<jupyter_start><jupyter_text>Running membership inference attacks on a Regression Model In this tutorial we will show how to run black-box membership attacks. This will be demonstrated on the Diabetes dataset from Scikitlearn (https://scikit-learn.org/stable/datasets/toy_dataset.htmldiabetes-dataset).   Load data<jupyter_code>import numpy as np
import os
import sys
sys.path.insert(0, os.path.abspath('..'))

from art.utils import load_diabetes

(x_train, y_train), (x_test, y_test), _, _ = load_diabetes(test_set=0.5)<jupyter_output><empty_output><jupyter_text>Train MLP regression model<jupyter_code>from sklearn.linear_model import LinearRegression
from art.estimators.regression.scikitlearn import ScikitlearnRegressor

model = LinearRegression()
model.fit(x_train, y_train)

art_regressor = ScikitlearnRegressor(model)

print('Base model score: ', model.score(x_test, y_test))<jupyter_output>Base model score:  0.5182246496026136<jupyter_text>Attack Black-box attackThe black-box attack basically trains an additional classifier (called the attack model) to predict the membership status of a sample. The loss of the target model is used as input to the learning process.<jupyter_code>from art.attacks.inference.membership_inference import MembershipInferenceBlackBox


bb_attack = MembershipInferenceBlackBox(art_regressor, attack_model_type='rf', input_type='loss')

attack_train_ratio = 0.5
attack_train_size = int(len(x_train) * attack_train_ratio)
attack_test_size = int(len(x_test) * attack_train_ratio)


# train attack model
bb_attack.fit(x_train[:attack_train_size], y_train[:attack_train_size],
              x_test[:attack_test_size], y_test[:attack_test_size])

# infer 
inferred_train_bb = bb_attack.infer(x_train.astype(np.float32), y_train)
inferred_test_bb = bb_attack.infer(x_test.astype(np.float32), y_test)

# check accuracy
train_acc_bb = np.sum(inferred_train_bb) / len(inferred_train_bb)
test_acc_bb = 1 - (np.sum(inferred_test_bb) / len(inferred_test_bb))
acc_bb = (train_acc_bb * len(inferred_train_bb) + test_acc_bb * len(inferred_test_bb)) / (len(inferred_train_bb) + len(inferred_test_bb))
print('Member accuracy:', train_acc_bb)
print('Non-Member accuracy:', test_acc_bb)
print('Accuracy:', acc_bb)
def calc_precision_recall(predicted, actual, positive_value=1):
    score = 0  # both predicted and actual are positive
    num_positive_predicted = 0  # predicted positive
    num_positive_actual = 0  # actual positive
    for i in range(len(predicted)):
        if predicted[i] == positive_value:
            num_positive_predicted += 1
        if actual[i] == positive_value:
            num_positive_actual += 1
        if predicted[i] == actual[i]:
            if predicted[i] == positive_value:
                score += 1
    
    if num_positive_predicted == 0:
        precision = 1
    else:
        precision = score / num_positive_predicted  # the fraction of predicted “Yes” responses that are correct
    if num_positive_actual == 0:
        recall = 1
    else:
        recall = score / num_positive_actual  # the fraction of “Yes” responses that are predicted correctly

    return precision, recall

# rule-based
print(calc_precision_recall(np.concatenate((inferred_train_bb, inferred_test_bb)), 
                            np.concatenate((np.ones(len(inferred_train_bb)), np.zeros(len(inferred_test_bb))))))<jupyter_output>(0.7804878048780488, 0.7239819004524887)
{'fraction_non_alphanumeric': 0.09311859443631039, 'fraction_numerical': 0.021083455344070277, 'mean_word_length': 4.940869565217391, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 11, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '3', 'dir': 'jupyter-structured-clean-dedup', 'id': '165881', 'license': 'MIT', 'n_tokens_mistral': 1195, 'n_tokens_neox': 1103, 'n_words': 250, 'path': 'notebooks/attack_membership_inference_regressor.ipynb', 'repo_name': 'jamestiotio/adversarial-robustness-toolbox', 'size': '3415'}