Abstract
Membership Inference (MI) poses a substantial privacy threat to the training data of Automatic Speech Recognition (ASR) systems, while also offering an opportunity to audit these models with regard to user data. This paper explores the effectiveness of loss-based features in combination with Gaussian and adversarial perturbations to perform MI in ASR models. To the best of our knowledge, this approach has not yet been investigated. We compare our proposed features with commonly used error-based features and find that the proposed features greatly enhance performance for sample-level MI. For speaker-level MI, these features improve results, though by a smaller margin, as error-based features already obtained a high performance for this task. Our findings emphasise the importance of considering different feature sets and levels of access to target models for effective MI in ASR systems, providing valuable insights for auditing such models.
Abstract (translated)
翻译：Membership Inference (MI) 对自动语音识别（ASR）系统的训练数据提出了实质性的隐私威胁，同时为审计这些模型与用户数据有关提供了机会。本文探讨了基于损失的特征与高斯和对抗扰动在ASR模型中进行MI的有效性。据我们所知，这种方法尚未被研究过。我们将提出的特征与常见的基于错误的特征进行比较，发现所提出的特征在样本级MI方面极大地提高了性能。在说话人级别MI方面，这些特征提高了结果，但相对较小，因为基于错误的特征已经在这一任务上取得了很高的性能。我们的研究结果强调了在ASR系统中有效MI时考虑不同特征集和访问目标模型的重要性，为审计这些模型提供了宝贵的见解。
URL
https://arxiv.org/abs/2405.01207
