Amplifying Machine Learning Attacks Through Strategic Compositions

Abstract: Machine learning (ML) models are proving to be vulnerable to a variety of attacks that allow the adversary to learn sensitive information, cause mispredictions, and more. While these attacks have been extensively studied, current research predominantly focuses on analyzing each attack type individually. In practice, however, adversaries may employ multiple attack strategies simultaneously rather than relying on a single approach. This prompts a crucial yet underexplored question: When the adversary has multiple attacks at their disposal, are they able to mount or amplify the effect of one attack with another? In this paper, we take the first step in studying the strategic interactions among different attacks, which we define as attack compositions. Specifically, we focus on four well-studied attacks during the model's inference phase: adversarial examples, attribute inference, membership inference, and property inference. To facilitate the study of their interactions, we propose a taxonomy based on three stages of the attack pipeline: preparation, execution, and evaluation. Using this taxonomy, we identify four effective attack compositions, such as property inference assisting attribute inference at its preparation level and adversarial examples assisting property inference at its execution level. We conduct extensive experiments on the attack compositions using three ML model architectures and three benchmark image datasets. Empirical results demonstrate the effectiveness of these four attack compositions. We implement and release a modular reusable toolkit, COAT. Arguably, our work serves as a call for researchers and practitioners to consider advanced adversarial settings involving multiple attack strategies, aiming to strengthen the security and robustness of AI systems.

• The paper introduces a taxonomy for composing attacks that shows how combining adversarial examples, membership, property, and attribute inference can significantly amplify ML vulnerabilities.
• The paper empirically demonstrates that strategic compositions boost attack accuracy—evidenced by increases from random to near-optimal performance on benchmarks like CIFAR10, Places, and CelebA.
• The paper releases the CoAT toolkit for reproducible evaluation, revealing that defenses such as differential privacy may be insufficient against multi-vector attack strategies.

Strategic Compositions of Machine Learning Attacks: Amplification and Implications

The paper "Amplifying Machine Learning Attacks Through Strategic Compositions" (2506.18870) presents a systematic study of the interactions among multiple inference-time attacks on ML models. The authors move beyond the conventional paradigm of analyzing attacks in isolation and instead investigate how adversaries can intentionally compose different attack strategies to amplify their effectiveness. The work focuses on four canonical inference-time attacks: adversarial examples, attribute inference, membership inference, and property inference. The authors introduce a taxonomy for attack composition, empirically demonstrate the amplification effects of strategic compositions, and provide a modular toolkit (CoAT) for reproducible evaluation.

Taxonomy and Methodology

The authors propose a taxonomy for attack composition based on the attack pipeline, partitioned into three stages:

• Preparation: Activities prior to the main attack, such as data collection and auxiliary model training.
• Execution: The actual implementation of the attack, including queries and exploitation.
• Evaluation: Post-attack analysis and calibration.

This taxonomy enables systematic identification of points where one attack can support or amplify another. The authors identify four effective compositions:

1. Property inference assisting attribute inference (preparation): Property inference is used to estimate the distribution of sensitive attributes in the training data, enabling the adversary to construct a more effective auxiliary dataset for attribute inference.
2. Adversarial examples assisting membership inference (execution): The $L_2$ distance between original and adversarial examples is used as an additional feature to distinguish members from non-members, leveraging the distributional shift induced by adversarial perturbations.
3. Adversarial examples assisting property inference (execution): The distribution of adversarial perturbation magnitudes across datasets with different property proportions is exploited to improve property inference accuracy.
4. Property inference assisting membership inference (evaluation): Property inference is used to calibrate membership inference outputs, adjusting for prior property distributions in the training data.

Empirical Evaluation

Experiments are conducted on three benchmark image datasets (CelebA, CIFAR10, Places) and three model architectures (DenseNet121, ResNet18, VGG19). The results demonstrate substantial amplification of attack effectiveness through composition:

• Property-to-Attribute Inference: On ResNet18 with CIFAR10, attribute inference accuracy increases from 0.500 (random guess) to 0.894 (empirical) and 0.872 (theoretical) when assisted by property inference.
• Adversarial-to-Membership Inference: For black-box membership inference on ResNet18 with Places, accuracy improves from 0.664 to 0.851, and for property inference from 0.890 to 0.960, when adversarial example information is incorporated.
• Property-to-Membership Inference (Calibration): Membership inference accuracy on ResNet18 with CIFAR10 increases from 0.631 to 0.669 after calibration with property inference.

These results are consistent across datasets and architectures, with the amplification effect being most pronounced when the original attack is weak due to data imbalance or limited overfitting.

CoAT Toolkit

The authors introduce CoAT, a modular and extensible toolkit for evaluating attack compositions. CoAT is structured into four modules: input preparation, attack implementation, composition logic, and analysis. The modularity allows for easy integration of new attacks, datasets, and models, facilitating reproducibility and further research.

Differential Privacy and Defense Limitations

The study includes an ablation on differential privacy (DP) as a defense. While DP is effective against membership inference in isolation, the results show that composition with adversarial examples can partially bypass DP, and DP is largely ineffective against property and attribute inference, as well as their compositions. This highlights a critical limitation of current defense strategies: they are typically designed for individual attacks and do not account for synergistic adversarial strategies.

Chain Compositions

The authors also explore "chains of composition," where multiple attacks are composed in sequence (e.g., adversarial example → property inference → attribute inference). The results indicate that such chains can further amplify attack effectiveness, sometimes matching the performance of the strongest single composition.

Implications and Future Directions

This work makes several strong claims:

• Attack compositions can significantly amplify the effectiveness of individual attacks, often surpassing the performance of standalone attacks.
• Current defense mechanisms, such as differential privacy, are insufficient when facing composed attacks.
• The real-world risk posed by ML model vulnerabilities is underestimated if only individual attacks are considered.

The practical implications are substantial. Security evaluations of deployed ML systems must consider the possibility of adversaries leveraging multiple attack vectors in concert. Defense strategies need to be rethought to address the compositional nature of real-world threats. The CoAT toolkit provides a foundation for benchmarking and developing such defenses.

Theoretically, the taxonomy and empirical findings suggest that the attack surface of ML models is not merely the union of individual attacks, but is expanded by their interactions. This calls for new formal models of adversarial capability and risk assessment.

Future research directions include:

• Extending the study to other domains (e.g., NLP, graph data) and attack types (e.g., training-time attacks, model stealing).
• Designing defense mechanisms that are robust to attack compositions, possibly by jointly optimizing for multiple threat models.
• Formalizing the theory of attack composition and its limits.

Conclusion

The paper provides a comprehensive and systematic analysis of strategic attack compositions in ML security, demonstrating that adversaries can amplify their capabilities by combining multiple inference-time attacks. The findings challenge the sufficiency of current defense paradigms and establish a new benchmark for evaluating ML model robustness in adversarial settings. The release of the CoAT toolkit is likely to catalyze further research into both attack and defense strategies under realistic, multi-vector threat models.