A Unified Framework for Privacy Attacks in Machine Learning: Theory and Empirical Evaluation

This thesis investigates how machine learning models can disclose information about their training data or learned behavior. Its contribution is a unified formal description of membership inference, property inference, reconstruction, and model extraction, supported by four experimental adaptations of established attacks. The framework makes their inference targets, access assumptions, and evaluation criteria explicit, distinguishing training-data privacy from model confidentiality. Four case studies apply offline LiRA, property inference, MI-Face reconstruction, and $E^3$ extraction to image benchmarks. The membership results show how low false-positive requirements and shadow-model choices affect what an attack can detect. Property inference successfully distinguishes controlled dataset compositions through model parameters. Reconstruction produces coarse facial prototypes without establishing recovery of individual training images, while extraction approximates a target model's predictions through query access. Together, the case studies illustrate distinct forms of disclosure, each requiring its own success criterion. The comparison shows why predictive accuracy alone is insufficient to assess confidentiality. A literature-based discussion relates the findings to defenses and national-security concerns, emphasizing that protection must be evaluated against the information at risk and the access available to an adversary.