  While person Re-identification (Re-ID) has progressed rapidly due to its wide
real-world applications, it also causes severe risks of leaking personal
information from training data. Thus, this paper focuses on quantifying this
risk by membership inference (MI) attack. Most of the existing MI attack
algorithms focus on classification models, while Re-ID follows a totally
different training and inference paradigm. Re-ID is a fine-grained recognition
task with complex feature embedding, and model outputs commonly used by
existing MI like logits and losses are not accessible during inference. Since
Re-ID focuses on modelling the relative relationship between image pairs
instead of individual semantics, we conduct a formal and empirical analysis
which validates that the distribution shift of the inter-sample similarity
between training and test set is a critical criterion for Re-ID membership
inference. As a result, we propose a novel membership inference attack method
based on the inter-sample similarity distribution. Specifically, a set of
anchor images are sampled to represent the similarity distribution conditioned
on a target image, and a neural network with a novel anchor selection module is
proposed to predict the membership of the target image. Our experiments
validate the effectiveness of the proposed approach on both the Re-ID task and
conventional classification task.
