# Wavefunction of Plasmon Excitations with Space Charge Effects

M. Akbari-Moghanjoughi  Faculty of Sciences, Department of Physics, Azarbaijan
Shahid Madani University, 51745-406 Tabriz, Iran

###### Abstract

The one dimensional (1D) driven quantum coupled pseudoforce system governing
the dynamics of collective Langmuir electron oscillations is used in order to
investigate the effects of variety of space charge distributions on plasmon
excitations of a nearly free electron gas with arbitrary degree of degeneracy
and electron fluid temperature. A generalized closed form analytic expression
for the grand wavefunction of collective excitations in presence of an
arbitrary space charge distribution is presented based on the stationary
solutions of the driven coupled pseudoforce system which has been derived from
the Schrödinger-Poisson model. The wavefunction and electrostatic potential
profiles for some especial cases such as the Heaviside charge distribution,
Dirac charge sheet, impurity charge sheet in 1D plasmonic lattice and the
Kroning-Penney Dirac charge distributions with particular applications in
plasmonics and condensed matter physics is investigated in this paper. It is
remarkably found that two parallel Dirac charged sheets completely shield all
interior plasmon excitations with any given energy value from outside
electrostatic fields and charge densities. It is also found that the presence
of even a weakly charged impurity layer within a perfect 1D plasmonic crystal
profoundly destroys the periodic electrostatic field of the crystal lattice,
hence, the Bloch character of the wavefunction considered in band gap theory
of solids. Current investigation of electron excitations in arbitrary
degenerate electron gas in the presence of static charge distributions may be
used to develop analytic models for a variety of real physical situations. It
also helps in further developments of the rapidly growing fields of
nanotechnology and plasmonics.

###### pacs:

52.30.-q,71.10.Ca, 05.30.-d

##  I Introduction

Collective effects play a fundamental role in many body fermionic and bosonic
systems like solids kittel ; ash . In fermionic systems like plasmas multi-
ingredient aspects lead to variety of interesting linear and nonlinear
properties due to colorful interactions among different species chen ; krall ;
drazin ; klimontovich . Therefore, a lot of analytical as well as numerical
methods have been developed over the years to investigate these interesting
aspects of plasmas rowlands ; mitsuo ; davidson ; sagdeev ; karpman . Almost
all physical properties of condensed matter, biological and molecular systems,
electron-hole dynamics in solids etc. are affected by complex collective
electromagnetic interactions markovich ; man ; haug ; gardner ; ae . Dynamic
properties of such complex settings are usually dealt with kinetic and fluid
models manfredi ; shukla1 ; shukla2 ; haasbook . In dense quantum systems with
extra quantum potential interactions, on the other hand, the statistical tools
to study the field-density time evolution require a memory-time consuming
large scale numerical simulations through well-known models like Hartree-Fock,
Wigner-Poisson-Maxwell, magnetohydrodynamic and ground state density
functional, etc. due to large degree of freedom and complex nature of particle
interactions. Nowadays, however, very realistic simulations has been possible
for kiloscale degree of freedom (DoF) systems with the help of improved
computing systems and algorithms which brings into view some interesting
statistical behavior of many body charged systems matt . Recently, the
generation of high-harmonic in metallic nanoparticles has been examined by
numerical evaluation of nonlinear electron dynamics using the quantum
hydrodynamics model incorporating the self-consistent Hartree potential, in
which collective excitations in 200 gold nanoparticles has been examined
hurst1 . In another work the extended quantum hydrodynamic model with Hartree
potential and exchange effect has been employed to numerically study the
plasmon excitations in a quantum trap hurst2 .

Plasmons are elementary collective excitations of free electron systems such
as plasmas, metals, nano-metallic compounds, etc. which cause peculiar quantum
features in physical properties like electric and thermal conductivities,
optical properties and dielectric responses etc. maier . Electron-hole quantum
transport and tunneling through potential barriers in integrated circuits are
typical collective phenomenon understanding of which requires in depth
knowledge of these elementary excitations chenming ; seeger ; bart . Study of
plasmon excitations has started with pioneering works of Bohm bohm , Pines
pines  and Levine levine . There has been however a renewed momentum in
investigation of different aspects of these entities due to their fundamental
contribution to the rapidly growing fields of nonotechnology, optoelectronics,
plasmonics and low dimensional systems. For instance, there has been numerous
recent investigations revealing many outstanding new quantum aspects of
electron plasma oscillations in collective charged environments using density
functional, quantum hydrodynamics and kinetic approaches ydj3 ; ydj4 ; dub3 ;
dub4 ; garcia ; marklund ; stenflo ; shukla0 ; shuklaprl ; nshukla ; bret ; se
; akb1 ; mend ; es ; brod ; sten ; stenf . In this paper we use the newly
introduced concept of coupled pseudoforce akbpseudo1 ; akbpseudo2  based on
the Schrödinger-Poisson to obtain the grand wavefunction which includes the
wavefunction together with the collective electrostatic potential of the free
electron gas with arbitrary degree of electron degeneracy and electron fluid
temperature in Sec. II. This approach is then extended to include the effect
of static charge distribution as the driving pseudoforce in Sec. III. The
later approach is then used to study the plasmon excitations in Heaviside in
Sec. IV and Dirac delta charge distributions and Kronig-Penney model in Sec.
V. Conclusions are also presented in Sec. VI.

##  II Grand Wavefunction of Plasmon Excitations

We would like to study plasmon excitations of finite temperature arbitrary
degenerate electron gas in presence of different electrostatic potential
configurations solving for the plasmon wavefunction and the electrostatic
potential function. Let us now consider a one dimensional isothermal electron
gas with the chemical potential $\mu_{0}$ and fluid temperature $T$. Dynamics
of electron fluid is described using the following effective Schrödinger-
Poisson model which is related to the hydrodynamic formulation as described
elsewhere manfrediprb

$\displaystyle i\hbar\frac{{\partial\cal N}}{{\partial
t}}=-\frac{{{\hbar^{2}}}}{{2m}}\frac{{\partial{{\cal
N}^{2}}}}{{\partial{x^{2}}}}-(e\phi-\mu){\cal N},$ (1a)
$\displaystyle\frac{{\partial{\phi^{2}}}}{{\partial{x^{2}}}}=4\pi en,$ (1b)

in which ${\cal N}=\sqrt{n(x,t)}\exp[iS(x,t)]$ is the time dependent electron
fluid wavefunction with ${\cal N}{\cal N^{*}}=n(x,t)$ and $n(x,t)$ and
$u(x,t)=(1/m)\partial S(x,t)/\partial x$ being the number density and fluid
speed of the arbitrary degenerate electron gas, respectively. The isothermal
electron gas is described via the following generalized equation of state

$\displaystyle{n(\mu,T)}=\frac{{{2^{1/2}}m{{}^{3/2}}}}{{{\pi^{2}}{\hbar^{3}}}}\int_{0}^{+\infty}{\frac{{\sqrt{{\epsilon}}d{\epsilon}}}{{{e^{\beta({\epsilon}-\mu)}}+1}}},$
(2a)
$\displaystyle{P(\mu,T)}=\frac{{{2^{3/2}}m{{}^{3/2}}}}{{3{\pi^{2}}{\hbar^{3}}}}\int_{0}^{+\infty}{\frac{{{{\epsilon}^{3/2}}d{\epsilon}}}{{{e^{\beta({\epsilon}-{\mu})}}+1}}.}$
(2b)

satisfying the thermodynamic identity $\partial P(\mu,T)/\partial\mu=n(\mu,T)$
which has been used to replace the electron statistical pressure with the
chemical potential in the Schrödinger-Poisson model. Each electron in the
system is described by a wavefucntion which is in the linear perturbation
limit a combination of single particle wavefucntion and a collective
electrostatic interaction wavefunction as described elsewhere akbnew . The
later is attributed via the mean field Hartree potential in the Schrödinger-
Poisson model hurst2 . We consider the later model as described in terms of
the electron chemical potential instead of the scalar Fermi pressure which is
assumed to remain constant to the linear order. Therefore assuming ${\cal
N}=\psi_{1}(x)\psi_{2}(t)$ the coupled pseudoforce model describing the
stationary plasmon solution is as follows

$\displaystyle\frac{{d^{2}{\Psi(x)}}}{{d{x^{2}}}}+\Phi(x)=-2E\Psi(x),$ (3a)
$\displaystyle\frac{{d^{2}{\Phi(x)}}}{{d{x^{2}}}}-{\Psi}(x)=0,$ (3b)

in which assuming $\mu\equiv\mu_{0}$, we have used the normalized quantities
in (1) as $\Psi(x)=\psi_{1}(x)/\sqrt{n_{0}}$ where $n_{0}$ is the equilibrium
number density of the electron fluid, $\Phi(x)=e\phi(x)$,
$E=(\epsilon-\mu_{0})/2E_{p}$ ($E_{p}=\hbar\omega_{p}$ with
$\omega_{p}=\sqrt{4\pi e^{2}n_{0}/m}$ being the quantized plasmon energy) and
$x=x/\lambda_{p}$ with $\lambda_{p}=2\pi/k_{p}$ and
$k_{p}=\sqrt{2mE_{p}}/\hbar$ being the characteristic plasmon wavelength.
Also, the time dependent part of the wavefunction reads
$\psi_{2}(t)=\exp(-i\omega t)$ with $\epsilon=\hbar\omega$ being the energy
eigenvalues.

The grand wavefunction ${\cal G}(x,t)$ characterizing the pseudoforce system
3(a) and 3(b) with the boundary conditions
$\Phi^{\prime}(0)=\Psi^{\prime}(0)=0$, $\Phi(0)=\Phi_{0}$ and
$\Psi(0)=\Psi_{0}$ is

${\cal G}(x,t)=\left[{\begin{array}[]{*{20}{c}}{\Phi(x)}\\\
{\Psi(x)}\end{array}}\right]e^{-i\omega t}=\frac{e^{-i\omega
t}}{{2\alpha}}\left[{\begin{array}[]{*{20}{c}}{{\Psi_{0}}+k_{2}^{2}{\Phi_{0}}}&{-\left({{\Psi_{0}}+k_{1}^{2}{\Phi_{0}}}\right)}\\\
{-\left({{\Phi_{0}}+k_{1}^{2}{\Psi_{0}}}\right)}&{{\Phi_{0}}+k_{2}^{2}{\Psi_{0}}}\end{array}}\right]\left({\begin{array}[]{*{20}{c}}{{{\rm{e}}^{i{k_{1}}x}}}\\\
{{{\rm{e}}^{i{k_{2}}x}}}\end{array}}\right),$ (4)

in which $E=\hbar\omega$ is the energy eigenvalue and

${k_{1}}=\sqrt{E-\alpha},\hskip 8.53581pt{k_{2}}=\sqrt{E+\alpha},\hskip
8.53581pt\alpha=\sqrt{{E^{2}}-1}.$ (5)

Note that $k_{1}=1/k_{2}$ holds for any energy eigenvalue $E>1$.

##  III Wavefunction of Driven Plasmon

The following driven pseudoforce system akbpseudo1  describes the plasmon
excitations in the presence of given static charge distribution due to ions or
impurity charge in crystals

$\displaystyle\frac{{d^{2}{\Psi(x)}}}{{d{x^{2}}}}+\Phi(x)=-2E\Psi(x),$ (6a)
$\displaystyle\frac{{d^{2}{\Phi(x)}}}{{d{x^{2}}}}-{\Psi}(x)=n_{i}(x).$ (6b)

For the sinusoidal space charge distribution $n_{i}(x)=C\exp(iKx)$ (with $C$
being the normalized charge density) the particular solution to time
-independent system (3) is

$\displaystyle\Phi_{p}(x)=\frac{C}{{2\alpha}}\left[{\frac{{\left({1+\beta
k_{2}^{2}}\right){e^{i{k_{1}}x}}-\left({1+\beta
k_{1}^{2}}\right){e^{i{k_{2}}x}}-2\alpha\beta{e^{iKx}}}}{{\left({{K^{2}}-k_{1}^{2}}\right)\left({{K^{2}}-k_{2}^{2}}\right)}}}\right],$
(7a)
$\displaystyle\Psi_{p}(x)=\frac{C}{{2\alpha}}\left[{\frac{{\left({{K^{2}}-k_{1}^{2}}\right){e^{i{k_{2}}x}}-\left({{K^{2}}-k_{2}^{2}}\right){e^{i{k_{1}}x}}-2\alpha{e^{iKx}}}}{{\left({{K^{2}}-k_{1}^{2}}\right)\left({{K^{2}}-k_{2}^{2}}\right)}}}\right].$
(7b)

where $\beta={K^{2}}-2E$. Hence, the solution to system (6) is the combination
of general (4) and particular (7) solutions. It is however easy to give a
generalized particular solution to the case of arbitrary driven pseudoforce
$n_{i}(x)=\sum{{C_{m}}\exp}\left({iK_{m}x}\right)$ with $K_{m}=mK$ as follows

$\displaystyle\Phi_{p}(x)=\sum\limits_{m=-\infty}^{+\infty}{\frac{{{C_{m}}}}{{2\alpha}}\left[{\frac{{\left({1+\beta
k_{2}^{2}}\right){e^{i{k_{1}}x}}-\left({1+\beta
k_{1}^{2}}\right){e^{i{k_{2}}x}}-2\alpha\beta{e^{iK_{m}x}}}}{{\left({{K_{m}^{2}}-k_{1}^{2}}\right)\left({{K_{m}^{2}}-k_{2}^{2}}\right)}}}\right]},$
(8a)
$\displaystyle\Psi_{p}(x)=\sum\limits_{m=-\infty}^{+\infty}{\frac{{{C_{m}}}}{{2\alpha}}\left[{\frac{{\left({{K_{m}^{2}}-k_{1}^{2}}\right){e^{i{k_{2}}x}}-\left({{K_{m}^{2}}-k_{2}^{2}}\right){e^{i{k_{1}}x}}-2\alpha{e^{iK_{m}x}}}}{{\left({{K_{m}^{2}}-k_{1}^{2}}\right)\left({{K_{m}^{2}}-k_{2}^{2}}\right)}}}\right]}.$
(8b)

where $C_{m}=(K/2\pi)\int{n_{i}(x)\exp(-iK_{m}x)dx}$ are the Fourier
components of the charge distribution. Note that (8) is the most general
analytic particular solution to the plasmon wavefunction in the presence of an
arbitrary one dimensional charge distribution $n_{i}(x)$.

##  IV Heaviside Charge Distribution

There are obviously physical instances in which an ambient free electron gas
arrives at a uniform step charge density. However, it is valuable to derive
expressions for probability charge density and electrostatic field in the two
regions for given energy of the plasmon expiation. Assuming that the for there
is an abrupt increase in the ion charge density in the region $x>0$, we have
$n_{i}(x)=A\Theta(x)$ in which $\Theta(x)$ is the Heaviside step function.
Note that the current case with charge density barrier is a new aspect of the
pseudoforce model of plasmon excitations which is fundamentally different from
the case involving the potential barrier considered in many classical quantum
problems of Schrödinger equation. It can be easily confirmed that the
following particular solutions satisfy the driven pseudoforce model with the
Heaviside step density distribution, $n_{i}(x)=A\Theta(x)$.

$\displaystyle{\Phi_{p}}(x)=\frac{{A\Theta(x)\left[{4\alpha
E-{\gamma_{1}}\cos\left({{k_{2}}x}\right)+{\gamma_{2}}\cos\left({{k_{1}}x}\right)}\right]}}{{2\alpha}},$
(9a)
$\displaystyle{\Psi_{p}}(x)=-\frac{{A\Theta(x)\left[{1+{\gamma_{2}}-\cos\left({{k_{2}}x}\right)-{\gamma_{2}}\cos\left({{k_{1}}x}\right)}\right],}}{{1+{\gamma_{2}}}}.$
(9b)

where $\gamma_{1}=1-2Ek_{1}^{2}$ and $\gamma_{2}=1-2Ek_{2}^{2}$.

Figure 1 shows the numerical evaluation of the solution (9) for different
values of the charge density values. The initial values $\Phi_{0}=\Psi_{0}=1$
is chosen for all simulations in this paper. However, the continuity of the
solutions and the derivative of $\Psi$ is found to be completely independent
of the initial values. Figure 1(a) shows the electrostatic potential
variations of plasmon excitation in the region of space charge distribution
for two different values of negative (thin curves) and positive (thick curves)
charge distributions and for a given value of the plasmon energy. It is
remarked that the average electrostatic potential level of plasmon for
positive/negative space charge distribution is positive/negative. Moreover
Fig. 1(b) shows the electrostatic potential variations for an elevated plasmon
energy indicating that, while the spacial fluctuation frequency increases due
to increase in plasmon energy in both $x<0$ and $x>0$ regions for positive
value of $A=0.5$, these fluctuations for negative value of space charge
distribution $A=-0.5$ decreases. On the other hand, Figs. 1(c) and 1(d) show
the variations of the wavefunction of electrons for the values used in Figs.
1(a) and 1(b). It is revealed that, the average fluctuation level of the
wavefunction in Fig. 1(c) resides in negative/positive values for
positive/negative space charge distributions in the region $x>0$. This is
opposite to the case for electrostatic potential profiles in Fig. 1(a). The
same feature is also seen for Fig. 1(d) which depicts the wavefunction
variations for an elevated plasmon energy. Another feature revealed by Fig.
1(d) is that increase in the plasmon energy tends to further separate the
average fluctuation levels corresponding to negative and positive space charge
distribution values, while increasing the fluctuation frequency for both
negative and positive space charge distribution signs.

##  V Kronig-Penney Plasmonic Model

The case of Dirac delta charge distribution, $n_{i}(x)=A\delta(x)$, may be
realized as a coated uniform charge sheet sandwiched in a Josephson junction.
The particular solution of driven coupled pseudoforce system may be written as
follows

$\displaystyle{\Phi_{p}}(x)=\frac{{A\left[{\Theta(x)-\Theta(0)}\right]}}{{2\alpha}}\left[{k_{2}^{3}\sin\left({{k_{1}}x}\right)-k_{1}^{3}\sin\left({{k_{2}}x}\right)}\right],$
(10a)
$\displaystyle{\Psi_{p}}(x)=\frac{{A\left[{\Theta(x)-\Theta(0)}\right]}}{{2\alpha}}\left[{{k_{1}}\sin\left({{k_{2}}x}\right)-{k_{2}}\sin\left({{k_{1}}x}\right)}\right],$
(10b)

in which $\Theta(x)$ is the Heaviside theta function assuming $\Theta(0)=1/2$.
The solution (10) may be generalized to the case with one dimensional
plasmonic crystal with $n_{c}(x)=B\cos(Gx)$ ($G=2\pi/a$) . The initial values
$\Phi_{0}$ and $\Psi_{0}$ in this case are chosen so that the general solution
satisfies the lattice periodicity condition. The complete, i.e.,
general+particular solution for plasmonic crystal with a single Dirac delta
charge at the origin is given below

$\displaystyle\Phi(x)=-\frac{{B\left({{G^{2}}-k_{1}^{2}-k_{2}^{2}}\right)\cos\left({Gx}\right)}}{{\left({{G^{2}}-k_{1}^{2}}\right)\left({{G^{2}}-k_{2}^{2}}\right)}}+\frac{{A\left[{\Theta(x)-\Theta(0)}\right]}}{{2\alpha}}\left[{k_{2}^{3}\sin\left({{k_{1}}x}\right)-k_{1}^{3}\sin\left({{k_{2}}x}\right)}\right],$
(11a)
$\displaystyle\Psi(x)=-\frac{B\cos\left({Gx}\right)}{{\left({{G^{2}}-k_{1}^{2}}\right)\left({{G^{2}}-k_{2}^{2}}\right)}}+\frac{{A\left[{\Theta(x)-\Theta(0)}\right]}}{{2\alpha}}\left[{{k_{1}}\sin\left({{k_{2}}x}\right)-{k_{2}}\sin\left({{k_{1}}x}\right)}\right],$
(11b)

Moreover, for a symmetric sheets located at $x=\pm b$ (the parallel charged
sheet configuration) the solution for $b>0$ reads

$\displaystyle{\Phi_{p}}(x)=\frac{{A\left[{\Theta(b)-\Theta(b-x)}\right]}}{{2\alpha}}\left\\{{k_{2}^{3}\sin\left[{{k_{1}}\left({x-b}\right)}\right]-k_{1}^{3}\sin\left[{{k_{2}}\left({x-b}\right)}\right]}\right\\}$
(12a)
$\displaystyle-\frac{{A\left[{\Theta(b)-\Theta(b+x)}\right]}}{{2\alpha}}\left\\{{k_{2}^{3}\sin\left[{{k_{1}}\left({x+b}\right)}\right]-k_{1}^{3}\sin\left[{{k_{2}}\left({x+b}\right)}\right]}\right\\},$
(12b)
$\displaystyle{\Psi_{p}}(x)=\frac{{A\left[{\Theta(b)-\Theta(b-x)}\right]}}{{2\alpha}}\left\\{{{k_{1}}\sin\left[{{k_{2}}\left({x-b}\right)}\right]-{k_{2}}\sin\left[{{k_{1}}\left({x-b}\right)}\right]}\right\\}$
(12c)
$\displaystyle-\frac{{A\left[{\Theta(b)-\Theta(b+x)}\right]}}{{2\alpha}}\left\\{{{k_{1}}\sin\left[{{k_{2}}\left({x+b}\right)}\right]-{k_{2}}\sin\left[{{k_{1}}\left({x+b}\right)}\right]}\right\\}.$
(12d)

The particular solution for Dirac delta charge may be further generalized to
the 1D Kronig-Penney model which finds numerous applications in solid state
physics. The particular solutions for the case of Dirac delta Kronig-Penney
distribution ($b>0$) is

$\displaystyle{\Phi_{p}}(x)=\sum\limits_{m=1}^{+\infty}{\frac{{A\left[{\Theta(mb)-\Theta(mb-x)}\right]}}{{2\alpha}}\left\\{{k_{2}^{3}\sin\left[{{k_{1}}\left({x-mb}\right)}\right]-k_{1}^{3}\sin\left[{{k_{2}}\left({x-mb}\right)}\right]}\right\\}}$
(13a)
$\displaystyle-\sum\limits_{m=0}^{+\infty}\frac{{A\left[{\Theta(mb)-\Theta(mb+x)}\right]}}{{2\alpha}}\left\\{{k_{2}^{3}\sin\left[{{k_{1}}\left({x+mb}\right)}\right]-k_{1}^{3}\sin\left[{{k_{2}}\left({x+mb}\right)}\right]}\right\\},$
(13b)
$\displaystyle{\Psi_{p}}(x)=\sum\limits_{m=1}^{+\infty}{\frac{{A\left[{\Theta(mb)-\Theta(mb-x)}\right]}}{{2\alpha}}\left\\{{{k_{1}}\sin\left[{{k_{2}}\left({x-mb}\right)}\right]-{k_{2}}\sin\left[{{k_{1}}\left({x-mb}\right)}\right]}\right\\}}$
(13c)
$\displaystyle-\sum\limits_{m=0}^{+\infty}\frac{{A\left[{\Theta(mb)-\Theta(mb+x)}\right]}}{{2\alpha}}\left\\{{{k_{1}}\sin\left[{{k_{2}}\left({x+mb}\right)}\right]-{k_{2}}\sin\left[{{k_{1}}\left({x+mb}\right)}\right]}\right\\}.$
(13d)

The initial values $\Phi_{0}$ and $\Psi_{0}$ in the general solution should
also be set in a way that the $G^{\prime}=2\pi/b$ is the reciprocal lattice
vector of 1D Kronig-Penney plasmonic crystal, i.e.,

$\displaystyle{\Phi_{g}}(x)=-\frac{{B\left({{G^{\prime
2}}-k_{1}^{2}-k_{2}^{2}}\right)\cos\left({G^{\prime}x}\right)}}{{\left({{G^{\prime
2}}-k_{1}^{2}}\right)\left({{G^{\prime 2}}-k_{2}^{2}}\right)}},$ (14a)
$\displaystyle{\Psi_{g}}(x)=-\frac{B\cos\left({G^{\prime}x}\right)}{{\left({{G^{\prime
2}}-k_{1}^{2}}\right)\left({{G^{\prime 2}}-k_{2}^{2}}\right)}}.$ (14b)

Figure 2 shows the plasmon excitations with given energy in the presence of a
Dirac delta sheet at the origin. Figure 2(a) depicts the plasmon excitation in
the presence of an extremely narrow negatively charged sheet at the origin.
The thin curve shows the plasmon excitation with the same energy in the
absence of the charge sheet. It is clearly remarked that the charge sheet
significantly modifies the plasmon electrostatic field variations in the whole
space around the sheet. However, the presence of Dirac charge sheet leads to a
discontinuity of electric field at the place of sheet. Moreover, Fig. 2(b)
depicts the plasmon excitation in space around a positively charged sheet. It
is clearly remarked that the plasmon electrostatic potential around the
positive sheet is relatively higher compared to the previous case with
negatively charged sheet. On the other hand, Figure 2(c) and 2(d) depict the
plasmon wavefunction around the same sheets represented in Figs. 2(a) and
2(b), respectively. For the case of positive/negative charges the profile
seems to be mirror reflected in places far from the origin where the sheet
resides. However, the inspection of the values of $\Psi^{2}(x)$ around the
charge sheet reveals that electrons are more localized around the positive
sheet rather than that of negative charge.

The quantum plasmon excitation profiles in driven pseudoforce model and in the
presence of double Dirac delta sheet is depicted in Fig. 3. In Fig. 3(a) and
3(b) It is seen that the wavefunction and electrostatic potential amplitudes
inside the parallel charged sheets is comparatively lower than those outside
this region. It is remarked that the electrostatic potential contributed from
the charged sheets is only present outside of the sheet region. In other words
the plasmon excitations inside the parallel charged sheets is isolated from
the outside fields. This feature is found to be dominant even with the
asymmetric charged sheet configurations (not shown here). Figure 3(c) shows
the particular solution due to the charged sheets only which reveals that this
solution does not contribute to the plasmon excitations inside the sheet
region. Moreover, the plasmon excitations around the Dirac charged sheets for
beating energy eigenvalue $E\simeq 1$ is depicted in Fig. 3(d) for both
wavefunction and electrostatic potential profiles. It is remarked that the
presence of charged sheets leads to amplification of beating phenomenon
outside of the sheet region.

Figure 4 depict the effect of Dirac charge sheet on one dimensional plasmon
excitations in a sinusoidal periodic lattice of spacing $a$. Figure 4(a) shows
the plasmon excitation with the energy $E=5$ in unit of the plasmon energy
$E_{p}=\hbar\omega_{p}$ where $\omega_{p}$ is the electron plasma oscillation
frequency, around a negative charge sheet at the origin. The thin curve
represents the period field of the lattice. It is remarked that driven plasmon
excitations carries the periodicity of the lattice modulated over a large
amplitude due to the charge sheet. The current problem may represent a one
dimensional impurity screening in a plasmonic crystal. Because of the one
dimensional screening instead of realistic spherical problem the decaying does
not take place. The plasmon excitation around a positive sheet with the same
charge, lattice parameter and plasmon energy is seen in Fig. 4(b). The
electrostatic potential around the sheet has become more positive in Fig. 4(b)
due to the presence of positively charged sheet. Moreover, Fig. 4(c) shows the
wavefunction profile quantum electron plasma oscillation in a plasmonic
crystal around the negatively charged Dirac sheet at the origin with same
parameters as in Fig. 4(a). It is remarked that, the electronic density is
localized at the ionic positions. However, it is shown that the wavefunction
and electrostatic potential are out of phase everywhere in plasmonic lattice.
In Fig. 4(d), on the other hand, the negative charge sheet has been replaced
with a positive sheet of same charge but with identical other parameters. It
is remarked that the free electronic charge in this case as compared to Fig.
4(c) is more localized around the positive sheet.

The time evolution of the plasmon excitation in lattice containing dirac
charge sheet appears in Fig. 5. Figure 5(a) shows perfect periodic plasmon
excitations in the absence of charge distributions. As it is clear the Fig.
5(a) reflect a perfect harmonic pattern due to the lattice periodicity. The
introduction of a weak negatively charged Dirac sheet at the origin, however,
makes the clear periodic pattern somehow blurry but still the crystal
periodicity is apparent from Fig. 5(b). With further increase in the charge of
the Dirac sheet, on the other hand, the periodicity is further destroyed in
Fig. 5(c). Figure 5(d) shows the time evolution of plasmon excitation with
elevated energy level as compared to Fig. 5(d). It is remarked that plasmon
excitations with higher energy values feel less that those of lower energy the
lattice periodicity in the presence of a Dirac charge sheet.

##  VI Conclusion

Using the driven coupled pseudoforce system derived from one dimensional
Schrödinger-Poisson model the plasmon excitations of a free electron gas with
arbitrary degree of degeneracy and electron fluid temperature is studied in
the presence of various charge distributions. Closed forms of analytic
functions is developed for plasmon excitations in the presence of an arbitrary
charge distribution. The developed model is shown to be completely flexible to
model a variety of physical problems with wide range of applications such as
the impurity screening in 1D lattice, multi-charge distributed layers, etc.
Current research help to study in detail the nature of quantum free electron
excitations in periodic and quasi-periodic charged environments like plasmonic
lattice and in presence of arbitrary and random impurity distributions. The
model can also be further extended to include complex charge distributions
containing arbitrary shaped charge regions fitting the desired physical
situations.

##  VII Acknowledgement

Some analytic calculations in this research has been performed and checked for
consistency by the Wolfram Mathematica symbolic computing software mathematica
.

## References

  * (1) C. Kittel, Introduction to Solid State Physics, (John Wiely and Sons, New York, 1996), 7th ed.
  * (2) N. W. Ashcroft and N. D. Mermin, Solid state physics (Saunders College Publishing, Orlando, 1976).
  * (3) F. F. Chen, Introduction to Plasma Physics and Controlled Fusion, 2nd ed. (Plenum Press, New York, London, 1984).
  * (4) N. A. Krall and A. W. Trivelpeice, ”Principles of Plasma Physics”, (San francisco Press, San francisco 1986).
  * (5) P. G. Drazin and R. S. Johnson, ”Solitons: an introduction”, Cambridge Texts in Applied Mathematics, Cambridge University Press, (l993)
  * (6) Y. Klimontovich and V. P. Silin, in Plasma Physics, edited by J. E. Drummond (McGraw-Hill, New York, 1961).
  * (7) E. Infeld and G. Rowlands, Nonlinear Waves, Solitons, and Chaos” (Cambridge University, Cambridge, 1990).
  * (8) M. Kono and M. Skoric, ”Nonlinear Physics of Plasmas” (Springer Heidelberg Dordrecht London New York, 2010).
  * (9) R. C. Davidson, Methods in Nonlinear Plasma Theory (Academic Press, New York, 1972).
  * (10) R. Z. Sagdeev, in ” _Reviews of Plasma Physics_ ” (Ed. M. A. Leontovich, Consultants Bureau, NewYork, 1966).
  * (11) V. I. Karpman, Nonlinear Waves in Dispersive Media (Pergamon, Oxford, 1975).
  * (12) P.A. Markovich, C.A. Ringhofer, C. Schmeister, Semiconductor Equations, Springer, Berlin, 1990.
  * (13) G. Manfredi, Phys. Plasmas 25, 031701(2018); doi.org/10.1063/1.5026653
  * (14) H. Haug and S. W. Koch, ”Quantum theory of the optical and electronic properties of semiconductors”, World Scientific, 2004,
  * (15) C. Gardner, SIAM, J. Appl. Math. 54 409(1994).
  * (16) M. Akbari-Moghanjoughi and B. Eliasson, Phys. Scripta, 91, 105601(2016); doi:10.1088/0031-8949/91/10/105601
  * (17) G. Manfredi, “How to model quantum plasmas,” Fields Inst. Commun. 46, 263–287 (2005); in Proceedings of the Workshop on Kinetic Theory (The Fields Institute, Toronto, Canada 2004): http://arxiv.org/abs/quant–ph/0505004.
  * (18) P. K. Shukla, B. Eliasson, ”Nonlinear aspects of quantum plasma physics” Phys. Usp. 51 53(2010).
  * (19) P. K. Shukla and B. Eliasson, Rev. Mod. Phys. 83, 885 (2011).
  * (20) F. Haas, Quantum Plasmas: An Hydrodynamic Approach (Springer, New York, 2011).
  * (21) S. Mattei, K. Nishid, M. Onaic, J. Lettry, M. Q. Tranb and A.Hatayama, J. Comp. Phys. 350, 891(2017).
  * (22) J. Hurst, K. L. Simon, P. A. Hervieux, G. Manfredi and F. Haas, Phys. Rev. B 93, 205402(2016).
  * (23) F. Haas, G. Manfredi, P. K. Shukla, and P.-A. Hervieux, Phys. Rev. B, 80, 073301 (2009).
  * (24) S. A. Maier, Plasmonics: Fundamentals and Aplications, Springer Science$+$Business Media LLC (2007).
  * (25) C. Hu, Modern Semiconductor Devices for Integrated Circuits (Prentice Hall, Upper Saddle River, New Jersey, 2010) 1st ed.
  * (26) K. Seeger, Semiconductor Physics (Springer, Berlin, 2004) 9th ed.
  * (27) B. Van Zeghbroeck, Principles of Electronic Devices (2011), Chap. 2.5, http://ece-www.colorado.edu/$\sim$bart/book/carriers.htm
  * (28) D. Bohm and D. Pines, Phys. Rev. 92 609(1953).
  * (29) D. Pines, Phys. Rev. 92 609(1953).
  * (30) P. Levine and O. V. Roos, Phys. Rev, 125 207(1962).
  * (31) Young-Dae Jung, Phys. Plasmas 2, 332(1995); doi.org/10.1063/1.871440
  * (32) Young-Dae Jung, Phys. Plasmas 8, 3842(2001); doi.org/10.1063/1.1386430
  * (33) A. E. Dubinov, A. A. Dubinova, and M. A. Sazonkin, J. Comm. Tech. Electr., 55 907(2010).
  * (34) A. E. Dubinov and I. N. Kitayev, Semiconductors 51 14(2017); doi.org/10.1134/S1063782617010079
  * (35) F. Haas, L. G. Garcia, J. Goedert, and G. Manfredi, Phys. Plasmas 10, 3858(2003).
  * (36) M. Marklund, B. Eliasson, P. K. Shukla, Phys. Rev. E 76, 067401 (2007); doi:10.1103/PhysRevE.76.067401
  * (37) P. K. Shukla and L. Stenflo, J. Plasma Phys. 74 719(2008); doi:10.1017/S0022377808007344
  * (38) M. Marklund, P.K. Shukla, Rev. Mod. Phys. 78 591(2006).
  * (39) P. K. Shukla and B. Eliasson, Phys. Rev. Lett. 108, 219902 (E) (2012); ibid. 109, 019901 (E) (2012).
  * (40) Nitin Shukla, P. K. Shukla, G. Brodin, and L. Stenflo, Phys. Plasmas, 15, 044503 (2008); https://doi.org/10.1063/1.2909533
  * (41) A. Bret, Phys. Plasmas 14, 084503(2007); doi.org/10.1063/1.2759886
  * (42) P. K. Shukla and B. Eliasson, Phys. Lett. A, 372, 2897(2008).
  * (43) M. Akbari-Moghanjoughi, Phys. Plasmas 24, 012113(2017); doi.org/10.1063/1.4975078
  * (44) J. T. Mendonca and A. Serbeto, Phys. Scripta, 91, 095601(2016); doi:10.1088/0031-8949/91/9/095601
  * (45) B. Eliasson and P. K. Shukla, Phys. Scr. 78, 025503 (2008).
  * (46) G. Brodin and L. Stenflo, Phys. Plasmas 24, 124505(2017); doi.org/10.1063/1.5011299
  * (47) L. Stenflo and G. Brodin, Phys. Lett. A, 378 549(2014); doi.org/10.1016/j.physleta.2013.12.027
  * (48) L. Stenflo and G. Brodin, Phys. Plasmas, 23, 074501(2016); doi.org/10.1063/1.4955325
  * (49) M. Akbari-Moghanjoughi, Phys. Plasmas 17, 082302(2017); doi: 10.1063/1.4987016
  * (50) M. Akbari-Moghanjoughi, Phys. Plasmas 25, 102105(2018); doi: 10.1063/1.5055372
  * (51) G. Manfredi and F. Haas, Phys. Rev. B 64, 075316 (2001).
  * (52) M. Akbari-Moghanjoughi, ”Quantized Plasmon Excitations of Electron Gas in Potential Well” Accepted in Phys. Plasmas
  * (53) Stephen Wolfram, The Mathematica Book, Wolfram Media, Incorporated (2003); ISBN:1579550223


# LTU Attacker for Membership Inference

Joseph Pedersen
RPI, New York, USA &Rafael Muñoz-Gómez
LISN/CNRS/INRIA
U. Paris-Saclay, France &Jiangnan Huang
LISN/CNRS/INRIA
U. Paris-Saclay, France Haozhe Sun
LISN/CNRS/INRIA
U. Paris-Saclay, France &Wei-Wei Tu
4Paradigm, China
ChaLearn, USA &Isabelle Guyon
LISN/CNRS/INRIA
U. Paris-Saclay, France
ChaLearn, USA Third AAAI Workshop on Privacy-Preserving Artificial
Intelligence (PPAI-22), February 2022
Correspond to<EMAIL_ADDRESS>
###### Abstract

> We address the problem of defending predictive models, such as machine
> learning classifiers (Defender models), against membership inference
> attacks, in both the black-box and white-box setting, when the trainer and
> the trained model are publicly released. The Defender aims at optimizing a
> dual objective: utility and privacy. Both utility and privacy are evaluated
> with an external apparatus including an Attacker and an Evaluator. On one
> hand, Reserved data, distributed similarly to the Defender training data, is
> used to evaluate Utility; on the other hand, Reserved data, mixed with
> Defender training data, is used to evaluate membership inference attack
> robustness. In both cases classification accuracy or error rate are used as
> the metric: Utility is evaluated with the classification accuracy of the
> Defender model; Privacy is evaluated with the membership prediction error of
> a so-called “Leave-Two-Unlabeled” LTU Attacker, having access to all of the
> Defender and Reserved data, except for the membership label of one sample
> from each. We prove that, under certain conditions, even a “naïve” LTU
> Attacker can achieve lower bounds on privacy loss with simple attack
> strategies, leading to concrete necessary conditions to protect privacy,
> including: preventing over-fitting and adding some amount of randomness.
> However, we also show that such a naïve LTU Attacker can fail to attack the
> privacy of models known to be vulnerable in the literature, demonstrating
> that knowledge must be complemented with strong attack strategies to turn
> the LTU Attacker into a powerful means of evaluating privacy. Our
> experiments on the QMNIST and CIFAR-10 datasets validate our theoretical
> results and confirm the roles of over-fitting prevention and randomness in
> the algorithms to protect against privacy attacks.

Figure 1: Methodology Flow Chart. (a) Defender: Source data are divided into
Defender data, to train the model under attack ( Defender model) and  Reserved
data to evaluate such model. The  Defender model trainer creates a model
optimizing a utility objective, while being as resilient as possible to
attacks. (b) LTU Attacker: The evaluation apparatus includes an  LTU Attacker
and an  Evaluator: The evaluation apparatus performs a hold-out evaluation
leaving two unlabeled examples (LTU) by repeatedly providing the  LTU Attacker
with ALL of the  Defender and  Reserved data samples, together with their
membership origin, hiding only the membership label of 2 samples. The  LTU
Attacker must turn in the membership label (Defender data or Reserved data) of
these 2 samples (Attack predictions). (c) Evaluator: The  Evaluator computes
two scores:  LTU Attacker prediction error ( Privacy metric), and  Defender
model classification performance ( Utility metric).

## Introduction

Large companies are increasingly reluctant to let any information out, for
fear of privacy attacks and possible ensuing lawsuits. Even government
agencies and academic institutions, whose charter is to disseminate data and
results publicly, must be careful. Hence, we are in great need of simple and
provably effective protocols to protect data, while ensuring that some utility
can be derived from them. Though critical sensitive data must never leave the
source organization (Source) – company, government, or academia –, an
authorized researcher (Defender) may gain access to them within a secured
environment to analyse them and produce models (Product). Source may desire to
release Product, provided that desired levels of Utility and Privacy are met.
We consider the most complete release of model information, including the
Defender trainer, with all its settings, and the trained model. This enables
“white-box attacks” from potential attackers (?). We devise an evaluation
apparatus to help Source in its decision whether or not to release Product
(Figure 1). The setting considered is that of “membership inference attack”,
in which an attacker seeks to uncover whether given samples, distributed
similarly as the Defender training dataset, belong or not to such dataset (?).
The apparatus includes an Evaluator and an LTU Attacker. The Evaluator
performs a hold-out leave-two-unlabeled (LTU) evaluation, giving the LTU
Attacker access to extensive information: all the Defender and Reserved data,
except for the membership label of one sample from each. The contributions of
our paper include this new evaluation apparatus. Its soundness is backed by
some initial theoretical analyses and by preliminary experimental results,
which indicate that Defender models can protect data privacy while retaining
utility in such extreme attack conditions.

## Related work

Membership inference attacks (MIA) have been extensively studied in the last
years. (?) developed a privacy framework called “Membership Privacy”,
establishing a family of related privacy definitions. (?) explored the first
MIA scenario, in which an attacker has black-box query access to a
classification model $f$ and can obtain the prediction vector of the data
record $x$ given as input. (?) proposed a metric inspired from Differential
Privacy to measure the privacy risk of each training record, based on the
impact it has on the learning algorithm. Similarly, (?) incorporate a fine-
grained analysis on his systematic evaluation of privacy risk. The Bayesian
metric proposed is defined as the posterior probability that a given input
sample is from the training set after observing the target model’s behavior
over that sample. (?) explores a more realistic scenario. They consider skewed
priors where only a small fraction of the samples belong to the training set,
and its attack strategy is focused on selecting the best inference thresholds.
In contrast, our LTU Attacker is not trying to address a realistic scenario.

(?) studied the connection between overfitting and membership inference,
showing that overfitting is a sufficient condition to guarantee success of the
adversary. (?) continued exploring MIAs in the black-box model setting,
considering different scenarios according to the prior knowledge that the
adversary has about the training data: black-box, grey-box and white-box.
Recent work also addressed membership inference attacks against generative
models (?; ?; ?). This paper focuses on the attack of discriminative models in
an ‘all knowledgeable scenario’, both from the point of view of model and
data.

Several frameworks have been proposed to mitigate attacks, among which
Differential Privacy (?) has become a reference method. Work in (?; ?) show
how to implement this technique in deep learning. Using DP to protect against
attacks comes at the cost of decreasing the model’s utility. Regularization
approaches have been investigated, in an effort to increase model robustness
against privacy attacks, while retaining most utility. One of them inspired
our idea to defend against attacks in an adversarial manner: Domain-
adversarial training (?) introduced in the context of domain adaptation. (?)
will later use this technique to defend against MIA. (?) helped bridge the gap
between membership inference and domain adaptation.

Most literature addressing MIA considers a black-box scenario, where the
adversary only has access to the model through an API and very little
knowledge about the training data. Closest to the scenario considered in this
paper, the work of (?) analyzes attackers having all information about the
neural network under attack, including inner layer outputs; allowing them to
exploit privacy vulnerabilities of the SGD algorithm. However, contrary to the
LTU Attacker we are introducing, the authors’ adversary executes the attack in
an unsupervised way; without having access to membership labels of any data
sample. Bayes optimal strategies have been examined in (?); showing that,
under some assumptions, the optimal inference depends only on the loss. Recent
work in (?) also aims to design the best possible adversary, defined in terms
of the Bayes Optimal Classifier, to estimate privacy leakage of a model.

Figure 2:  Taxonomy of LTU Attacker . Top: Any LTU Attacker has available the
Defender trainer $\mathcal{T}_{D}$, the trained Defender model
$\mathcal{M}_{D}$, and attack data $\mathcal{D}_{A}$ including (almost) all
the Defender data $\mathcal{D}_{D}$ and Reserved data $\mathcal{D}_{R}$
$\mathcal{D}_{A}=\mathcal{D}_{D}-\\{\texttt{membership}(d)\\}\cup\mathcal{D}_{R}-\\{\texttt{membership}(r)\\}$.
But it may use only part of this available knowledge to conduct attacks. $r$
and $d$ are two labeled examples belonging $\mathcal{D}_{R}$ and
$\mathcal{D}_{D}$ respectively, and $u_{1}$ and $u_{2}$ are two unlabeled
examples, one from $\mathcal{D}_{R}$ and one from $\mathcal{D}_{D}$ (ordered
randomly). Left: Attacker $\mathcal{M}_{A}$ targets only the trained Defender
model $\mathcal{M}_{D}$. Right: $\mathcal{M}_{A}$ targets both
$\mathcal{M}_{D}$ and its trainer $\mathcal{T}_{D}$.

## Problem statement and methodology

We consider the scenario in which an owner of a data Source $\mathcal{D}_{S}$
wants to create a predictive model trained on some of those data, but needs to
ensure that privacy is preserved. In particular, we focus on privacy from
membership inference. The data owner entrusts an agent called Defender with
creating such a model, giving him access to a random sample
$\mathcal{D}_{D}\subset\mathcal{D}_{S}$ (Defender dataset). We denote by
$\mathcal{M}_{D}$ the trained model (Defender model) and by $\mathcal{T}_{D}$
the algorithm used to train it (Defender trainer). The data owner wishes to
release $\mathcal{M}_{D}$, and eventually $\mathcal{T}_{D}$, provided that
certain standards of privacy and utility of $\mathcal{M}_{D}$ and
$\mathcal{T}_{D}$ are met. To evaluate such utility and privacy, the data
owner reserves a dataset $\mathcal{D}_{R}\subset\mathcal{D}_{S}$, disjoint
from $\mathcal{D}_{D}$, and gives both $\mathcal{D}_{D}$ and $\mathcal{D}_{R}$
to a trustworthy Evaluator agent. The Evaluator tags the samples with dataset
“membership labels”: Defender or Reserved. Then, the Evaluator performs
repeated rounds, consisting in randomly selecting one Defender sample $d$ and
one Reserved sample $r$, and giving to a LTU Attacker an almost perfect attack
dataset
$\mathcal{D}_{A}=\mathcal{D}_{D}-\\{\texttt{membership}(d)\\}\cup\mathcal{D}_{R}-\\{\texttt{membership}(r)\\}$,
removing only the membership labels of the two selected samples. The two
unlabeled samples are referred to as $u_{1}$ and $u_{2}$, with each being
equally likely to be from the Defender dataset. We refer to this procedure as
“Leave Two Unlabeled” (LTU), see Figure 1. The LTU Attacker also has access to
the Defender trainer $\mathcal{T}_{D}$ (with all its hyper-parameter
settings), and the trained Defender model $\mathcal{M}_{D}$. He is tasked to
correctly predict which of the two samples $d$ and $r$ belongs to
$\mathcal{D}_{D}$ (independently for each LTU round, forgetting everything at
the end of a round).

We use the LTU membership classification accuracy $A_{ltu}$ from $N$
independent LTU rounds (as defined above), to define a global privacy score
as:

$\displaystyle\texttt{Privacy}=$ $\displaystyle\min\\{2~{}(1-A_{ltu}),1\\}$
$\displaystyle\pm 2\sqrt{A_{ltu}(1-A_{ltu})/N}~{},$ (1)

where the error bar is an estimator of the standard error of the mean
(approximating the Binomial law with the Normal law, see e.g. (?)). The weaker
the performance of the LTU Attacker ($A_{ltu}\simeq 0.5$ for random guessing),
the larger Privacy, and the better $\mathcal{M}_{D}$ should be protected from
attacks. We can also determine an individual membership inference privacy
score for any sample $d\in\mathcal{D}_{D}$ by using that sample for all $N$
rounds, and only drawing $r\sim\mathcal{D}_{R}$ at random111Similarly, we can
determine an individual non-membership inference privacy score for any sample
$r\in\mathcal{D}_{R}$ by using that sample for all $N$ rounds, and only
drawing $d$ at random. (see example in Appendix C).

The Evaluator also uses $\mathcal{D}_{uE}=\mathcal{D}_{R}$ to evaluate the
utility of the Defender model $\mathcal{M}_{D}$. We focus on multi-class
classification, and measure utility with the classification accuracy $A_{D}$
of $\mathcal{M}_{D}$, defining utility as:

$\displaystyle\texttt{Utility}=$
$\displaystyle\max\\{(c~{}A_{D}-1)/(c-1),0\\}$ $\displaystyle\pm
c\sqrt{A_{D}(1-A_{D})/|\mathcal{D}_{R}|}~{},$ (2)

where $c$ is the number of classes.

While the LTU Attacker is all knowledgeable, we still need to endow it with an
algorithm to make membership predictions. In Figure 2 we propose a taxonomy of
LTU Attackers. In each LTU round, let $u_{1}$ and $u_{2}$ be the samples that
were deprived of their labels. The taxonomy has 2 branches:

  * •

Attack on $\mathcal{M}_{D}$ alone: (1) Simply use a generalization Gap-
attacker, which classifies $u_{1}$ as belonging to $\mathcal{D}_{D}$ if the
loss function of $\mathcal{M}_{D}(u_{1})$ is smaller than that of
$\mathcal{M}_{D}(u_{2})$ (works well if $\mathcal{M}_{D}$ overfits
$\mathcal{D}_{D}$); or, (2) train a $\mathcal{M}_{D}$-attacker
$\mathcal{M}_{A}$ to predict membership, using as input any internal state or
the output of $\mathcal{M}_{D}$, and using $\mathcal{D}_{A}$ as training data.
Then use $\mathcal{M}_{A}$ to predict the labels of $u_{1}$ and $u_{2}$.

  * •

Attack on $\mathcal{M}_{D}$ and $\mathcal{T}_{D}$: Depending on whether the
Defender trainer $\mathcal{T}_{D}$ is a white-box from which gradients can be
computed, define $\mathcal{M}_{A}$ by: (3) Training two mock Defender models
$\mathcal{M}_{1}$ and $\mathcal{M}_{2}$, one using
$(\mathcal{D}_{D}-\\{d\\})\cup\\{u_{1}\\}$ and the other using
$(\mathcal{D}_{D}-\\{d\\})\cup\\{u_{2}\\}$, with the trainer
$\mathcal{T}_{D}$. If $\mathcal{T}_{D}$ is deterministic and independent of
sample ordering, either $\mathcal{M}_{1}$ or $\mathcal{M}_{2}$ should be
identical to $\mathcal{M}_{D}$, and otherwise one of them should be “closer”
to $\mathcal{M}_{D}$. The sample corresponding to the model closest to
$\mathcal{M}_{D}$ is classified as being a member of $\mathcal{D}_{D}$. (4)
Performing one gradient learning step with either $u_{1}$ or $u_{2}$ using
$\mathcal{T}_{D}$, starting from the trained model $\mathcal{M}_{D}$, and
compare the gradient norms.

A variety of Defender strategies might be considered:

  * •

Applying over-fitting prevention (regularization) to $\mathcal{T}_{D}$.

  * •

Applying Differential Privacy algorithms to $\mathcal{T}_{D}$.

  * •

Training $\mathcal{T}_{D}$ in a semi-supervised way (with transfer learning)
or using synthetic data (generated with a simulator trained with a subset of
$\mathcal{D}_{D}$).

  * •

Modifying $\mathcal{T}_{D}$ to optimize both utility and privacy.

## Theoretical analysis of naïve attackers

We present several theorems outlining weaknesses of the Defender that are
particularly easy to exploit by a black-box LTU Attacker, not requiring
training a sophisticated attack model $\mathcal{M}_{A}$ (we refer to such
attackers as “naïve”). First, we prove, in the context of the LTU procedure,
theorems related to an already known result connecting privacy and over-
fitting: Defender trainers that overfit the Defender data lend themselves to
easy attacks (?). The attacker can simply exploit the loss function of the
Defender (which should be larger on Reserved data than on Defender data). The
last theorem concerns deterministic trainers $\mathcal{T}_{D}$: We show that
the LTU Attacker can defeat them with 100% accuracy, under mild assumptions.
Thus Defenders must introduce some randomness in their training algorithm to
be robust against such attacks (?).

Throughout this analysis, we use the fact that our LTU methodology simplifies
the work for the LTU Attacker since it is always presented with pairs of
samples for which exactly one is in the Defender data. This can give it very
simple attack strategies. For example, for any real valued function $f(x)$,
with $x\in\mathcal{D}_{S}$, let $r$ be drawn uniformly from $\mathcal{D}_{R}$
and $d$ be drawn uniformly from $\mathcal{D}_{D}$, and define:

$\displaystyle p_{R}$
$\displaystyle=\mathop{Pr}_{\begin{subarray}{c}u_{1}\sim\mathcal{D}_{R}\\\
u_{2}\sim\mathcal{D}_{D}\end{subarray}}[f(u_{1})>f(u_{2})]$ (3) $\displaystyle
p_{D}$
$\displaystyle=\mathop{Pr}_{\begin{subarray}{c}u_{1}\sim\mathcal{D}_{R}\\\
u_{2}\sim\mathcal{D}_{D}\end{subarray}}[f(u_{1})<f(u_{2})]$ (4)

Thus $p_{R}$ is the probability that discriminant function $f$ “favors”
Reserved data while $p_{D}$ is the probability with which it favors the
Defender data. $p_{R}>p_{D}$ occurs if for a larger number of random pairs
$f(x)$ is larger for Reserved data than for Defender data. If the probability
of a tie is zero, then $p_{R}+p_{D}=1$.

######  Theorem 1.

If there is any function $f$ for which $p_{R}>p_{D}$, a LTU Attacker
exploiting that function can achieve an accuracy
$A_{ltu}\geq\frac{1}{2}+\frac{1}{2}(p_{R}-p_{D})$.

###### Proof.

A simple attack strategy would be predict that the unlabeled sample with the
smaller value of $f(x)$ belongs to the Defender data, with ties (i.e. when
$f(u_{1})=f(u_{2})$) decided by tossing a fair coin. This strategy would give
a correct prediction when $f(r)>f(d)$, which occurs with probability $p_{R}$,
and would be correct half of the time when $f(r)=f(d)$, which occurs with
probability $(1-(p_{r}+p_{d}))$. This gives a classification accuracy:

$\displaystyle
A_{ltu}=p_{R}+\frac{1}{2}(1-p_{R}-p_{D})=\frac{1}{2}+\frac{1}{2}(p_{R}-p_{D})~{}.$
(5)

∎

This is similar to the threshold adversary of (?), except that the LTU
Attacker does not need to know the exact conditional distributions, since it
can discriminate pairwise. The most obvious candidate function $f$ is the loss
function used to train $\mathcal{M}_{D}$ (we call this a naïve attacker), but
the LTU Attacker can mine $\mathcal{D}_{A}$ to potentially find more
discriminative functions, or multiple functions to bag, and use
$\mathcal{D}_{A}$ to compute very good estimates for $p_{R}$ and $p_{D}$. We
verify that an LTU Attacker using an $f$ function making perfect membership
predictions (e.g., having the knowledge of the entire Defender dataset and
using the nearest neighbor method) would get $A_{ltu}=1$, if there are no
ties. Indeed, in that case, $p_{R}=1$ and $p_{D}=0$.

In our second theorem, we show that the LTU Attacker can attain an analogous
lower bound on accuracy connected to overfitting as the bounded loss function
(BLF) adversary of (?).

######  Theorem 2.

If the loss function $\ell(x)$ used to train the Defender model is bounded for
all $x$, without loss of generality $0\leq\ell(x)\leq 1$ (since loss functions
can always be re-scaled), and if $e_{R}$, the expected value of the loss
function on the Reserved data, is larger than $e_{D}$, the expected value of
the loss function on the Defender data, then a lower bound on the accuracy of
the LTU Attacker is given by the following function of the generalization
error gap $e_{R}-e_{D}$:

$\displaystyle A_{ltu}\geq\frac{1}{2}+\frac{1}{2}(e_{R}-e_{D})$ (6)

###### Proof.

If the order of the pair $(u_{1},u_{2})$ is random and the loss function
$\ell(x)$ is bounded by $0\leq\ell(x)\leq 1$, then the LTU Attacker could
predict $u_{1}\in\mathcal{D}_{R}$ with probability $\ell(u_{1})$, by drawing
$z\sim U(0,1)$ and predicting $u_{1}\in\mathcal{D}_{R}$ if $z<\ell(u_{1})$,
and $u_{1}\in\mathcal{D}_{D}$ otherwise. This gives the desired lower bound,
derived in more detail in Appendix A:

$\displaystyle A_{ltu}$
$\displaystyle=\frac{1}{2}\mathop{Pr}_{u_{1}\sim\mathcal{D}_{R}}[z<\ell(u_{1})]+\frac{1}{2}\left(1-\mathop{Pr}_{u_{1}\sim\mathcal{D}_{D}}[z<\ell(u_{1})]\right)$
$\displaystyle=\frac{1}{2}\mathop{\mathbb{E}}_{u_{1}\sim\mathcal{D}_{R}}\left[\ell(u_{1})\right]+\frac{1}{2}-\frac{1}{2}\mathop{\mathbb{E}}_{u_{1}\sim\mathcal{D}_{D}}\left[\ell(u_{1})\right]$
$\displaystyle=\frac{1}{2}+\frac{e_{R}-e_{D}}{2}$ (7) $\displaystyle\text{
where
}e_{R}\coloneqq\mathop{\mathbb{E}}_{u_{1}\sim\mathcal{D}_{R}}\left[\ell(u_{1})\right]\text{
and
}e_{D}\coloneqq\mathop{\mathbb{E}}_{u_{1}\sim\mathcal{D}_{D}}\left[\ell(u_{1})\right]$

∎

This is only a lower bound on the accuracy of the attacker, connected to the
main difficulty in machine learning - overfitting of the loss function. Other
attack strategies may be more accurate. However, neither of the attack
strategies in Theorems 1 and 2 is dominant over the other: shown in Appendix
B. The strategy in Theorem 1 is more widely applicable, since it does not
require the function to be bounded.

In the special case when the loss function used to train the Defender model is
the 0-1 loss, and that is used to attack (i.e., $f=\ell$), the strategies in
Theorems 1 and 2 are different, but have the same accuracy:

$\displaystyle p_{R}$
$\displaystyle=\mathop{Pr}_{u\sim\mathcal{D}_{R}}[\ell(u)=1](1-\mathop{Pr}_{u\sim\mathcal{D}_{D}}[\ell(u)=1])$
$\displaystyle p_{D}$
$\displaystyle=(1-\mathop{Pr}_{u\sim\mathcal{D}_{R}}[\ell(u)=1])\mathop{Pr}_{u\sim\mathcal{D}_{D}}[\ell(u)=1]$
$\displaystyle p_{R}-p_{D}$
$\displaystyle=\mathop{Pr}_{u_{1}\sim\mathcal{D}_{R}}[\ell(u)=1]-\mathop{Pr}_{u\sim\mathcal{D}_{D}}[\ell(u)=1]$
$\displaystyle=e_{R}-e_{D}$

Note that $u$ is a dummy variable. The first line of the derivation is due to
the fact that the only way the loss on the Reserved set can be greater than
the loss on the Defender set is if the loss on the Reserved set is 1, which
has probability $\mathop{Pr}_{u\sim\mathcal{D}_{R}}[\ell(u)=1]$, and the loss
on the Defender set is zero, which has probability
$1-\mathop{Pr}_{u\sim\mathcal{D}_{D}}[\ell(u)=1]$. The second line is derived
similarly.

######  Theorem 3.

If the Defender trainer $\mathcal{T}_{D}$ is deterministic, invariant to the
order of the training data, and injective, then the LTU Attacker has an
optimal attack strategy, which achieves perfect accuracy.

###### Proof.

The proof uses the fact that the LTU Attacker knows all of the Defender
dataset except one sample, and knows that the missing sample is either $u_{1}$
or $u_{2}$. Therefore, the attack strategy is to create two models, one
trained on $u_{1}$ combined with the rest of the Defender dataset, and the
other trained on $u_{2}$ combined with the rest of the Defender dataset. Since
the Defender trainer is deterministic, one of those two models will match the
Defender model, revealing which unlabeled sample belonged in the Defender
dataset.

Formally, denote the subset of $\mathcal{D}_{A}$ labeled “Defender” as
$\mathcal{D}_{D}-\\{d\\}$, and the two membership unlabeled samples as $u_{1}$
and $u_{2}$. The attacker can use the Defender trainer with the same hyper-
parameters on $\left(\mathcal{D}_{D}-\\{d\\}\right)\cup\\{u_{1}\\}$ to produce
model $\mathcal{M}_{1}$ and on
$\left(\mathcal{D}_{D}-\\{d\\}\right)\cup\\{u_{2}\\}$ to produce model
$\mathcal{M}_{2}$.

By definition of the LTU Attacker , the missing sample $d$ is either $u_{1}$
or $u_{2}$, and $\mathcal{D}_{D}\cap\mathcal{D}_{R}=\emptyset$, so $u_{1}\neq
u_{2}$. There are two possible cases. If $u_{1}=d$, then
$\mathcal{D}_{D}=\left(\mathcal{D}_{D}-\\{d\\}\right)\cup\\{u_{1}\\}$, so that
$\mathcal{M}_{1}=\mathcal{M}_{D}$, since $\mathcal{T}_{D}$ is deterministic
and invariant to the order of the training data. However,
$\mathcal{D}_{D}\neq\left(\mathcal{D}_{D}-\\{d\\}\right)\cup\\{u_{2}\\}$,
since $u_{2}\neq u_{1}$, so $\mathcal{M}_{2}\neq\mathcal{M}_{D}$, since
$\mathcal{T}_{D}$ is also injective. Therefore, the LTU Attacker can know,
with no uncertainty, that $u_{1}$ has membership label “Defender” and $u_{2}$
has membership label “Reserved”. The other case, for $u_{2}=d$, has a
symmetric argument. ∎

Under the hypotheses above, the LTU Attacker achieves the optimal Bayesian
classifier using:

$\displaystyle Pr[u_{i}\in\mathcal{D}_{D}|\mathcal{M}_{i}=\mathcal{M}_{D}]$
$\displaystyle=1$ $\displaystyle
Pr[u_{i}\in\mathcal{D}_{R}|\mathcal{M}_{i}=\mathcal{M}_{D}]$ $\displaystyle=0$
$\displaystyle Pr[u_{i}\in\mathcal{D}_{D}|\mathcal{M}_{i}\neq\mathcal{M}_{D}]$
$\displaystyle=0$ $\displaystyle
Pr[u_{i}\in\mathcal{D}_{R}|\mathcal{M}_{i}\neq\mathcal{M}_{D}]$
$\displaystyle=1$

## Data and experimental setting

We are using two datasets in our experiments: CIFAR-10 (?), and QMNIST (?).
CIFAR-10 is an object classification dataset with 10 different classes, well-
known as a benchmark for membership inference attacks (?; ?; ?). QMNIST (?) is
a handwritten digit recognition dataset, similarly preprocessed as the well-
known MNIST (?), but including the whole original NIST Special Database
19222https://www.nist.gov/srd/nist-special-database-19. data (402953 images).
QMNIST includes meta-data that MNIST was deprived of, including writer IDs and
its origin (high-school students or Census Bureau employees), which could be
used in future studies of attribute or property inference attack. They are not
used in this work.

To speed up our experiments, we preprocessed the data using a backbone neural
network pretrained on some other dataset, and used the representation of the
second last layer of the network. For QMNIST we used VGG19 (?) pretrained on
Imagenet (?). For CIFAR-10, we rely on Efficient-netv2 (?) pretrained on
Imagenet21k and finetuned on CIFAR-100.

The data were then split as follows: The 402953 QMNIST images were shuffled,
then separated into 200000 samples for Defender data and 202953 for Reserved
data. The CIFAR-10 data were also shuffled and split evenly (30000/30000
approximately).

## Results

### Black-box attacker

We trained and evaluated various algorithms of the scikit-learn library as
Defender model and evaluated the Utility and Privacy, based on two subsets of
data: 1) 1600 random examples from the Defender (training) data and 2) 1600
random examples from the Reserved data (used to evaluate Utility and Privacy).
We performed $N=100$ independent LTU rounds and then computed Privacy based on
the LTU membership classification accuracy through Equation Problem statement
and methodology. The Utility of the model was obtained with Equation 2. We
used a Black-box LTU Attacker  (number (3) in Figure 2). The results shown in
Table 1 are averaged over 3 trials333Code is available at
https://github.com/JiangnanH/ppml-workshop/blob/master/generate_table_v1.py..
The first few lines (gray shaded) are deterministic methods (whose trainer
yields to the same model regardless of random seeds and sample order). For
these lines, consistent with Theorem 3, Privacy is zero, in all columns.444
Results may vary depending upon which scikit-learn output method is used
(predict_proba(), decision_function(), density_function()), or predict(). To
achieve zero Privacy, consistent with the theory, the method predict() should
be avoided. The algorithms use default scikit-learn hyper-parameter values. In
the first two result columns, the Defender trainers are forced to be
deterministic by seeding all random number generators. In the first column,
the sample order is fixed to the order used by the Defender trainer, while in
the second one it is not. Privacy in the first column is near zero, consistent
with the theory. In the second column, this is also verified for methods
independent of sample order. The third result column corresponds to varying
the random seed, hence algorithms including some level of randomness have an
increased level of privacy.

Table 1:  Utility and Privacy on QMNIST and CIFAR-10 of different scikit-learn
models with three levels of randomness: Original sample order + Fixed random
seed (no randomness); Random sample order + Fixed random seed; Random sample
order + Random seed. The Defender data and Reserved data have both 1600
examples. All numbers shown in the table have at least two significant digits
(standard error lower than 0.004). For model implementations, we use scikit-
learn (version 0.24.2) with default values. Results with Utility or Privacy
$>0.90$ are highlighted and those meeting both criteria are underlined. Shaded
in gray: fully deterministic models with Privacy$\equiv 0$.

QMNIST
Utility $|$ Privacy |  Orig. order + Seeded |  Rand. order + Seeded |  Not Seeded
---|---|---|---
Logistic lbfgs |  0.92$|$0.00 |  0.91$|$0.00 |  0.91$|$0.00
Bayesian ridge |  0.92$|$0.00 |  0.92$|$0.00 |  0.89$|$0.00
Naive Bayes |  0.70$|$0.00 |  0.70$|$0.00 |  0.70$|$0.00
SVC |  0.91$|$0.00 |  0.91$|$0.00 |  0.88$|$0.00
KNN* |  0.86$|$0.27 |  0.86$|$0.27 |  0.83$|$0.18
LinearSVC |  0.92$|$0.00 |  0.92$|$0.69 |  0.91$|$0.63
SGD SVC |  0.90$|$0.03 |  0.92$|$1.00 |  0.89$|$1.00
MLP |  0.90$|$0.00 |  0.90$|$0.97 |  0.88$|$0.93
Perceptron |  0.90$|$0.04 |  0.91$|$1.00 |  0.92$|$1.00
Random Forest |  0.88$|$0.00 |  0.88$|$0.99 |  0.85$|$1.00

CIFAR-10
Utility $|$ Privacy |  Orig. order + Seeded |  Rand. order + Seeded |  Not Seeded
---|---|---|---
Logistic lbfgs |  0.95$|$0.00 |  0.95$|$0.00 |  0.95$|$0.00
Bayesian ridge |  0.91$|$0.00 |  0.90$|$0.00 |  0.90$|$0.00
Naive Bayes |  0.89$|$0.00 |  0.89$|$0.01 |  0.89$|$0.00
SVC |  0.95$|$0.00 |  0.94$|$0.00 |  0.95$|$0.00
KNN* |  0.92$|$0.44 |  0.91$|$0.49 |  0.92$|$0.49
LinearSVC |  0.95$|$0.00 |  0.95$|$0.26 |  0.95$|$0.22
SGD SVC |  0.94$|$0.32 |  0.94$|$0.98 |  0.93$|$0.99
MLP |  0.95$|$0.00 |  0.94$|$0.98 |  0.95$|$0.97
Perceptron |  0.94$|$0.26 |  0.94$|$1.00 |  0.93$|$0.96
Random Forest |  0.92$|$0.00 |  0.93$|$0.99 |  0.91$|$0.92

The results of Table 1 show that there is no difference between the column 2
and 3; suggesting that, just with the randomness associated to altering the
order of the training samples, is enough to make the strategy fails. These
results also expose one limitation of black-box attacks: example-based methods
indicated in red (e.g., SVC), which store examples in the model, obviously
violate privacy. However, this is not detected by a black-box LTU Attacker ,
if they are properly regularized and/or involve some degree or randomness.
White-box attackers solve this problem.

### White-box attacker

We implemented a white-box attacker based on gradient calculations (method (4)
in Figure 2). We evaluated the effect of the proposed attack with QMNIST on
two types of Defender models: A Deep Neural Networks (DNN) trained with
supervised learning or with unsupervised domain adaptation (UDA) (?).555Code
is available at https://github.com/JiangnanH/ppml-workshop##white-box-
attacker.

For supervised learning, we used ResNet50 (?) as the backbone neural network,
which is pre-trained on ImageNet (?). We then retrained all its layers on the
Defender set of QMNIST. The results are reported in Table 2, line
“Supervised”. With the very large Defender dataset we are using for training
(200000 examples), regardless of variations on regularization hyper-
parameters, we could get ResNet50 to overfit. Consequently, both Utility and
Privacy are good.

In an effort to still improve Privacy, we used Unsupervised Domain Adaptation
(UDA). To that end, we use as source domains a synthetic dataset, called
Large-Fake-MNIST (?), which are similar to MNIST. Large-Fake-MNIST has 50000
white-on-black images for each digit, which results in 500000 images in total.
The target domain is the Defender set of QMNIST. The chosen UDA method is DSAN
(?; ?), which optimizes the neural network with the sum of a cross-entropy
loss (classification loss) and a local MMD loss (transfer loss) (?). We tried
3 variants of attacks of this UDA model. The simplest is the most effective:
attack the model as if it were trained with supervised learning.
Unfortunately, UDA did not yield improved performance. We attribute that to
the fact that the supervised model under attack performs well on this dataset
and already has a very good level of privacy.

Table 2:  Utility and Privacy of DNN ResNet50 Defender models trained on QMNIST. Defender model | Utility | Privacy
---|---|---
Supervised | $1.00\pm 0.00$ | $0.97\pm 0.03$
Unsupervised Domain Adaptation | $0.99\pm 0.00$ | $0.94\pm 0.03$

## Discussion and further work

Although an LTU Attacker is all knowledgeable, it must make efficient use of
available information to be powerful. We proposed a taxonomy based on
information available or used (Figure 2). The most powerful Attackers use both
the trained Defender model $\mathcal{M}_{D}$ and its trainer
$\mathcal{T}_{D}$.

When the Defender trainer $\mathcal{T}_{D}$ is a black box, like in our first
set of experiments on scikit-learn algorithms, we see clear limitations of the
LTU Attacker which include the fact that it is not possible to diagnose
whether the algorithm is example-based.

Unfortunately, white-box attacks cannot be conducted in a generic way, but
must be tailored to the trainer (e.g., gradient descent algorithms for MLP).
In contrast, black-box methods can attack $\mathcal{T}_{D}$ (and
$\mathcal{M}_{D}$) regardless of mechanism. Still, we get necessary conditions
for privacy protection by analyzing black-box methods. Both theoretical and
empirical results using black-box attackers (on a broad range of algorithms of
the scikit-learn library on the QMNIST and CIFAR-10 data), indicate that
Defender algorithms are vulnerable to a LTU Attacker if it overfits the
training Defender data or if it is deterministic. Additionally, the degree of
stochasticity of the algorithm must be sufficient to obtain a desired level of
privacy.

We explored white-box attacks neural networks trained with gradient descent.
In our experiments on the large QMNIST dataset (200,000 training examples),
Deep CNNs such as ResNet seem to exhibit both good Utility and Privacy in
their “native form”, according to our white-box attacker. We were pleasantly
surprised of our white box attack results, but, in light of the fact that
other authors found similar networks vulnerable to attack (?), we conducted
the following sanity check. We performed the same supervised learning
experiment by modifying $20\%$ of the class labels (to another class label
chosen randomly), in both the Defender set and Reserved set. Then we incited
the neural network to overfit the Defender set. Although the training accuracy
(on Defender data) was still nearly perfect, we obtained a loss of test
accuracy (on Reserved data): $78\%$. According Theorem 2, this should result
in a loss of privacy. This allowed us to verify that our white-box attacker
correctly detected a loss of privacy. Indeed, we obtained a privacy of 0.55.

We are in the process of conducting comparison experiments between our white-
box attacker and that of (?). However, their method does not easily lend
itself to be used with the LTU framework, because it requires training a
neural network for each LTU round (i.e., on each
$\mathcal{D}_{A}=\mathcal{D}_{D}-\\{\texttt{membership}(d)\\}\cup\mathcal{D}_{R}-\\{\texttt{membership}(r)\\}$).
We are considering doing only one data split to evaluate privacy, with
$\mathcal{D}_{A}=50\%~{}\mathcal{D}_{D}~{}\cup~{}50\%~{}\mathcal{D}_{R}$ and
using the rest of the data for privacy evaluation. However, we can still use
the pairwise testing of the LTU methodology, i.e., the evaluator queries the
attacker with pairs of samples, one from the Defender data and the other from
the Reserved data. In Appendix C, we show on an example that this results in
an increased accuracy of the attacker.

In Appendix C, we use the same example to illustrate how we can visualize the
privacy protection of individuals. Further work includes comparing this
approach with (?).

Further work also includes testing LTU Attacker on a wider variety of datasets
and algorithms, varying the number of training examples, training new white-
box attack variants to possibly increase the power of the attacker, and
testing various means of improving the robustness of algorithms against
attacks by LTU Attacker . We are also in the process of designing a
competition of membership inference attacks.

## Conclusion

In summary, we presented an apparatus for evaluating the robustness of machine
learning models (Defenders) against membership inference attack, involving an
“all knowledgeable” LTU Attacker . This attacker has access to the trained
model of the Defender, its learning algorithm (trainer), all the Defender data
used for training, minus the label of one sample, and all the similarly
distributed non-training Reserved data (used for evaluation), minus the label
of one sample. The Evaluator repeats this Leave-Two-Unlabeled (LTU) procedure
for many sample pairs, to compute the efficacy of the Attacker, whose charter
is to predict the membership of the unlabeled samples (training or non-
training data). We call such LTU Attacker the LTU-attacker for short. The LTU
framework helped us analyse privacy vulnerabilities both theoretically and
experimentally.

The main conclusions of this paper are that a number of conditions are
necessary for a Defender to protect privacy:

  * •

Avoid storing examples (a weakness of example-based method, such as Nearest
Neighbors).

  * •

Ensure that $p_{R}=p_{D}$ for all $f$, following Theorem 1 ($p_{R}$ is the
probability that discriminant function $f$ “favors” Reserved data while
$p_{D}$ is the probability with which it favors the Defender data).

  * •

Ensure that $e_{R}=e_{D}$, following Theorem 2 ($e_{R}$ is the expected value
of the loss on Reserved data and $e_{D}$ on Defender data).

  * •

Include some randomness in the Defender trainer algorithm, after Theorem 3.

### Acknowledgements

We are grateful to our colleagues Kristin Bennett and Jennifer He for
stimulating discussion. This work is funded in part by the ANR (Agence
Nationale de la Recherche, National Agency for Research) under AI chair of
excellence HUMANIA, grant number ANR-19-CHIA-0022.

## References

  * [Abadi et al. 2016] Abadi, M.; Chu, A.; Goodfellow, I.; McMahan, H. B.; Mironov, I.; Talwar, K.; and Zhang, L.  2016\.  Deep learning with differential privacy.  In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 308–318.
  * [Chen et al. 2020] Chen, D.; Yu, N.; Zhang, Y.; and Fritz, M.  2020\.  Gan-leaks: A taxonomy of membership inference attacks against generative models.  In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, 343–362.
  * [Deng et al. 2009] Deng, J.; Dong, W.; Socher, R.; Li, L.-J.; Li, K.; and Fei-Fei, L.  2009\.  Imagenet: A large-scale hierarchical image database.  In 2009 IEEE conference on computer vision and pattern recognition, 248–255.  Ieee.
  * [Dwork et al. 2006] Dwork, C.; McSherry, F.; Nissim, K.; and Smith, A.  2006\.  Calibrating noise to sensitivity in private data analysis.  In Theory of cryptography conference, 265–284.  Springer.
  * [Dwork et al. 2017] Dwork, C.; McSherry, F.; Nissim, K.; and Smith, A.  2017\.  Calibrating noise to sensitivity in private data analysis.  Journal of Privacy and Confidentiality 7(3):17–51.
  * [Ganin et al. 2016] Ganin, Y.; Ustinova, E.; Ajakan, H.; Germain, P.; Larochelle, H.; Laviolette, F.; Marchand, M.; and Lempitsky, V.  2016\.  Domain-adversarial training of neural networks.  The journal of machine learning research 17(1):2096–2030.
  * [Guyon et al. 1998] Guyon, I.; Makhoul, J.; Schwartz, R.; and Vapnik, V.  1998\.  What size test set gives good error rate estimates?  IEEE Transactions on Pattern Analysis and Machine Intelligence 20(1):52–64.
  * [Hayes et al. 2018] Hayes, J.; Melis, L.; Danezis, G.; and Cristofaro, E. D.  2018\.  Logan: Membership inference attacks against generative models.
  * [He et al. 2016] He, K.; Zhang, X.; Ren, S.; and Sun, J.  2016\.  Deep residual learning for image recognition.  In Proceedings of the IEEE conference on computer vision and pattern recognition, 770–778.
  * [Hilprecht, Härterich, and Bernau 2019] Hilprecht, B.; Härterich, M.; and Bernau, D.  2019\.  Reconstruction and membership inference attacks against generative models.
  * [Huang et al. 2021] Huang, H.; Luo, W.; Zeng, G.; Weng, J.; Zhang, Y.; and Yang, A.  2021\.  Damia: Leveraging domain adaptation as a defense against membership inference attacks.  IEEE Transactions on Dependable and Secure Computing.
  * [Jayaraman et al. 2020] Jayaraman, B.; Wang, L.; Knipmeyer, K.; Gu, Q.; and Evans, D.  2020\.  Revisiting membership inference under realistic assumptions.  arXiv preprint arXiv:2005.10881.
  * [Krizhevsky, Hinton, and others 2009] Krizhevsky, A.; Hinton, G.; et al.  2009\.  Learning multiple layers of features from tiny images.  Technical report.
  * [LeCun et al. 1998] LeCun, Y.; Bottou, L.; Bengio, Y.; and Haffner, P.  1998\.  Gradient-based learning applied to document recognition.  Proceedings of the IEEE 86(11):2278–2324.
  * [Li et al. 2013] Li, N.; Qardaji, W.; Su, D.; Wu, Y.; and Yang, W.  2013\.  Membership privacy: a unifying framework for privacy definitions.  In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, 889–900.
  * [Liu et al. 2020] Liu, X.; Xu, Y.; Tople, S.; Mukherjee, S.; and Ferres, J. L.  2020\.  Mace: A flexible framework for membership privacy estimation in generative models.  arXiv preprint arXiv:2009.05683.
  * [Long, Bindschaedler, and Gunter 2017] Long, Y.; Bindschaedler, V.; and Gunter, C. A.  2017\.  Towards measuring membership privacy.  arXiv preprint arXiv:1712.09136.
  * [Nasr, Shokri, and Houmansadr 2018] Nasr, M.; Shokri, R.; and Houmansadr, A.  2018\.  Machine learning with membership privacy using adversarial regularization.  In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 634–646.
  * [Nasr, Shokri, and Houmansadr 2019] Nasr, M.; Shokri, R.; and Houmansadr, A.  2019\.  Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning.  In 2019 IEEE symposium on security and privacy (SP), 739–753.  IEEE.
  * [Rahman et al. 2018] Rahman, M. A.; Rahman, T.; Laganière, R.; Mohammed, N.; and Wang, Y.  2018\.  Membership inference attack against differentially private deep learning model.  Trans. Data Priv. 11(1):61–79.
  * [Sablayrolles et al. 2019] Sablayrolles, A.; Douze, M.; Schmid, C.; Ollivier, Y.; and Jégou, H.  2019\.  White-box vs black-box: Bayes optimal strategies for membership inference.  In International Conference on Machine Learning, 5558–5567.  PMLR.
  * [Shokri et al. 2017] Shokri, R.; Stronati, M.; Song, C.; and Shmatikov, V.  2017\.  Membership inference attacks against machine learning models.  In 2017 IEEE Symposium on Security and Privacy (SP), 3–18.  IEEE.
  * [Simonyan and Zisserman 2014] Simonyan, K., and Zisserman, A.  2014\.  Very deep convolutional networks for large-scale image recognition.  arXiv preprint arXiv:1409.1556.
  * [Song and Mittal 2021] Song, L., and Mittal, P.  2021\.  Systematic evaluation of privacy risks of machine learning models.  In 30th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 21).
  * [Sun, Tu, and Guyon 2021] Sun, H.; Tu, W.-W.; and Guyon, I. M.  2021\.  Omniprint: A configurable printed character synthesizer.
  * [Tan and Le 2021] Tan, M., and Le, Q. V.  2021\.  Efficientnetv2: Smaller models and faster training.  arXiv preprint arXiv:2104.00298.
  * [Truex et al. 2019] Truex, S.; Liu, L.; Gursoy, M. E.; Yu, L.; and Wei, W.  2019\.  Demystifying membership inference attacks in machine learning as a service.  IEEE Transactions on Services Computing.
  * [Wang and Hou 2017] Wang, J., and Hou, W.  2017\.  Deepda: Deep domain adaptation toolkit.  https://github.com/jindongwang/transferlearning/tree/master/code/DeepDA.
  * [Xie et al. 2018] Xie, L.; Lin, K.; Wang, S.; Wang, F.; and Zhou, J.  2018\.  Differentially private generative adversarial network.  arXiv preprint arXiv:1802.06739.
  * [Yadav and Bottou 2019] Yadav, C., and Bottou, L.  2019\.  Cold case: The lost mnist digits.  In Advances in Neural Information Processing Systems 32. Curran Associates, Inc.
  * [Yeom et al. 2018] Yeom, S.; Giacomelli, I.; Fredrikson, M.; and Jha, S.  2018\.  Privacy risk in machine learning: Analyzing the connection to overfitting.  In 2018 IEEE 31st Computer Security Foundations Symposium (CSF), 268–282.  IEEE.
  * [Zhu et al. 2021] Zhu, Y.; Zhuang, F.; Wang, J.; Ke, G.; Chen, J.; Bian, J.; Xiong, H.; and He, Q.  2021\.  Deep Subdomain Adaptation Network for Image Classification.  IEEE Transactions on Neural Networks and Learning Systems 32(4):1713–1722.

Supplemental material

### A. Derivation of the proof of Theorem 2

If the loss function $\ell(x)$ used to train the Defender model is bounded for
all $x$, without loss of generality $0\leq\ell(x)\leq 1$ (since loss functions
can always be re-scaled), and if $e_{R}$, the expected value of the loss
function on the Reserved data, is larger than $e_{D}$, the expected value of
the loss function on the Defender data, then a lower bound on the expected
accuracy of the LTU Attacker is given by the following function of the
generalization error $e_{R}-e_{D}$:

$\displaystyle A_{ltu}\geq\frac{1}{2}+\frac{1}{2}(e_{R}-e_{D})$ (8)

###### Proof.

If the order of the pair $(u_{1},u_{2})$ is random and the loss function
$\ell(x)$ is bounded by $0\leq\ell(x)\leq 1$, then the LTU Attacker could
predict $u_{1}\in\mathcal{D}_{R}$ with probability $\ell(u_{1})$, by drawing
$z\sim U(0,1)$ and predicting $u_{1}\in\mathcal{D}_{R}$ if $z<\ell(u_{1})$,
and $u_{1}\in\mathcal{D}_{D}$ otherwise. This gives the desired lower bound on
the expected accuracy, derived as follows:

$\displaystyle A_{ltu}$
$\displaystyle=\frac{1}{2}\mathop{Pr}_{u_{1}\sim\mathcal{D}_{R}}[z<\ell(u_{1})]+\frac{1}{2}\left(1-\mathop{Pr}_{u_{1}\sim\mathcal{D}_{D}}[z<\ell(u_{1})]\right)$

When $u_{1}$ is drawn uniformly from $\mathcal{D}_{R}$, then:

$\displaystyle\mathop{Pr}_{u_{1}\sim\mathcal{D}_{R}}[z<\ell(u_{1})]$
$\displaystyle=\frac{1}{|\mathcal{D}_{R}|}\sum_{u_{1}\in\mathcal{D}_{R}}\mathop{Pr}[z<\ell(u_{1})]$
$\displaystyle=\frac{1}{|\mathcal{D}_{R}|}\sum_{u_{1}\in\mathcal{D}_{R}}\ell(u_{1})$
$\displaystyle=\mathop{\mathbb{E}}_{u_{1}\sim\mathcal{D}_{R}}\left[\ell(u_{1})\right]$
(9)

Similarly, when $u_{1}$ is drawn uniformly from $\mathcal{D}_{D}$, then:

$\displaystyle\mathop{Pr}_{u_{1}\sim\mathcal{D}_{D}}[z<\ell(u_{1})]$
$\displaystyle=\frac{1}{|\mathcal{D}_{D}|}\sum_{u_{1}\in\mathcal{D}_{D}}\mathop{Pr}[z<\ell(u_{1})]$
$\displaystyle=\frac{1}{|\mathcal{D}_{D}|}\sum_{u_{1}\in\mathcal{D}_{D}}\ell(u_{1})$
$\displaystyle=\mathop{\mathbb{E}}_{u_{1}\sim\mathcal{D}_{D}}\left[\ell(u_{1})\right]$
(10)

Substituting in these expected values gives:

$\displaystyle=\frac{1}{2}\mathop{\mathbb{E}}_{u_{1}\sim\mathcal{D}_{R}}\left[\ell(u_{1})\right]+\frac{1}{2}-\frac{1}{2}\mathop{\mathbb{E}}_{u_{1}\sim\mathcal{D}_{D}}\left[\ell(u_{1})\right]$
$\displaystyle=\frac{1}{2}+\frac{e_{R}-e_{D}}{2}$ (11) $\displaystyle\text{
where
}e_{R}\coloneqq\mathop{\mathbb{E}}_{u_{1}\sim\mathcal{D}_{R}}\left[\ell(u_{1})\right]\text{
and
}e_{D}\coloneqq\mathop{\mathbb{E}}_{u_{1}\sim\mathcal{D}_{D}}\left[\ell(u_{1})\right]$

∎

### B. Non-dominance of either strategy in Theorem 1 or Theorem 2

Here we present two simple examples to show that neither of the strategies in
Theorem 1 or Theorem 2 dominates over the other.

For example 1, assume that for $d\sim\mathcal{D}_{D}$ the loss function takes
the two values 0 or 0.5 with equal probability, and that for
$r\sim\mathcal{D}_{R}$ the loss function takes the two values 0.3 or 0.4 with
equal probability. Then $p_{R}=p_{D}=1/2$ so that $p_{R}-p_{D}=0$. However,
$e_{R}=0.35$ and $e_{D}=0.25$, so $e_{R}-e_{D}=0.1$.

For example 2, the joint probability mass function below can be used to
compute that $(e_{R}-e_{D})=0.15<(p_{r}-p_{d})=0.22$.

Table 3: Example joint PMF of bounded loss function, for $r\sim\mathcal{D}_{R}$ and $d\sim\mathcal{D}_{D}$. The attack strategy in theorem 1 outperforms the attack strategy in theorem 2 on this data. |  | $l(r)$ |  |
---|---|---|---|---
| $0$ | $1/2$ | $1$ | row sum
$l(d)=0$ | 0.24 | 0.24 | 0.12 | 0.6
$l(d)=1/2$ | 0.12 | 0.12 | 0.06 | 0.3
$l(d)=1$ | 0.04 | 0.04 | 0.02 | 0.1
column sum | 0.4 | 0.4 | 0.2 |

### C. LTU Global and Individual Privacy Scores

The following small example illustrates that the pairwise prediction accuracy
in the LTU methodology is not a function of the accuracy, false positive rate,
or false negative rate of predictions made on individual samples.

Let $f(x)$ be the discriminative function trained to predict the probability
that a sample is in the Reserved set (i.e. predictions made using a threshold
of 0.5), and for simplicity consider Defender and Reserved sets with three
samples each, such that:

$\displaystyle f(d_{1})$ $\displaystyle=0.1\qquad$ $\displaystyle f(r_{1})$
$\displaystyle=0.4$ $\displaystyle f(d_{2})$ $\displaystyle=0.3$
$\displaystyle f(r_{2})$ $\displaystyle=0.7$ $\displaystyle f(d_{3})$
$\displaystyle=c$ $\displaystyle f(r_{3})$ $\displaystyle=0.9$

If $c$ is either $0.6$, $0.8$, or $0.95$, then in all three cases the overall
accuracy for individual sample predictions is $2/3$, and the false positive
rate and false negative rate are both $1/3$. However, in the LTU methodology,
the LTU Attacker would get 9 different pairs to predict, and for those values
of $c$, its accuracy would be $8/9$, $7/9$, or $6/9$, respectively.

We used the ML Privacy Meter python library of Shokri et
al.666https://github.com/privacytrustlab/ml_privacy_meter. to run their attack
of AlexNet, which achieved an attack accuracy of 74.9%. Their attack model
predicts the probability that each sample was in the Defender dataset. The
histograms of the predictions over the Defender dataset and Reserved dataset
follow:

Figure 3: Histogram of Predicted Probabilities

Using their attack model predictions in the LTU methodology, so that the
attacker is always shown pairs of points for which exactly one was from the
Defender dataset, increased the overall attack accuracy to 81.3%.

Furthermore, by evaluating the accuracy of the attacker on each Defender
sample individually (against all Reserved samples), we computed easy to
interpret individual privacy scores for each sample in the Defender dataset:

Figure 4: Histogram of Individual Privacy Scores for each sample in the
Defender dataset