Property inference attacks against machine learning (ML) models aim to infer
properties of the training data that are unrelated to the primary task of the
model, and have so far been formulated as binary decision problems, i.e.,
whether or not the training data have a certain property. However, in
industrial and healthcare applications, the proportion of labels in the
training data is quite often also considered sensitive information. In this
paper we introduce a new type of property inference attack that unlike binary
decision problems in literature, aim at inferring the class label distribution
of the training data from parameters of ML classifier models. We propose a
method based on \emph{shadow training} and a \emph{meta-classifier} trained on
the parameters of the shadow classifiers augmented with the accuracy of the
classifiers on auxiliary data. We evaluate the proposed approach for ML
classifiers with fully connected neural network architectures. We find that the
proposed \emph{meta-classifier} attack provides a maximum relative improvement
of 52% over state of the art.Comment: 12 pages, 2022 Trustworthy and Socially Responsible Machine Learning
(TSRML 2022) co-located with NeurIPS 202