\section{Setup}\label{sec:setup}
\subsection{Trained Models for Predicting Brain Age}
We use models trained to predict brain age from structural MRIs to demonstrate vulnerability to membership inference attacks.
We show successful attacks on \texttt{3D-CNN} and \texttt{2D-slice-mean} models. The neural network architectures are summarized in \appendixref{subsec:architecture_diagrams}. For centralized training, we use the same dataset and training setup as \citet{gupta2021improved} and for federated training, we use the same training setup and dataset as \citet{stripelis2021scaling} (see \appendixref{subsec:centralized_training_details,subsec:federated_training_details}). %
In the latter, the authors simulate different federated training environments by considering diverse amounts of records (i.e., Uniform and Skewed) and varying subject age  distribution across learners (i.e., IID and non-IID).
All models are trained on \rebuttal{T1 structural MRI scans of healthy subjects from the  UK Biobank dataset~\cite{ukbb} with the same pre-processing as~\citet{lam2020accurate}}.
See \appendixref{sec:appendix_training_data_details} for more details regarding the dataset, data distribution, and training setup.






\subsection{Attack Setup}\label{subsec:attack_setup}
As discussed in \sectionref{sec:sub_membership_attacks}, attackers may have access to some part of the training set and additional MRI samples that were not used for training, referred hereafter as the \textit{unseen set}. We train a binary classifier to distinguish if the sample was part of the training set (see \appendixref{sec:attack_arch} for classifier architecture details). We study effectiveness of different features for the attacks in \sectionref{subsec:centralized_result}.

In the case of models trained via centralized training, the attack models are trained on a balanced training set using 1500 samples from both training and unseen sample set\footnote{In the implementation, the unseen set is the same as the test dataset used to evaluate the brain age model. \rebuttal{The unseen set and the training set are IID samples from the same distribution.}}. For testing, we create a balanced set from the remaining train and unseen set --- 694 samples each and report accuracy as the vulnerability measure. To attack models trained via federated learning, we consider each learner as the attacker. Thus, the attacker is trained on its private dataset and some samples from the unseen set that it may have. This way, we created a balanced training set of up to 1000\footnote{In the case of Skewed \& non-IID environment, some learners had less than 1000 training samples. As a result, the attack model had to be trained with fewer samples.}  samples from training and unseen set each.
\rebuttal{Unlike centralized setup, the distribution of the unseen set and training set that the attacker model is trained on could be different, particularly in non-IID environments.} In this scenario, the attacks are made on the private data of other learners. Thus, we report the classifier's accuracy on the test set created from the training sample of the learner being attacked and new examples from the unseen set.

