How Does Data Augmentation Affect Privacy in Machine Learning?

It is observed in the literature that data augmentation can significantly mitigate membership inference (MI) attack. However, this work, we challenge observation by proposing new MI attacks to utilize information of augmented data. attack widely used measure model's leakage training set. We establish optimal when model trained with data, which inspires us formulate as a set classification problem, i.e., classifying instances instead single point, and design input permutation invariant features. Empirically, demonstrate proposed approach universally outperforms original methods augmentation. Even further, show achieve higher success rates on models some than existing without Notably, 70.1\% rate CIFAR10 against wide residual network while previous best only attains 61.9\%. This suggests privacy risk could be largely underestimated.