further shows MIAs with four popular existing scores, where two of them are
even not convex or concave functions, are upper bounded by
$D_{\mathcal{Q}_{cvx}}(S,\mathcal{D})$. Second, observe that as
$\mathcal{Q}_{cvx}$ is not arbitrarily expressive – $Q\in\mathcal{Q}_{cvx}$ is
constrained to be a convex set in $\mathbb{R}^{2C}$,
$D_{\mathcal{Q}_{cvx}}(S,\mathcal{D})$ should not be loose enough to be a
trivial upper bound. In particular, our numerical experiments will illustrate
that this upper bound $D_{\mathcal{Q}_{cvx}}(S,\mathcal{D})$ is non-vacuous in
many common cases and is capable of distinguishing between different models
and different datasets. Third, we are going to show that an approximation of
$D_{\mathcal{Q}_{cvx}}(S,\mathcal{D})$ can be computed efficiently; this is
the topic of the next subsection.

#### Comparison with the existing MIAs.

We now compare our new metric to two categories of the existing MIAs
introduced in Section 2. As proved in Theorem 1, the new metric is stronger
than the popular score-based MIAs. On the other hand, because its computation
doesn’t involve training multiple “shadow models", it is more computational-
feasible than the MIAs leveraging “shadow models" and can be applied to large
models.

###  3.2 Approximation of the discrepancy

In general, it is challenging to represent arbitrary convex sets, and hence a
natural strategy is to approximate the set $\mathcal{Q}_{cvx}$ by a set
$\mathcal{Q}_{cvx,K}$ of all convex polytopes with $K$ facets for large $K$.
It turns out that there exists a $K$ such that this approximation is exact
when considering closed sets, suggesting this is a viable solution strategy.

######  Proposition 2.

Suppose $\mathcal{Q}_{cvx}^{\prime}$ and $\mathcal{Q}_{cvx,K}^{\prime}$ are
the sets of all closed convex sets and closed convex polytopes respectively.
We have
$D_{\mathcal{Q}_{cvx}^{\prime}}(S,\mathcal{D})=D_{\mathcal{Q}_{cvx,K}^{\prime}}(S,\mathcal{D})$
for $K=\binom{|S|}{2C}$.

Unfortunately, exactly calculating the discrepancy distance
$D_{\mathcal{Q}_{cvx}}(S,\mathcal{D})$ over even polytopes with $2$ facets is
NP-hard [17]! To overcome this hardness, we first observe that each convex
polytope with $K$ facets can be parameterized as
$Q_{w_{i},b_{i},i\in[K]}:=\\{a|a\in\mathbb{R}^{2C},w_{i}^{\top}a+b_{i}\leq
0,\text{ where }w_{i}\in\mathbb{R}^{2c},b_{i}\in\mathbb{R},i\in[K]\\}$. After
this parameterization, we can use a standard technique in machine learning –
instead of optimizing over the $0/1$ loss in discrepancy, we instead use a
smoother surrogate loss and optimize over it. Specifically, we choose logistic
regression $\ell_{lg}$. By notating $a_{z,f}=(f(x),y)$, the objective function
can be written as

$\max_{w_{i}\in\mathbb{R}^{2C},b_{i}\in\mathbb{R},i\in[K],s=\pm
1}\frac{1}{|S|}\sum_{z\sim S}\ell_{lg}\left(\max_{i\in[K]}w_{i}\top
a_{z,f}+b_{i},s\right)+\mathbb{E}_{z\sim\mathcal{D}}\left[\ell_{lg}\left(\max_{i\in[K]}w_{i}\top
a_{z,f}+b_{i},-s\right)\right].$ (3)

Now the objective function is both parametric and continuous. Although it is
still non-convex, we can use gradient descent to find the approximate
solution.

To distinguish the exact solution $(w_{i}^{*},b_{i}^{*})$ representing the
best polytope and the approximate solution $(\hat{w}_{i},\hat{b}_{i})$ solved
by Equation 3, we name the optimal value
$D(S,\mathcal{D}|Q_{w_{i}^{*},b_{i}^{*},i\in[K]})$ as the CPB (Convex Polytope
Bound) and by following Kantchelian et al. [27] name
$D(S,\mathcal{D}|Q_{\hat{w}_{i},\hat{b}_{i},i\in[K]})$ as the CPM (Convex
Polytope Machine). Moreover, we notice that CPM is achievable by some score-
based MIA: $D(S,\mathcal{D}|Q_{\hat{w}_{i},\hat{b}_{i},i\in[K]})$ is
equivalent to the advantage of a score-based MIA with scoring function
$\max_{i\in[K]}\hat{w_{i}}\top a_{z,f}+\hat{b_{i}}$ or
$-\max_{i\in[K]}\hat{w_{i}}\top a_{z,f}+\hat{b_{i}}$.

##  4 Experiment

In this section, we investigate the empirical performance of CPM on both
various models and several datasets, where we follow the setups in the MIA
literature [6], and pre-trained ImageNet classification models in the wild. In
particular, we are interested in the following questions:

  1. 1.

How does CPM perform compared to other scoring functions on models trained
with different learning algorithms?

  2. 2.

How good is the approximation quality of CPM with $K$ facets as a function of
$K$?

  3. 3.

How does CPM perform on models in the wild?

###  4.1 Experimental Setup

(a) CIFAR-10

(b) CIFAR-100

(c) Texas

(d) Purchase

Figure 1: CPM and the advantage of baselines on models trained on CIFAR-10
1(a), CIFAR-100 1(b), Texas 1(c) and Purchase 1(d). As shown in the figures,
CPM is an upper bound to the advantage of the baseline scores for most models.

Datasets and Models. We first consider two image classification datasets:
CIFAR-10 [29], CIFAR-100 [29] and two tabular datasets [45]: Texas100,
Purchase100. The CIFAR-10 has 10 classes and the other three datasets have 100
classes. The following settings for these four datasets and the to-be-test
models mainly follow the MIA literature [4, 6] and we call these models by
models trained from scratch. We use ResNet-20 [19] as the model architecture
for CIFAR-10 and CIFAR-100, and MLP [18] as the model architecture for
Texas100 and Purchase100. Models are trained with 10000 balanced training
samples. We use three different training methods. The first, _vanilla_ , is
trained by minimizing the standard cross-entropy loss. _Mixup_ [56] is trained
by minimizing the cross-entropy loss after linear interpolation of the
training data and labels – a method that is known to promote generalization.
Finally, our third method _RelaxLoss_ [6] trains models by minimizing the the
cross-entropy loss in a dynamic way, which is a state-of-the-art empirical
defense against MIAs. These three methods lead to models with accuracy varying
between $78-84\%$ for CIFAR-10 and $39-52\%$ for CIFAR-100, $52-58\%$ for
Texas-100 and $78-89\%$ for Purchase-100.

We further test our methods on ImageNet [8] dataset and pre-trained Imagenet
models downloaded from the publicly available Pytorch Torchvision library
[41]; surprisingly, there are no previous published MIA results on these
models. We pick ResNet-50, ResNet-101 and ResNet-152 models from Pytorch [42]
pre-trained on ImageNet with both versions 1 and version 2222The models are
from https://pytorch.org/vision/stable/models.html..The version 1 models are
trained by minimizing the usual cross-entropy loss, while the version 2
models, which are more accurate, use an advanced training recipe that includes
many generalization-promoting techniques such as Label Smoothing [37], Mixup,
Cutmix [55], Random Erasing [58] and so on.

CPM setup. we get our new metric CPM by optimizing the objective in Equation 3
with $K=1000$. All optimizations are conducted with GPU on NVIDIA GeForce RTX
3080, and the longest time for one optimization is 20 minutes. See
optimization details in Appendix B.

Baselines. We compare CPM with four popular baseline scores used in the
literature: maximum-softmax-probability (MSP), entropy (ENT), cross-entropy
loss (CE) and modified entropy (ME); see Table 1 for their definitions.

Evaluation Method. To evaluate the advantage (from equation 1) of MIAs between
training samples and testing distribution, for each target model, the CPM is
computed by optimizing Equation 3 on the entire training set and half of the
test set. We then report the actual advantage of the CPM calculated over the
training set and the rest of the testing samples. Similarly, for the other
scores, we choose the optimal threshold based on the training set and half of
the testing samples, and evaluate the actual advantage similarly.

###  4.2 Observations

(a) Vanilla

(b) MixUp

(c) Relaxloss

Figure 2: CPM with different numbers of facets $K$. The figures show CPM
achieves a higher advantage than the existing MIAs as an uppper bound with a
moderate value of $K$.

Figure 3: CPM and the advantage of baseline scores on PyTorch models. It shows
that CPM is very close to the advantage of the baseline scores for the V1
models, but the gap is significantly larger for the V2 models.

Models trained from scratch. The results for CIFAR-10, CIFAR-100, Texas-100
and Purchase-100 are presented in Figures 1(a), 1(b), 1(c) and 1(d)
respectively. We see that for most models, CPM is an upper bound on the
advantage of the four baseline scores. This corroborates Theorem 1, and shows
that the approximate solution CPM for the upper bound serves as a stronger
privacy metric. Note that only for the vanilla model in CIFAR-10, Cross-
Entropy loss achieves slightly higher advantage than CPM. This might be
because CPM approximates the theoretical upper bound CPB, which suggests that
the difference might be due to approximation error.

More interestingly, we observe that CPM is very close to the advantage of the
Cross-Entropy loss in vanilla models, while there is a sizeable gap between
the advantages for Mixup and Relaxloss models. Recall that CPM is achievable
by some score-based MIA as discussed in Section 3.2. This suggests the design
of scores such as Cross-Entropy and MSP, which are used because of their high
empirical performance on cross-entropy trained models, might be overfitting to
these kinds of models. Different scores may be needed for more effective
membership inference in more sophisticated models.

Effect of $K$ for approximation quality of CPM. Recall that the parameter $K$
in the CPM computation measures approximation quality. We plot CPM on
CIFAR-100 versus the number of facets $K$ in Figure 4.2. We see that this is a
monotone increasing function where larger $K$ has higher advantage, suggesting
that CPM is approaching the true upper bound CPB well when $K$ is getting
larger. Furthermore, we see that the CPM outperforms the advantage of other
scores even at $K=10$, which suggests that in these cases, even a reasonably
large value of $K$ can achieve larger advantage. We make the similar
evaluation for $K$ on other three datasets in Appendix B.

Models in the Wild. The results for PyTorch models are shown in Figure 3. We
observe that CPM is very close to the advantage of the baseline scores for the
Version 1 models which are trained by minimizing the cross-entropy loss,
whereas the gap is significantly larger for the version 2 models, which are
trained with a more advanced recipe. This shows that our observation from
Figure 1 that the existing baseline scores may not be very effective for
membership inference in more sophisticated models also holds for pre-trained
models in the wild.

##  5 Improving MI Attacks for More Sophisticated Models

Our results from Section 4 show that while the current loss-based membership
inference attacks are effective for cross-entropy trained models, they are
considerably less so for the more sophisticated models of today. Thus, a
natural question to ask is whether there are other better score-based
membership inference attacks for the models trained through different
procedures?

This suggests us to design training-procedure aware scores. Although this
requires the additional knowledge for the training procedure, this assumption
can be realistic – the public foundation models, for example Pytorch pre-
trained ImageNet classification models and public large language models (GPT
[43], Llama [48]), are always accompanied with the certain level of training
details – and this assumption is much easier than other common assumptions in
literatures that require either the full model weights or the additional
auxiliary dataset.

Also, notice that the training-procedure aware score is different from the
loss aware score – for example in the previous experiments, vanilla, MixUp and
RelaxLoss models are all trained based on cross-entropy loss, but their
training-procedures are different. We are going to design training-procedure
aware scores next for the MixUp and RelaxLoss models.

For Mixup models, the training loss is the cross-entropy loss of a “Mixup” –
or, linear combination – of two training points. This suggests the following
Mixup score. Suppose we have a small auxiliary subset $S_{\rm aux}$ of the
training data; 333In our evaluation $|S_{\rm aux}|$ is smaller than $200$.
then we define the Mixup score $m_{\rm MixUp}(z,f)$, as the CE loss between a
linear combination of $z$ and $z_{\rm aux}\in S_{\rm aux}$:

$\frac{1}{R|S_{\rm aux}|}\sum_{r\in[R],z_{\rm aux}\in S_{\rm aux}}\ell_{\rm
ce}(f(x_{\rm mix}),y_{\rm mix}),$

where $x_{\rm mix}=\lambda_{r}\cdot x+(1-\lambda_{r})\cdot x_{\rm aux}$,
$y_{\rm mix}=\lambda_{r}\cdot y+(1-\lambda_{r})\cdot y_{\rm aux}$, and
$\lambda_{r}$ ($r\in[R]$) are i.i.d. sampled from a uniform distribution
$\mathcal{U}_{[0.5,1]}$.

For RelaxLoss models, there is no static loss function cross optimization
iterations and the training procedure is more complicated. If the loss on an
example is more than $\alpha$, then Chen et al. [6] does standard SGD.
Otherwise, if the classifier predicts correctly on the example, then we do
gradient ascent; if not, then they do gradient descent on a modified loss
function that incorporates a smoothed label. We mimic this dynamic training
procedure into the following RelaxLoss score $m_{\rm Relaxloss}(z,f)$:

$\displaystyle|\ell_{\rm
ce}(f(x),y)-\alpha|+\left(1.5-\ell_{0/1}(f,z)\right)\cdot\ell_{\rm
ce}(f(x),y)+\left(0.5+\ell_{0/1}(f,z)\right)\cdot\ell_{\rm ce-s}(f(x),y),$ (4)

where $\alpha$ is a hyperparameter, $\ell_{0/1}$ is the classification error,
and $\ell_{\rm ce-s}(f(x),y):=\sum_{c=1}^{C}\log(f(x)_{c})y^{\rm soft}_{c})$
is the cross-entropy loss after label smoothing as defined in Chen et al. [6].
The soft label $y^{\rm soft}$ is defined as $y^{\rm
soft}_{c^{*}}=\min\\{f(x)_{c^{*}},\mu\\}$ where $y_{c^{*}}=1$ and $y^{\rm
soft}_{c}=\frac{1-\min\\{f(x)_{c^{*}},\mu\\}}{C-1}$ for any $c\neq c^{*}$ and
$\mu$ is another hyperparameter to soften the original one-hot label.

###  5.1 Experiments with Mixup and RelaxLoss Scores

In this section, we implement the Mixup score and RelaxLoss score attack on
pre-trained models from the previous section. We are interested in the
following question: Do the Mixup score and RelaxLoss score outperform existing
MIA scores for Mixup and RelaxLoss models respectively?

Experimental Setups. For the Mixup experiments, we implement a number of
values of $|S_{aux}|$ and $R$. For two image datasets, we randomly sample our
auxiliary dataset $S_{aux}$ from the test set with $|S_{aux}|$ equal to 30 and
$R=10$. For tabular datasets, we randomly sample $S_{aux}$ from the train set
with $|S_{aux}|=100,R=100$ for Purchase-100, and $|S_{aux}|=150,R=150$ for
Texas-100. For the RelaxLoss experiments, we set the hyperparameters
$(\alpha,\mu)$ in Equation 4 as what they were used in the RelaxLoss training
procedure [6]. The two values of $(\alpha,\mu)$ are
$(1,1),(3,1),(2.5,0.1),(0.8,0.3)$ for CIFAR-10, CIFAR-100, Texas-100 and
Purchase-100 respectively.

Observations. The results for CIFAR-10, CIFAR-100, Texas-100 and Purchase-100
are presented in Table 2(a), 2(b), 2(c), 2(d) respectively. We see that as we
expected, the Mixup score and the RelaxLoss score have the highest advantage
for the Mixup and the RelaxLoss model respectively. In other words, the
advantage is the highest when the training procedure and the MIA scores are
aligned. This suggests that for the modern models, that are trained with more
sophisticated procedures, we may be able to design better MIA scores that are
training-procedure aware.

Model $\backslash$ Score | CE | Mixup | RelaxLoss
---|---|---|---
Vanilla | 28.45 | 15.11 | 12.53
Mixup | 18.50 | 18.92 | 13.80
RelaxLoss | 4.9 | 4.75 | 5.24
(a) CIFAR-10

Model $\backslash$ Score | CE | Mixup | RelaxLoss
---|---|---|---
Vanilla | 56.80 | 50.60 | 48.65
Mixup | 33.36 | 33.95 | 31.89
RelaxLoss | 6.62 | 6.73 | 8.64
(b) CIFAR-100

Model $\backslash$ Score | CE | Mixup | RelaxLoss
---|---|---|---
Vanilla | 58.53 | 58.52 | 46.91
Mixup | 41.16 | 41.25 | 35.34
RelaxLoss | 13.10 | 13.09 | 13.45
(c) Texas

Model $\backslash$ Score | CE | Mixup | RelaxLoss
---|---|---|---
Vanilla | 29.17 | 22.77 | 11.07
Mixup | 39.11 | 39.12 | 32.77
RelaxLoss | 22.82 | 22.77 | 22.86
(d) Purchase

Table 2: The advantage of MIA with cross-entropy score, Mixup score, and
RelaxLoss score (columns) for models (rows) trained on CIFAR-10 2(a),
CIFAR-100 2(b), Texas 2(c) and Purchase 2(d). The tables show that the
advantage is the highest when the training loss and the MIA scores are
aligned.

##  6 Related Work

Membership inference attack in large-scale foundation models. While this paper
mainly discusses the membership inference attack for classification models,
many literature study the membership inference attack for more recent large-
scale foundation models. Several work study the MIA for the unsupervised
models such as GAN [5], contrastive learning [30, 20] and diffusion models
[32, 10]. MIA has been explored for multi-modal models such as CLIP [28, 21],
text-to-image generation models [52], and image captioning models [22].
Mireshghallah et al. [36], Mattern et al. [33], Fu et al. [15] explore MIA for
the latest large language models.

Attribute inference attack. Another popular empirical privacy metric is
attribute inference, where the input is the partial knowledge of a training
data point and the model, and the output is an estimation of the unknown
sensitive attributes. Attribute inference has been studied in various data
domains. Fredrikson et al. [14], Yeom et al. [53], Mehnaz et al. [35] study
the attribute inference on tabular dataset, Zhang et al. [57], Aïvodji et al.
[2], Meehan et al. [34] focus on the unsupervised image models, and Jia et al.
[26], Gong and Liu [16] explore the attribute inference in social networks.

Differential privacy. Differential privacy [12, 13] is a theoretical privacy
definition for any learning algorithm. Different from empirical privacy
metrics which are measured by any designed attacks, the DP parameters for the
learning algorithm, which indicates the privacy leakage, need to be proved.
Yeom et al. [53], Humphries et al. [23], Wu et al. [51] have discussed the
relationship between differential privacy and empirical privacy metrics such
as membership inference attack or attribute inference attack. On the other
hand, its good theoretical property motivates the design of privacy-preserving
algorithms and it has been widely deployed in many tasks [1, 24, 7, 54].

##  7 Conclusion

In this work, we proposed a new empirical privacy metric based on discrepancy
distance, i.e. the discrepancy distance between the training and test data
with respect to a class of sets. We show that this is a stronger privacy
metric than four current score-based MIAs and gives an informative upper
bound. In addition, we introduce an approximation CPM to the new metric, that
is computationally efficient. In our experiment section, we observe that
existing MIAs are upper-bounded by the CPM. More interestingly, we find that
the design of existing score-based MIA may overfit standard models and is
suboptimal for the model trained by sophisticated recipes. Motivated by this
observation, we propose two new score-based MIAs for MixUp and RelaxLoss,
which achieve higher advantages.

Limitation and future work. First, this paper considers the discrepancy
distance with respect to the convex family of sets in the probability space.
One extension can be either considering a more general family than the convex
family or exploring the discriminative set in the logit space or the feature
space. Another future direction motivated by this work is to design better
score-based MIA for models trained by more sophisticated learning techniques
in various data domains.

#### Acknowledgement

This work is supported by grants from National Science Foundation NSF
(CIF-2402817, CNS-1804829), SaTC-2241100, CCF-2217058, ARO-MURI
(W911NF2110317), and ONR under N00014-24-1-2304.

## References

  * Abadi et al. [2016] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang.  Deep learning with differential privacy.  In _Proceedings of the 2016 ACM SIGSAC conference on computer and communications security_ , pages 308–318, 2016.
  * Aïvodji et al. [2019] U. Aïvodji, S. Gambs, and T. Ther.  Gamin: An adversarial approach to black-box model inversion.  _arXiv preprint arXiv:1909.11835_ , 2019.
  * Carlini et al. [2019] N. Carlini, C. Liu, Ú. Erlingsson, J. Kos, and D. Song.  The secret sharer: Evaluating and testing unintended memorization in neural networks.  In _28th USENIX security symposium (USENIX security 19)_ , pages 267–284, 2019.
  * Carlini et al. [2022] N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer.  Membership inference attacks from first principles, 2022.
  * Chen et al. [2020] D. Chen, N. Yu, Y. Zhang, and M. Fritz.  Gan-leaks: A taxonomy of membership inference attacks against generative models.  In _Proceedings of the 2020 ACM SIGSAC conference on computer and communications security_ , pages 343–362, 2020.
  * Chen et al. [2022] D. Chen, N. Yu, and M. Fritz.  Relaxloss: Defending membership inference attacks without losing utility.  In _International Conference on Learning Representations_ , 2022.
  * De et al. [2022] S. De, L. Berrada, J. Hayes, S. L. Smith, and B. Balle.  Unlocking high-accuracy differentially private image classification through scale.  _arXiv preprint arXiv:2204.13650_ , 2022.
  * Deng et al. [2009] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei.  Imagenet: A large-scale hierarchical image database.  In _2009 IEEE conference on computer vision and pattern recognition_ , pages 248–255. Ieee, 2009.
  * Doerr et al. [2014] C. Doerr, M. Gnewuch, and M. Wahlström.  Calculation of discrepancy measures and applications.  _A panorama of discrepancy theory_ , pages 621–678, 2014.
  * Duan et al. [2023] J. Duan, F. Kong, S. Wang, X. Shi, and K. Xu.  Are diffusion models vulnerable to membership inference attacks?  In _International Conference on Machine Learning_ , pages 8717–8730. PMLR, 2023.
  * Duan et al. [2024] M. Duan, A. Suri, N. Mireshghallah, S. Min, W. Shi, L. Zettlemoyer, Y. Tsvetkov, Y. Choi, D. Evans, and H. Hajishirzi.  Do membership inference attacks work on large language models?  _arXiv preprint arXiv:2402.07841_ , 2024.
  * Dwork et al. [2006] C. Dwork, F. McSherry, K. Nissim, and A. Smith.  Calibrating noise to sensitivity in private data analysis.  In _Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3_ , pages 265–284. Springer, 2006.
  * Dwork et al. [2014] C. Dwork, A. Roth, et al.  The algorithmic foundations of differential privacy.  _Foundations and Trends® in Theoretical Computer Science_ , 9(3–4):211–407, 2014.
  * Fredrikson et al. [2014] M. Fredrikson, E. Lantz, S. Jha, S. Lin, D. Page, and T. Ristenpart.  Privacy in pharmacogenetics: An $\\{$End-to-End$\\}$ case study of personalized warfarin dosing.  In _23rd USENIX security symposium (USENIX Security 14)_ , pages 17–32, 2014.
  * Fu et al. [2023] W. Fu, H. Wang, C. Gao, G. Liu, Y. Li, and T. Jiang.  Practical membership inference attacks against fine-tuned large language models via self-prompt calibration.  _arXiv preprint arXiv:2311.06062_ , 2023.
  * Gong and Liu [2018] N. Z. Gong and B. Liu.  Attribute inference attacks in online social networks.  _ACM Transactions on Privacy and Security (TOPS)_ , 21(1):1–30, 2018.
  * Gottlieb et al. [2018] L.-A. Gottlieb, E. Kaufman, A. Kontorovich, and G. Nivasch.  Learning convex polytopes with margin.  _Advances in neural information processing systems_ , 31, 2018.
  * Haykin [1994] S. Haykin.  _Neural networks: a comprehensive foundation_.  Prentice Hall PTR, 1994.
  * He et al. [2016] K. He, X. Zhang, S. Ren, and J. Sun.  Deep residual learning for image recognition.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 770–778, 2016.
  * He and Zhang [2021] X. He and Y. Zhang.  Quantifying and mitigating privacy risks of contrastive learning.  In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_ , pages 845–863, 2021.
  * Hintersdorf et al. [2022] D. Hintersdorf, L. Struppek, M. Brack, F. Friedrich, P. Schramowski, and K. Kersting.  Does clip know my face?  _arXiv preprint arXiv:2209.07341_ , 2022.
  * Hu et al. [2022] P. Hu, Z. Wang, R. Sun, H. Wang, and M. Xue.  M4i: Multi-modal models membership inference.  _Advances in Neural Information Processing Systems_ , 35:1867–1882, 2022.
  * Humphries et al. [2023] T. Humphries, S. Oya, L. Tulloch, M. Rafuse, I. Goldberg, U. Hengartner, and F. Kerschbaum.  Investigating membership inference attacks under data dependencies.  In _2023 IEEE 36th Computer Security Foundations Symposium (CSF)_ , pages 473–488. IEEE, 2023.
  * Iyengar et al. [2019] R. Iyengar, J. P. Near, D. Song, O. Thakkar, A. Thakurta, and L. Wang.  Towards practical differentially private convex optimization.  In _2019 IEEE Symposium on Security and Privacy (SP)_ , pages 299–316. IEEE, 2019.
  * Jayaraman et al. [2020] B. Jayaraman, L. Wang, K. Knipmeyer, Q. Gu, and D. Evans.  Revisiting membership inference under realistic assumptions.  _arXiv preprint arXiv:2005.10881_ , 2020.
  * Jia et al. [2017] J. Jia, B. Wang, L. Zhang, and N. Z. Gong.  Attriinfer: Inferring user attributes in online social networks using markov random fields.  In _Proceedings of the 26th International Conference on World Wide Web_ , pages 1561–1569, 2017.
  * Kantchelian et al. [2014] A. Kantchelian, M. C. Tschantz, L. Huang, P. L. Bartlett, A. D. Joseph, and J. D. Tygar.  Large-margin convex polytope machine.  _Advances in Neural Information Processing Systems_ , 27, 2014.
  * Ko et al. [2023] M. Ko, M. Jin, C. Wang, and R. Jia.  Practical membership inference attacks against large-scale multi-modal models: A pilot study.  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , pages 4871–4881, 2023.
  * Krizhevsky [2009] A. Krizhevsky.  Learning multiple layers of features from tiny images.  Technical report, 2009.
  * Liu et al. [2021] H. Liu, J. Jia, W. Qu, and N. Z. Gong.  Encodermi: Membership inference against pre-trained encoders in contrastive learning.  In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_ , pages 2081–2095, 2021.
  * Mansour et al. [2009] Y. Mansour, M. Mohri, and A. Rostamizadeh.  Domain adaptation: Learning bounds and algorithms.  _arXiv preprint arXiv:0902.3430_ , 2009.
  * Matsumoto et al. [2023] T. Matsumoto, T. Miura, and N. Yanai.  Membership inference attacks against diffusion models.  In _2023 IEEE Security and Privacy Workshops (SPW)_ , pages 77–83. IEEE, 2023.
  * Mattern et al. [2023] J. Mattern, F. Mireshghallah, Z. Jin, B. Schölkopf, M. Sachan, and T. Berg-Kirkpatrick.  Membership inference attacks against language models via neighbourhood comparison.  _arXiv preprint arXiv:2305.18462_ , 2023.
  * Meehan et al. [2024] C. Meehan, F. Bordes, P. Vincent, K. Chaudhuri, and C. Guo.  Do ssl models have déjà vu? a case of unintended memorization in self-supervised learning.  _Advances in Neural Information Processing Systems_ , 36, 2024.
  * Mehnaz et al. [2022] S. Mehnaz, S. V. Dibbo, R. De Viti, E. Kabir, B. B. Brandenburg, S. Mangard, N. Li, E. Bertino, M. Backes, E. De Cristofaro, et al.  Are your sensitive attributes private? novel model inversion attribute inference attacks on classification models.  In _31st USENIX Security Symposium (USENIX Security 22)_ , pages 4579–4596, 2022.
  * Mireshghallah et al. [2022] F. Mireshghallah, K. Goyal, A. Uniyal, T. Berg-Kirkpatrick, and R. Shokri.  Quantifying privacy risks of masked language models using membership inference attacks.  _arXiv preprint arXiv:2203.03929_ , 2022.
  * Müller et al. [2019] R. Müller, S. Kornblith, and G. E. Hinton.  When does label smoothing help?  _Advances in neural information processing systems_ , 32, 2019.
  * Nasr et al. [2021] M. Nasr, S. Songi, A. Thakurta, N. Papernot, and N. Carlin.  Adversary instantiation: Lower bounds for differentially private machine learning.  In _2021 IEEE Symposium on security and privacy (SP)_ , pages 866–882. IEEE, 2021.
  * Niederreiter [1972] H. Niederreiter.  Discrepancy and convex programming.  _Annali di matematica pura ed applicata_ , 93:89–97, 1972.
  * Papernot et al. [2016] N. Papernot, P. McDaniel, A. Sinha, and M. Wellman.  Towards the science of security and privacy in machine learning.  _arXiv preprint arXiv:1611.03814_ , 2016.
  * Paszke et al. [2017] A. Paszke, S. Gross, S. Chintala, G. Chanan, E. Yang, Z. DeVito, Z. Lin, A. Desmaison, L. Antiga, and A. Lerer.  Automatic differentiation in pytorch.  In _NIPS-W_ , 2017.
  * Paszke et al. [2019] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, et al.  Pytorch: An imperative style, high-performance deep learning library.  _Advances in neural information processing systems_ , 32, 2019.
  * Radford et al. [2019] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever.  Language models are unsupervised multitask learners.  2019\.
  * Rezaei and Liu [2021] S. Rezaei and X. Liu.  On the difficulty of membership inference attacks.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 7892–7900, 2021.
  * Shokri et al. [2017] R. Shokri, M. Stronati, C. Song, and V. Shmatikov.  Membership inference attacks against machine learning models.  In _2017 IEEE symposium on security and privacy (SP)_ , pages 3–18. IEEE, 2017.
  * Song and Mittal [2021] L. Song and P. Mittal.  Systematic evaluation of privacy risks of machine learning models.  In _30th USENIX Security Symposium (USENIX Security 21)_ , pages 2615–2632, 2021.
  * [47] S. Song and D. Marn.  Introducing a new privacy testing library in tensorflow (2020).  _URL https://blog. tensorflow. org/2020/06/introducing-new-privacy-testing-library. html_.
  * Touvron et al. [2023] H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale, et al.  Llama 2: Open foundation and fine-tuned chat models.  _arXiv preprint arXiv:2307.09288_ , 2023.
  * Watson et al. [2021] L. Watson, C. Guo, G. Cormode, and A. Sablayrolles.  On the importance of difficulty calibration in membership inference attacks.  In _International Conference on Learning Representations_ , 2021.
  * Wen et al. [2022] Y. Wen, A. Bansal, H. Kazemi, E. Borgnia, M. Goldblum, J. Geiping, and T. Goldstein.  Canary in a coalmine: Better membership inference with ensembled adversarial queries.  _arXiv preprint arXiv:2210.10750_ , 2022.
  * Wu et al. [2023] R. Wu, J. P. Zhou, K. Q. Weinberger, and C. Guo.  Does label differential privacy prevent label inference attacks?  In _International Conference on Artificial Intelligence and Statistics_ , pages 4336–4347. PMLR, 2023.
  * Wu et al. [2022] Y. Wu, N. Yu, Z. Li, M. Backes, and Y. Zhang.  Membership inference attacks against text-to-image generation models.  2022\.
  * Yeom et al. [2018] S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha.  Privacy risk in machine learning: Analyzing the connection to overfitting, 2018.
  * Yu et al. [2021] D. Yu, S. Naik, A. Backurs, S. Gopi, H. A. Inan, G. Kamath, J. Kulkarni, Y. T. Lee, A. Manoel, L. Wutschitz, et al.  Differentially private fine-tuning of language models.  In _International Conference on Learning Representations_ , 2021.
  * Yun et al. [2019] S. Yun, D. Han, S. J. Oh, S. Chun, J. Choe, and Y. Yoo.  Cutmix: Regularization strategy to train strong classifiers with localizable features.  In _International Conference on Computer Vision (ICCV)_ , 2019.
  * Zhang et al. [2018] H. Zhang, M. Cisse, Y. N. Dauphin, and D. Lopez-Paz.  mixup: Beyond empirical risk minimization, 2018.
  * Zhang et al. [2020] Y. Zhang, R. Jia, H. Pei, W. Wang, B. Li, and D. Song.  The secret revealer: Generative model-inversion attacks against deep neural networks.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pages 253–261, 2020.
  * Zhong et al. [2020] Z. Zhong, L. Zheng, G. Kang, S. Li, and Y. Yang.  Random erasing data augmentation.  In _Proceedings of the AAAI conference on artificial intelligence_ , volume 34, pages 13001–13008, 2020.
  * Zhu et al. [2019] L. Zhu, Z. Liu, and S. Han.  Deep leakage from gradients.  _Advances in neural information processing systems_ , 32, 2019.
  * Zhu et al. [2024] M. Zhu, C. Guo, C. Feng, and O. Simeone.  Uncertainty, calibration, and membership inference attacks: An information-theoretic perspective.  _arXiv preprint arXiv:2402.10686_ , 2024.
  * Ziegler [2012] G. M. Ziegler.  _Lectures on polytopes_ , volume 152.  Springer Science & Business Media, 2012.

##  Appendix A Proofs of Theorems in Section 3

###  A.1 Proof of Theorem 1

###### Proof of Theorem 1..

We start from some notations. Given a discriminative set
$Q\subseteq\mathbb{R}^{2C}$, we define an MIA
$m_{Q}(f,z):=\mathds{1}[(f(x),y)\in Q]$.

The proof for $m_{msp,\tau}$ and $m_{ent,\tau}$ is straightforward because the
MSP score and the ENT score are convex/concave in $(f(x),y)$, hence
thresholding the convex/concave function gives a convex/concave discriminative
set.

For $m_{\rm CE}$, it takes more effort, because
$\sum_{c\in[C]}-y_{c}\log(f(x)_{c})$ is no longer convex in $(f(x),y)$. We
will construct a $\tilde{m}(f,z)=\mathds{1}\left[g(f,z)<\tau\right]$ for
$(f(x),y)\in(0,1]^{C}\times[0,1]^{C}$, which has the following property:

  1. 1.

$g(f,z)=\sum_{c\in[C]}-y_{c}\log(f(x)_{c})$, for $(f(x),y)$ in
$(0,1]^{C}\times{\color[rgb]{1,0,0}\\{}0,1{\color[rgb]{1,0,0}\\}}^{C}$.

  2. 2.

$g(f,z)$ is a convex function of $(f(x),y)$ on $(0,1]^{C}\times[0,1]^{C}$.

If such $\tilde{m}$ exists, because of the second property, by following the
same argument for $m_{\rm MSP}$, we can prove there exists a convex set
$Q\subseteq\mathbb{R}^{2C}$ s.t. $m_{Q}(f,z)=\tilde{m}(f,z)$. Moreover,
property 1 implies that $m(f,z)=\tilde{m}(f,z)$ for all
$(f(x),y)\in\\{(f(x),y)|(x,y)\in S\cup D_{\rm test}\\}$, which completes the
proof.

Now we are going to show the construction of
$\tilde{m}(f,z)=\mathds{1}\left[g(f,z)<\tau\right]$. We define

$g(f,z):=\sum_{c\in[C]}-y_{c}\log(f(x)_{c})+\sum_{c:y_{c}\neq
0}y_{c}\log(y_{c}),\forall(f(x),y)\in(0,1]^{C}\times[0,1]^{C}.$

By definition, property 1 naturally holds. We are going to verify the property
2. Firstly, $g(f,z)$ is a continuous function on $(0,1]^{C}\times[0,1]^{C}$ by
the fact that $\lim_{a\to 0}a\log(a)=0$. Secondly, we can prove
$\nabla^{2}_{f(x),y}g(f,z)\succeq\mathbf{0}\
\forall(f(x),y)\in(0,1]^{C}\times{\color[rgb]{1,0,0}(}0,1]^{C}$. It is
sufficient to prove $\nabla^{2}_{f(x)_{c},y_{c}}g(f,z)\succeq\mathbf{0}$
because $\nabla^{2}_{f(x)_{c},y_{c^{\prime}}}g(f,z)=\mathbf{0}$ when $c\neq
c^{\prime}$. To see $\nabla^{2}_{f(x)_{c},y_{c}}g(f,z)\succeq\mathbf{0}$,
$\forall\mathbf{a}\in\mathbb{R}^{2}$,

$\mathbf{a}\nabla^{2}_{f(x)_{c},y_{c}}g(f,z)\mathbf{a}^{\top}=\frac{y_{c}}{f(x)_{c}^{2}}\mathbf{a}_{1}^{2}-\frac{2}{f(x)_{c}}\mathbf{a}_{1}\mathbf{a}_{2}+\frac{1}{y_{c}}\mathbf{a}_{2}^{2}=\frac{1}{y_{c}}\left(\frac{y_{c}}{f(x)_{c}}\mathbf{a}_{1}-\mathbf{a}_{2}\right)^{2}\geq
0.$

Therefore $g(f,z)$ is a convex function of $(f(x),y)$ on
$(0,1]^{C}\times[0,1]^{C}$.

Similarly, for $m_{\rm ME}$, we are going to construct an $F$ such that

  1. 1.

$g(f,z)=-\sum_{c\in[C]}\left((1-f(x)_{c})\log(f(x)_{c})y_{c}+f(x)_{c}\log(1-f(x)_{c})(1-y_{c})\right)$
for $(f(x),y)$ in $(0,1]^{C}\times\\{0,1\\}^{C}$.

  2. 2.

$g(f,z)$ is a convex function of $(f(x),y)$ on $(0,1]^{C}\times[0,1]^{C}$.

We define

$g(f,z):=-\sum_{c\in[C]}\left((1-f(x)_{c})\log(f(x)_{c})y_{c}+f(x)_{c}\log(1-f(x)_{c})(1-y_{c})\right)$
$+5\sum_{c:y_{c}\neq 0}y_{c}\log(y_{c})+5\sum_{c:y_{c}\neq
1}(1-y_{c})\log(1-y_{c}).$

By definition, property 1 naturally holds. We are going to verify the property
2. Firstly, $g(f,z)$ is a continuous function on $(0,1]^{C}\times[0,1]^{C}$ by
the fact that $\lim_{a\to 0}a\log(a)=0$. Secondly, we can prove
$\nabla^{2}_{f(x),y}g(f,z)\succeq\mathbf{0}\
\forall(f(x),y)\in(0,1]^{C}\times{\color[rgb]{1,0,0}(}0,1]^{C}$. It is
sufficient to prove $\nabla^{2}_{f(x)_{c},y_{c}}g(f,z)\succeq\mathbf{0}$
because $\nabla^{2}_{f(x)_{c},y_{c^{\prime}}}g(f,z)=\mathbf{0}$ when $c\neq
c^{\prime}$. To see $\nabla^{2}_{f(x)_{c},y_{c}}g(f,z)\succeq\mathbf{0}$,
$\forall\mathbf{a}\in\mathbb{R}^{2}$,

$\displaystyle\mathbf{a}\nabla^{2}_{f(x)_{c},y_{c}}g(f,z)\mathbf{a}^{\top}$
$\displaystyle=\left(y_{c}\cdot\left(\frac{1}{f(x)_{c}^{2}}+\frac{1}{f(x)_{c}}\right)+(1-y_{c})\cdot\left(\frac{1}{(1-f(x)_{c})^{2}}+\frac{1}{1-f(x)_{c}}\right)\right)\mathbf{a}_{1}^{2}$
$\displaystyle+2\left(\frac{1}{1-f(x)_{c}}-\frac{1}{f(x)_{c}}+\log(f(x)_{c})-\log(1-f(x)_{c})\right)\mathbf{a}_{1}\mathbf{a}_{2}+\left(\frac{3}{y_{c}}+\frac{3}{1-y_{c}}\right)\mathbf{a}_{2}^{2}$
$\displaystyle=\frac{1}{y_{c}}\left(\frac{y_{c}}{f(x)_{c}}\mathbf{a}_{1}-\mathbf{a}_{2}\right)^{2}+\frac{1}{1-y_{c}}\left(\frac{1-y_{c}}{1-f(x)_{c}}\mathbf{a}_{1}-\mathbf{a}_{2}\right)^{2}$
$\displaystyle+\left(\frac{y_{c}}{f(x)_{c}}\mathbf{a}_{1}^{2}+2\log(f(x)_{c})\mathbf{a}_{1}\mathbf{a}_{2}+\frac{4}{y_{c}}\mathbf{a}_{2}^{2}\right)+\left(\frac{1-y_{c}}{1-f(x)_{c}}\mathbf{a}_{1}^{2}+2\log(1-f(x)_{c})\mathbf{a}_{1}\mathbf{a}_{2}+\frac{4}{1-y_{c}}\mathbf{a}_{2}^{2}\right)$
$\displaystyle\geq\left(\frac{y_{c}}{f(x)_{c}}\mathbf{a}_{1}^{2}+2\log(f(x)_{c})\mathbf{a}_{1}\mathbf{a}_{2}+\frac{4}{y_{c}}\mathbf{a}_{2}^{2}\right)+\left(\frac{1-y_{c}}{1-f(x)_{c}}\mathbf{a}_{1}^{2}+2\log(1-f(x)_{c})\mathbf{a}_{1}\mathbf{a}_{2}+\frac{4}{1-y_{c}}\mathbf{a}_{2}^{2}\right)$

We are going to first prove
$\frac{y_{c}}{f(x)_{c}}\mathbf{a}_{1}^{2}+2\log(f(x)_{c})\mathbf{a}_{1}\mathbf{a}_{2}+\frac{4}{y_{c}}\mathbf{a}_{2}^{2}\geq
0$. Because $\frac{y_{c}}{f(x)_{c}}>0$, it is sufficient to prove
$(2\log(f(x)_{c}))^{2}\leq 4\cdot\frac{y_{c}}{f(x)_{c}}\cdot\frac{4}{y_{c}}$,
which is equivalent to $-\log(f(x)_{c})\leq 2\sqrt{\frac{1}{f(x)_{c}}}$.
Define $h(f(x)_{c})=2\sqrt{\frac{1}{f(x)_{c}}}+\log(f(x)_{c})$. $\forall
f(x)_{c}\in(0,1]$,
$h^{\prime}(f(x)_{c})=-\frac{1}{\sqrt{f(x)_{c}}f(x)_{c}}+\frac{1}{f(x)_{c}}<0$.
Thus, $h(f(x)_{c})\geq h(1)=\sqrt{2}>0$ and
$\frac{y_{c}}{f(x)_{c}}\mathbf{a}_{1}^{2}+2\log(f(x)_{c})\mathbf{a}_{1}\mathbf{a}_{2}+\frac{4}{y_{c}}\mathbf{a}_{2}^{2}\geq
0$ has been proved.

Similarly, we can prove
$\left(\frac{1-y_{c}}{1-f(x)_{c}}\mathbf{a}_{1}^{2}+2\log(1-f(x)_{c})\mathbf{a}_{1}\mathbf{a}_{2}+\frac{4}{1-y_{c}}\mathbf{a}_{2}^{2}\right)\geq
0$ and we have completed the proof for
$\mathbf{a}\nabla^{2}_{f(x)_{c},y_{c}}g(f,z)\mathbf{a}^{\top}\geq 0$. We now
have the convexity of $g(f,z)$ on $(0,1]^{C}\times[0,1]^{C}.$ ∎

###  A.2 Proof of Proposition 2

###### Proof of Proposition 2.

Our proof mostly follows the proof in Niederreiter [39]. Suppose $z=(x,y)$.
$\forall Q\in\mathcal{Q}_{cvx}^{\prime}$, we are going to find
$Q_{1},Q_{2}\in\mathcal{Q}_{cvx,k}^{\prime}$ such that
$\mathbb{P}_{z\sim\mathcal{D}}((f(x),y)\in
Q_{1})\leq\mathbb{P}_{z\sim\mathcal{D}}((f(x),y)\in
Q)\leq\mathbb{P}_{z\sim\mathcal{D}}((f(x),y)\in Q_{2})$ and $\mathbb{P}_{z\sim
S}((f(x),y)\in Q)=\mathbb{P}_{z\sim S}((f(x),y)\in Q_{1})=\mathbb{P}_{z\sim
S}((f(x),y)\in Q_{2})$. Within this $Q_{1},Q_{2}$,

$D(S,\mathcal{D}|Q)\leq\max\\{D(S,\mathcal{D}|Q_{1}),D(S,\mathcal{D}|Q_{2})\\},$

and therefore $D_{\mathcal{Q}_{cvx}^{\prime}}(S,\mathcal{D})\leq
D_{\mathcal{Q}_{cvx,k}^{\prime}}(S,\mathcal{D})$. It is obvious that
$D_{\mathcal{Q}_{cvx}^{\prime}}(S,\mathcal{D})\geq
D_{\mathcal{Q}_{cvx,k}^{\prime}}(S,\mathcal{D})$ because
$\mathcal{Q}_{cvx,k}^{\prime}\subseteq\mathcal{Q}_{cvx}^{\prime}$. Thus
$D_{\mathcal{Q}_{cvx}^{\prime}}(S,\mathcal{D})=D_{\mathcal{Q}_{cvx,k}^{\prime}}(S,\mathcal{D})$.

To find $Q_{1}$, for any convex set $Q\in Q_{cvx}$, if $Q\cap S=\emptyset$, we
simply choose $Q_{1}=\emptyset$. If $Q\cap S\neq\emptyset$, we can consider a
convex hull $Q_{1}$ for $Q\cap S$. From the definition of the convex hull,
$Q_{1}\subseteq Q$. In both two cases above,

$\displaystyle\mathbb{P}_{z\sim S}((f(x),y)\in
Q)-\mathbb{P}_{z\sim\mathcal{D}}((f(x),y)\in Q)\leq\mathbb{P}_{z\sim
S}((f(x),y)\in Q_{1})-\mathbb{P}_{z\sim\mathcal{D}}((f(x),y)\in Q_{1})$

Because $Q\cap S$ is a discrete point set, the convex hull $Q_{1}$ would be a
convex polytope whose vertices are a subset of $Q\cap S$. The Upper Bound
Theorem [61] shows that the number of facets of a convex polytope with at most
$|S|$ vertices can be bounded by $\binom{|S|}{2C}$, where $2C$ is the
dimensionality of the space.

To find $Q_{2}$, we follow the proof in Niederreiter [39] to construct a
$Q^{\prime}$ first: Because $Q$ is a closed set by assumption, for each $z\in
S\backslash(Q\cap S)$, we can find a supporting hyperplane of $Q$ such that
$Q$ lies in the closed halfspace $H_{z}$ defined by this supporting
hyperplane. Then we can define $Q_{2}:=\cap_{z\in S\backslash(Q\cap S)}H_{z}$.
Obviously, $Q\subseteq Q_{2}$ by the definition of $H_{z}$. Therefore,
$\mathbb{P}_{z\sim\mathcal{D}}((f(x),y)\in
Q)\leq\mathbb{P}_{z\sim\mathcal{D}}((f(x),y)\in Q_{2})$. Moreover, $\forall
z\in S\backslash(Q\cap S)$, $z\notin Q_{2}$; $\forall z\in Q\cap S$, $z\in
Q\subseteq Q_{2}$. Thus, $\mathbb{P}_{z\sim S}((f(x),y)\in
Q)=\mathbb{P}_{z\sim S}((f(x),y)\in Q_{2})$. Lastly, by the definition
$Q_{2}$, it is a convex polytope with at most $|S|\leq\binom{|S|}{2C}$ facets.

∎

##  Appendix B Additional Experiment Results

#### CPM setup.

For the models trained on CIFA-10, CIFAR-100, Purchase100 and Texas100, we get
our new metric CPM by optimizing the objective in Equation 3 and pick the
number of facets $K=1000$, lr $=0.1,0.01,0.001$ and batch size 10000. For
ImageNet pre-trained models, we get CPM with $K=1000$, lr $=0.001$ and batch
size = 512. The optimizer is Adam. We select hyper-parameters that give the
minimum optimization loss. All optimizations are conducted with GPU on NVIDIA
GeForce RTX 3080, and the longest time for one optimization is 20 minutes.

#### Effect of $K$ for approximation quality of CPM on additional datasets.

The parameter $K$ in the CPM computation measures approximation quality. We
plot the advantage of CPM versus the number of facets $K$ for other three
datasets CIFAR-10 (Figure 4), Texas (Figure 5), Purchase (Figure 6). We see
the similar behavior to the figure of CIFAR-100 (Figure 4.2) in the main
paper, that is, this is a monotone increasing function where larger $K$ has
higher advantage, suggesting that CPM is approaching the true upper bound CPB
well when $K$ is getting larger. Furthermore, for MixUp and RelaxLoss models,
we see that the CPM outperforms the advantage of other scores even at $K=100$,
which suggests that in these cases, even a reasonably large value of $K$ can
achieve larger advantage.

(a) Vanilla

(b) MixUp

(c) Relaxloss

Figure 4: The advantage on CIFAR-10 when we find CPM with different numbers of
facets $K$.

(a) Vanilla

(b) MixUp

(c) Relaxloss

Figure 5: The advantage on Texas when we find CPM with different numbers of
facets $K$.

(a) Vanilla

(b) MixUp

(c) Relaxloss

Figure 6: The advantage on Purchase when we find CPM with different numbers of
facets $K$.


# A Technical Report for ICCV 2021 VIPriors Re-identification Challenge

Cen Liu, Yunbo Peng, Yue Lin
NetEase Games AI Lab
{liucen01, gzpengyunbo<EMAIL_ADDRESS>

###### Abstract

Person re-identification has always been a hot and challenging task. This
paper introduces our solution for the re-identification track in VIPriors
Challenge 2021. In this challenge, the difficulty is how to train the model
from scratch without any pretrained weight. In our method, we show use state-
of-the-art data processing strategies, model designs, and post-processing
ensemble methods, it is possible to overcome the difficulty of data shortage
and obtain competitive results. (1) Both image augmentation strategy and novel
pre-processing method for occluded images can help the model learn more
discriminative features. (2) Several strong backbones and multiple loss
functions are used to learn more representative features. (3) Post-processing
techniques including re-ranking, automatic query expansion, ensemble learning,
etc., significantly improve the final performance. The final score of our team
(ALONG) is 96.5154% mAP, ranking first in the leaderboard.

##  1 Introduction

2021 VIPriors Re-identification Challenge is one of “2nd Visual Inductive
Priors for Data-Efficient Deep Learning Workshop” in the ICCV2021 conference.
It focuses on obtaining high mean Average Precision (mAP) on a dataset coming
from short sequences of basketball games. This dataset contains 8,569 person
images of 436 identities in the training set while testing data is composed of
the 9,171 images of 468 identities.

Person re-identification (ReID) aims at recognizing pedestrians across non-
overlapping camera views, which draws wide attention due to its wide
applications in surveillance, tracking, smart retail, etc. [16, 15, 12, 7]. As
deep learning prevails, the CNN based ReID methods progress rapidly and
achieve impressive performance on benchmark datasets. However, this challenge
restricts the use of external data and pre-trained weights, due to the small
dataset, it is difficult to perform well with general training due to the
small dataset..

We solve this problem by experimenting with various techniques. In our method,
based on strong backbones, we use multiple loss functions, data augmentation
strategies, and ensemble learning to improve the performance.

Figure 1: Illustration of same noise data samples with varying degrees of
occlusion. The is partial occlusion is in the first row; the second row is
completely occluded (the label of the images in the second row is the person
occluded). Figure 2: Illustration of our proposed framework.

First, we focus on the data augmentation in data pre-processinging such as
Random Erasing [18], Local Grayscale Transformation [2] and random flip
horizontally, etc., to improve the diversity of person images. In addition,
there are different degrees of occlusion in the raw data, which lead to the
problem of noise in network training and result in hard samples. To address
these challenges, we use hard sampling method to select difficult samples and
clean noise samples. Then, we apply strong backbones, multiple loss functions
and add some training tricks by this paper [8] to enable model training well
with even a small amount of data. Finally, we apply automatic query expansion
(AQE) [1] and re-rank [17], and post-processing ensemble techniques, etc. to
compensate for the difficult problems through various models and multi-scale
testing to produce good performance. Through the model applies with these
techniques, our approach can significantly improve the ReID performance and
achieve a competitive result on the test set. According to the rules of the
competition, we do not use any external image/video data or pre-trained
weights. The implementation details of our solution are described in section 2
and section 3.

##  2 Our Method

In this section, our method for this challenge is introduced in detail. The
critical parts of our method include data pre-processing, model architecture,
loss function and post-processing techniques, which are elaborated in detail
as follows.

###  2.1 Pre-processing

Due to the limited quantity and quality of original data, effective data pre-
processing technology can improve the recognition performance of the model.

Noise Resist and Hard Sample Mining: Most of the person re-identification
datasets contain a small portion of noisy labels, which requires the learning
algorithm to resist certain amount of noises. Through our observation of this
dataset, we find that there is also a lot of labeling noise. Therefore, we
choose the online difficult sample mining algorithm proposed by Shrivastava et
al. [10] to mine the “hard sample (noise)” data according to the loss of the
training set in the training stage. The noise data we filtered out is shown in
Figure 1. We can see that this part of the data has different degrees of
person occlusion.

Our initial approach is to delete this part of “noise” data, but we find that
if all occlusion data are deleted through experiments, the results of the test
set fall rather than rise. We find the main reason is that there is occlusion
data in the test set, but the occlusion is not serious (not complete
occlusion). As shown in figure 1, the partial occlusion is in the first row;
the second row is completely occluded (the label of the images in the second
row is occluded by person). Therefore, inspired by [10], we divide samples
with different degrees of occlusion into partial occlusion and full occlusion,
according to the training loss and the selected threshold. Our approach is to
delete completely occluded samples as noise data. The data with slight
occlusion is not deleted, but as the “hard samples” in training stage, and
several data augmentations are used for the “hard samples”, increasing the
proportion of hard samples in the original training set. In this way, we make
the network focus on the optimization of this occlusion sample. The results
show that our method of hard sample mining is effective to improve the
performance of our network.

Data Augmentation: Data augmentation can effectively prevent overfitting. To
solve the limitation of training data, we adopt some data augmentation
strategies, such as Random Erasing [18], Local Grayscale Transformation [2].

Random Erasing [18]: In person ReID, persons in the images are sometimes
occluded by other objects. To address the occlusion problem and improve the
generalization ability of ReID models, Zhong et al. [18] proposed a new data
augmentation approach named as Random Erasing Augmentation.

Local Grayscale Transformation(LGT) [2]: Through the observation of the
original dataset, we find that most of the personnel are players of the same
team, so their dresses and appearances are very similar. Howerver, they have
the different spatial structures. To address this problem, this method can be
used as an effective data augmentation by introducing grayscale information,
which proposed by Gong [2]. With this strategy, our model can achieve
significant improvements in ReID task.

Besides the above two specific data augmentation methods, some regular augment
methods are applied, such as random affine transformation, pixel padding,
random flipping, etc.

Imbalance Identities Resist: Even if the data provider claims that in the
training set, sequence is composed by 20 frames in the training set. But
through statistics, we find that there are less than 20 images in IDs such as
ID31 and ID164. We use the balanced ID data augmentation on the training set,
copy few images up to 5 times, and several data augmentations are used for the
copied images.

Figure 3: Split-Attention Block of ResNeSt.

###  2.2 Model Architecture

Baseline model is important for the final ranking, we use a CNN-based baseline
[8] shown in Figure 2. And besides ResNet [4], we also use ResNeSt [14] and
SE-ResNeXt [13] as our backbones. These models are introduced as follows.

ResNeSt: The key part of ResNeSt is Split-Attention block. Split-Attention
block is a computational unit consisting of feature-map group and split
attention operations. Figure 3 depicts an overview of the Split-Attention
Block.

SE-ResNeXt: SE-ResNeXt is constructed by repeating a building block that
aggregates a set of transformations with the same topology. SE block [6]
adaptively recalibrates channel-wise feature responses by explicitly modelling
interdependencies between channels. SE-ResNeXt has good performance in
multiple tasks and is widely used.

Other Techniques: Various techniques are also applied. First, the aggregation
layer aims to aggregate feature maps generated by the backbone into a global
feature, and we use the Generalized-Mean (GeM) pooling [9] instead of GAP
proposed in [8]. Second, dropout is used for preventing overfitting. Finally,
we remove the last spatial downsampling operation in the backbone network to
increase the size of the feature map. For convenience, we denote the last
spatial down-sampling operation in the backbone network as last stride.

###  2.3 Loss function

Categorical cross-entropy(CE) loss after softmax and triplet loss [5] are
widely used in person ReID task. But for VIPriors ReID dataset, we find that
circle loss [11] performs better than CE loss. The total loss is proposed as
follows for better performance.

$L=\alpha L_{Triplet}+\beta L_{circle}$ (1)

Triplet Loss: The triplet loss is computed as:

$L_{Triplet}=[d_{p}-d_{n}+\alpha]_{+}$ (2)

where $d_{p}$ and $d_{n}$ are feature distances of positive pair and negative
pair. $\alpha$ is the margin of triplet loss, and $[z]_{+}$ equals to
$max(z,0)$. In this paper, $\alpha$ is set to 0.4. However, triplet loss only
considers the difference between $d_{p}$ and $d_{n}$ and ignores the absolute
values of them.

Circle Loss: The circle loss benefits deep feature learning with high
flexibility in optimization and more definite convergence target. It has a
unified formula for two elemental learning approaches, i.e., learning with
class-level labels and learning with pair-wise labels, more suitable for
person ReID task. The derivation process of circle loss is not described here
in detail, which can refer to [11].

It is worth mentioning that in the Circle Loss, the relaxation factor $m$ is a
very important hyper-parameter. We find that different $m$ may have different
results in training, but this difference is very conducive to the ensemble of
models. This point will be explained in detail in section 3.3.

###  2.4 Post-processing

Post-processing can significantly improve ReID performance in the inference
stage. In this section, we will introduce several post-processing methods in
this paper.

Augmentation Test: For each test image, we flip these two images horizontally
and additionally extract two features. We get two features totally and then
average them to obtain the final ReID feature.

Re-Ranking: We adopt a widely-used Re-ranking (RK) method [17] to update the
final result. We notice that Jaccard distance is more suitable than Euclidean
distance due to many people dressing in the same team uniform. We set
$\lambda=0.1$ in this paper.

Query expansion: We also use QE [1] to improve the performance of the
retrieval system. But compared to re-ranking, the improvement of this
technique is not significant.

##  3 Experiments

###  3.1 Implementation Details

All of our experiments are conducted in 8 NVIDIA A100 GPUs. In the training
stage, we train the model for 180 epochs with warming up [3] with initial
learning rate of 0.0001 in first 10 epochs, increasing the learning rate from
0.0001 to 0.005 and dropout with probability of 0.2, weight decay of 0.0001
and label smooth are used for learning. In early stage, we trained model on
training set for methods attempt and verification. And in the final stage, we
trained models on both training set and validation set, and no external images
or pre-trained weights are used. In addition, in order to obtain a better
model, the model is trained several times by varying the random seed, and the
results are combined together and treated as a whole, improving model mAP by
0.8%.

###  3.2 Results

We show the ablation study of above different strategies in Table 1. The
baseline with ResNet50 trains on training set and evaluates on the validation
set with the input size of $256\times 128$. The baseline with ResNet50
backbone network can achieves 93.4708% on validation set. Besides, it can be
find that the strategies we proposed improve the performance by almost 18% in
terms of mAP, which shows the effectiveness of these techniques.

Table 1: The ablation study of different strategies on validation set. With all methods, ResNet50 achieves 93.4708% mAP. Method | mAP(%)
---|---
Baseline(ResNet50) | 76.2044
\+ Noise Resist | 78.0190
\+ Hard Sample Mining | 80.9477
\+ Data Augmentation(Random Erasing and LGT) | 81.4552
\+ Gem Pooling | 83.8275
\+ Circle Loss | 84.9631
\+ Augmentation Test | 85.2631
\+ Re-rank | 93.0423
\+ AQE | 93.1172
\+ Large Input Size($384\times 128$) | 93.4708

###  3.3 Ensembling

Experimental evidence shows that the ensemble method is usually much more
accurate than a single model. In our method, the ensemble method is the
addition of the distance matrix of all prediction. For a better performance,
we have ensembled predictions of above methods in total 24 models including
ResNet101, ResNet152, ResNet200, ResNeSt-101, ResNeSt-152, ResNeSt-200, SE-
ResNeXt101, SE-ResNeXt152, SE-ResNeXt200, with different input sizes and
different relaxation factor $m$ of circle loss.

Tips: We trained all models on both training set and validation set, for each
backbone, we use two different sizes ($384\times 128$ and $384\times 192$) as
input. Besides, different relaxation factor $m$ of circle loss will get
different results, and we find that fusing the results has a certain
improvement. Specifically, we set $m=0.3$ and $m=0.4$. Therefore, we fuse all
the results as the final submission. The 96.5154% in mAP is the final ensemble
results, ranking first in the learderboard.

##  4 Conclusion

In our method, three strong network architectures were taken as the backbones.
The usage of multiple data pre-processing and post-processing strategies
improves the performance of the models. Besides, multiple testing methods and
ensemble strategies improve the generalization and robustness of the models
and prevent overfitting. Finally, we win the 1st place in VIPriors re-
identification competition.

## References

  * [1] O. Chum, J. Philbin, J. Sivic, M. Isard, and A. Zisserman.  Total recall: Automatic query expansion with a generative feature model for object retrieval.  In 2007 IEEE 11th International Conference on Computer Vision, pages 1–8. IEEE, 2007.
  * [2] Y. Gong.  A general multi-modal data learning method for person re-identification.  2021\.
  * [3] P. Goyal, P. Dollár, R. Girshick, P. Noordhuis, L. Wesolowski, A. Kyrola, A. Tulloch, Y. Jia, and K. He.  Accurate, large minibatch sgd: Training imagenet in 1 hour.  arXiv preprint arXiv:1706.02677, 2017.
  * [4] K. He, X. Zhang, S. Ren, and J. Sun.  Deep residual learning for image recognition.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016.
  * [5] A. Hermans, L. Beyer, and B. Leibe.  In defense of the triplet loss for person re-identification.  arXiv preprint arXiv:1703.07737, 2017.
  * [6] J. Hu, L. Shen, and G. Sun.  Squeeze-and-excitation networks.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 7132–7141, 2018.
  * [7] C. Liu, L.-J. Guo, and R. Zhang.  Hlfnet: High-low frequency network for person re-identification.  IEEE Signal Processing Letters, 2021.
  * [8] H. Luo, Y. Gu, X. Liao, S. Lai, and W. Jiang.  Bag of tricks and a strong baseline for deep person re-identification.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pages 0–0, 2019.
  * [9] F. Radenović, G. Tolias, and O. Chum.  Fine-tuning cnn image retrieval with no human annotation.  IEEE transactions on pattern analysis and machine intelligence, 41(7):1655–1668, 2018.
  * [10] A. Shrivastava, A. Gupta, and R. Girshick.  Training region-based object detectors with online hard example mining.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 761–769, 2016.
  * [11] Y. Sun, C. Cheng, Y. Zhang, C. Zhang, L. Zheng, Z. Wang, and Y. Wei.  Circle loss: A unified perspective of pair similarity optimization.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6398–6407, 2020.
  * [12] Y. Sun, L. Zheng, Y. Yang, Q. Tian, and S. Wang.  Beyond part models: Person retrieval with refined part pooling (and a strong convolutional baseline).  In Proceedings of the European conference on computer vision (ECCV), pages 480–496, 2018.
  * [13] S. Xie, R. Girshick, P. Dollár, Z. Tu, and K. He.  Aggregated residual transformations for deep neural networks.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1492–1500, 2017.
  * [14] H. Zhang, C. Wu, Z. Zhang, Y. Zhu, H. Lin, Z. Zhang, Y. Sun, T. He, J. Mueller, R. Manmatha, et al.  Resnest: Split-attention networks.  arXiv preprint arXiv:2004.08955, 2020.
  * [15] L. Zhao, X. Li, Y. Zhuang, and J. Wang.  Deeply-learned part-aligned representations for person re-identification.  In Proceedings of the IEEE international conference on computer vision, pages 3219–3228, 2017.
  * [16] L. Zheng, L. Shen, L. Tian, S. Wang, J. Wang, and Q. Tian.  Scalable person re-identification: A benchmark.  In Proceedings of the IEEE international conference on computer vision, pages 1116–1124, 2015.
  * [17] Z. Zhong, L. Zheng, D. Cao, and S. Li.  Re-ranking person re-identification with k-reciprocal encoding.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1318–1327, 2017.
  * [18] Z. Zhong, L. Zheng, G. Kang, S. Li, and Y. Yang.  Random erasing data augmentation.  In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 13001–13008, 2020.