Pith. sign in

REVIEW 3 major objections 5 minor 28 references

Membership Inference Attacks for Unseen Classes

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims shadow-model membership inference fails when the queried class was unseen during attack training, and that quantile-regression attacks transfer to such classes with up to 11× the TPR at 1% FPR.

desk verdict A genuinely new MIA problem setting with a credible finding, but the headline comparison is partly confounded by score-function choice; deserves serious review with major revisions. read the letter →

arxiv 2506.06488 v3 pith:DGCRZY7E submitted 2025-06-06 cs.LG cs.CRstat.ML

Pratiksha Thaker , Neil Kale , Zhiwei Steven Wu , Virginia Smith This is my paper
classification cs.LGcs.CRstat.ML MSC 68P2768T0562G08
keywords membershipinferenceattacksunseenclassesshadowmodelsquantileregressiondataauditingdistributionshiftlowfalsepositiverateAIsafety
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper formalizes a data-access restriction it calls the “unseen class” setting: an auditor who wants to test whether harmful or sensitive examples were in a model's training data has no samples from the relevant class when training the attack. In this setting the paper claims the standard shadow-model family of membership-inference attacks collapses, often to the level of a global-threshold baseline, because shadow models trained without the class assign it zero probability. The paper's positive claim is that quantile-regression attacks—which learn per-example score thresholds directly—generalize to unseen classes and deliver substantially higher true-positive rates at low false-positive rates, up to 11× the shadow-model TPR on CIFAR-100. A transferability theorem states the condition under which this should hold: if the density ratio between the full query distribution and the seen-class training distribution is a linear function of the quantile regressor's features, the false-positive-rate guarantee transfers. The work matters because real auditing scenarios, such as detecting child sexual abuse material, legally and ethically cannot supply the very content being audited.

What carries the argument

The central object is the quantile-regression attack: instead of training many shadow models, the attacker fits a single model $q_\alpha(x) = \langle \phi(x), w \rangle$ that predicts the $(1-\alpha)$-quantile of the nonmember score distribution per example, trained by minimizing pinball loss on seen classes, and then flags any example whose target-model score exceeds that threshold. The argument is carried by a transferability theorem (Theorem 5.3) that combines two conditions: multi-accuracy of the quantile predictor under the seen-class distribution, and an exact linear density-ratio condition $dQ_\phi/dP_\phi = \langle \phi(x), v \rangle$ between the full evaluation distribution and the seen-class training distribution. When both hold, the false-positive-rate guarantee proven on seen classes carries over to unseen classes. The paper also introduces the unseen-class data-access model itself—training the attack on $D'_{\mathrm{pub}}$ drawn from seen classes only while querying the full distribution—as the formal object that makes the failure of shadow models visible.

What would settle it

Train a quantile-regression attack on seen classes, then measure its calibration gap on held-out unseen classes for datasets where the linear-fit MSE of the density ratio is deliberately made large (e.g., by removing a class whose embedding distribution shifts nonlinearly). If the false-positive rate on unseen classes drifts from the nominal 1% while the linear-fit MSE is large, the theorem's mechanism is falsified; if TPR at low FPR stays high regardless of linearity, the generalization has a different cause.

Watch

Extended reading notes

Core claim

On its own terms, the paper establishes that the “unseen class” setting is a distinct MIA threat model in which shadow-model attacks—including LiRA and RMIA—fail because they must replicate the target model's task, and a classifier trained without a class assigns zero probability to that class. Quantile-regression attacks, trained once on seen classes, instead learn features that separate members from nonmembers and transfer those thresholds to held-out classes. Empirically the paper reports up to 11× higher TPR at 1% FPR over shadow models on CIFAR-100, 2× on the Texas tabular benchmark, 6× on 20 Newsgroups text classification, and 3.8% TPR at 1% FPR on ImageNet with as few as ten training classes seen. The theoretical contribution is Theorem 5.3: a linear quantile predictor that is multi-accurate under the seen-class distribution remains calibrated under the full distribution whenever the density ratio is exactly a linear function of the feature map. The paper frames quantile regression as a “promising approach,” not a complete solution, and points to the linearity condition as the place where the argument could break.

Load-bearing premise

The theoretical explanation assumes the density ratio between the full query distribution and the seen-class training distribution is exactly a linear function of the learned feature map, and the supporting empirical check only approximates that ratio in a two-dimensional projection of the embeddings.

Editorial extensions

If this is right

  • In the unseen-class setting, shadow-model attacks such as LiRA and RMIA cannot be assumed to transfer; their true-positive rate can fall below that of a single global threshold.
  • Quantile-regression attacks give a practical auditing tool when only a fraction of classes is available, for example 3.8% TPR at 1% FPR on ImageNet with 10% of classes, and they stay above the marginal baseline even with 990 of 1000 classes unseen.
  • The false-positive-rate guarantee of a quantile-regression attack is portable across distributions exactly when the density ratio is linearly representable in the feature space, so practitioners can check this condition on their own data.
  • Because the attack trains a single lightweight model rather than a shadow-model ensemble, it is computationally cheaper in the settings where it works.
  • Defenses behave as expected: weight decay weakens the attack but does not erase its advantage, while differential privacy, when training from scratch is feasible, removes the attack's signal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the linearity condition in Theorem 5.3 holds approximately in practical embedding spaces, quantile-regression attacks could be applied to other restricted-access audits, such as detecting copyrighted or proprietary content, without ever training on that content.
  • The paper's density-ratio check uses a two-dimensional PCA projection and Gaussian mixtures; testing the ratio in the full embedding space or with a nonlinear function class would show whether the linear condition is the real mechanism or a convenient approximation.
  • A direct test of the theorem: measure the calibration gap on unseen classes as a function of linear-fit MSE across datasets; the paper's own ordering (CINIC-10 worst, ImageNet best) is consistent with the gap shrinking as the linear fit improves.
  • The same transfer argument should apply to other per-example threshold learners, such as difficulty-calibrated loss models, suggesting a broader family of membership predictors that generalize to unseen classes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper formalizes a new membership-inference data access model, the 'unseen class' setting, in which the attacker has no samples from one or more classes on which membership is queried. It argues that shadow-model based attacks (LiRA, RMIA) deteriorate sharply in this setting, while quantile regression attacks generalize to unseen classes and achieve substantially higher TPR at low FPR across image, text, and tabular benchmarks. The paper also proves a transferability theorem (Theorem 5.3) giving a sufficient condition, in terms of a linear density-ratio assumption, for quantile predictors to remain calibrated under distribution shift, and reports exploratory PCA/GMM-based empirical checks of this condition. The central empirical claim is that quantile regression outperforms shadow-model attacks by up to 11x TPR at 1% FPR in the unseen-class setting.

Significance. If the empirical claims hold under a controlled comparison, the paper identifies a practically important failure mode of state-of-the-art MIAs in class-restricted auditing scenarios (e.g., CSAM detection, medical data) and proposes a computationally cheaper alternative. The formalization of the unseen-class setting is a useful conceptual contribution, and the multi-domain evaluation covers images, text, and tabular data. The transferability theorem is a clean conditional result, though its assumption is strong and only weakly validated. The paper also includes defense evaluations and multiple backbones. However, the headline comparison is currently confounded by the use of different score functions for shadow-model and quantile-regression attacks, and the empirical results lack confidence intervals or repeated seeds, so the quantitative strength of the central claim is not yet established.

major comments (3)
  1. [Section 4.1 vs Sections 2–3, Eq. (1)] The central comparison is not matched on the score function. The shadow-model baselines LiRA and RMIA are evaluated using the true-label logit-difference score from Eq. (1), while the quantile-regression attack is evaluated using the top-two logit difference, introduced in Section 4.1 with the note that it 'improves quantile regression performance.' For an unseen class, a shadow model has not seen the query class during training, so the true-label score behaves very differently from the top-two score, which remains well-defined. Appendix B (Figure 7) shows that switching LiRA to the top-two score on CINIC-10 makes the shadow attack worse, not better. Since no matched-score comparison is reported for CIFAR-100, ImageNet, Texas, or 20 Newsgroups, and none is reported for RMIA, the up-to-11x TPR advantage attributed to quantile regression may be a score-function effect rather than a method effect. Please rerun the headline comparisons with both attack families using the same score function, or provide a well-justified argument for why the score functions cannot be matched in this setting.
  2. [Figures 2 and 4; Tables 1–2] The empirical claims rest on single-run point estimates without confidence intervals or repeated seeds. Because the evaluation sets are single classes with roughly 1000 samples, TPR at 1% FPR corresponds to about 10 true-positive examples, and the per-class differences reported in Figures 2 and 4 are at the level of a few true positives (e.g., 1.4% vs 3.8% is 14 vs 38 positives). Without confidence intervals, repeated-seed variance, or a sensitivity analysis over class draws, the statements that quantile regression 'strictly outperforms' shadow models cannot be distinguished from noise. Please add error bars or bootstrap intervals, and run multiple seeds or class-draw replications for the main comparisons.
  3. [Section 5.1 and Theorem 5.3] The empirical check of Theorem 5.3 uses a two-dimensional PCA projection of the embeddings and Gaussian mixture density estimates, then fits a linear model and reports MSE. This does not test the theorem's assumption that the density ratio in the original feature space is exactly of the form <phi(x), v>; moreover, the reported MSE values (8.11e-3, 2.10e-3, 1.85e-3) are not compared against any null baseline or against a nonlinear alternative, so they cannot establish that the assumption 'holds' on the datasets. Please either test linearity on the full embedding or a much larger projection with a proper goodness-of-fit comparison, or reframe Section 5.1 as exploratory evidence and state explicitly that the theorem is conditional on an unverified assumption.
minor comments (5)
  1. [Appendix G] The proof of Theorem 5.3 contains typos that make it hard to follow: the contradiction step should be formulated under P, not Q, and the displayed inner product should be positive (not negative) for the directional-derivative argument to work; as written, the sign and the measure are inconsistent with the stated assumption.
  2. [Section 5] The sentence 'The assumption of optimality in the last layer is mild, since the pinball loss is convex in w given fixed features' is imprecise: the theorem assumes exact minimization of the expected pinball loss, not merely convexity. Clarify that optimization error is assumed to be zero.
  3. [Figure 3b] The text states that the unseen-class ROC curve 'remains significantly above the marginal baseline,' but Figure 3b does not plot a marginal baseline curve. Please include that curve or adjust the wording.
  4. [Appendix C and D captions] Several figure captions alternate between 'CIFAR-10' and 'CINIC-10' (e.g., Figure 8(a) is labeled 'CIFAR-10' while the associated experiments in Section 4.1 are described as CINIC-10; Figure 9 and Figure 10 also mix the two names). Please make the dataset labels consistent.
  5. [Section 4.2] There is a typo: 'againstrictly outperforms' should read 'strictly outperforms.'

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the attack comparison is out-of-sample, the transferability theorem is conditional with a post-hoc consistency check, and the self-citations to prior quantile-regression work are not load-bearing.

full rationale

The derivation chain is not circular in any of the seven enumerated senses. The unseen-class setting is a data-access restriction, not a relabeling of the result; the quantile-regression attack is trained on seen classes and evaluated on held-out unseen classes, and no parameter is fitted to the reported TPR values. The theoretical model (Theorem 5.3) is explicitly conditional: if the density ratio dQ_phi/dP_phi equals <phi(x),v> for the fixed feature map, then a pinball-optimal linear quantile predictor transfers its calibration from P to Q. The proof is a standard convex-optimality and change-of-measure argument; it does not assume the conclusion. Section 5.1's empirical check of that assumption uses a two-dimensional PCA projection and Gaussian mixtures, and the resulting MSE values are a post-hoc consistency check that could have contradicted the theorem's premise; it is not a fitted parameter renamed as a prediction. The only self-citations are to prior quantile-regression work by one of the present authors ([1], [19]), used as the source of the attack method and the Gaussian-loss training trick; the paper re-implements and evaluates these methods against independent baselines (LiRA, RMIA, LOSS), so the citations are not load-bearing evidence. The main weakness is a comparison confound: LiRA/RMIA are scored with the true-label logit difference while the quantile-regression attack uses the top-two logit difference, and Appendix B shows the top-two score hurts shadow attacks on CINIC-10. That is a threat to the validity of the empirical comparison, but it is not a circular derivation; it does not make any reported quantity equivalent to its input by construction. Likewise, the approximate density-ratio check is weaker than the theorem's assumption, but that is a soundness gap, not circularity. Overall score 2 reflects only minor self-citation with no load-bearing circular step.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The free_parameters list is empty because the quantile regressor's weights are learned from the attack training data, which is part of the method rather than an extra fitted parameter of the paper's claims. The alpha level (1% FPR) is a standard evaluation threshold, not a fitted constant. The main assumptions are the softmax zero-probability behavior for unseen classes, the linear density-ratio condition in Theorem 5.3, and the standard convexity/elicitation properties of the pinball loss.

assumptions (4)
  • domain assumption Shadow models trained on a label set excluding class i assign approximately zero probability to class i, causing the true-label confidence score to fail.
    Section 3: 'Intuitively, a model that does not see a class at training time will assign zero probability to that class label.' This is a modeling assumption about softmax classifiers.
  • ad hoc to paper The density ratio between the full-distribution and seen-class embedding distributions is of the form <phi(x), v> for some vector v.
    Theorem 5.3: 'Assume that the density ratio between Q and P satisfies dQ_phi/dP_phi = <phi(x), v>.' This is a strong, unverified assumption introduced for the proof.
  • standard math Pinball loss elicits quantiles and is convex, so empirical risk minimization yields a calibrated quantile predictor.
    Section 2 and Definition 5.1; used to justify the training objective and the optimality condition in the proof.
  • domain assumption The target model and shadow models are trained with identical architecture and training procedure.
    Section 2: 'the adversary trains k shadow models g1,...,gk, each solving the same classification task as the target model f, with architecture and training procedure identical to that of f.'

how reviews work

0 comments
Cite this review

Pith. "Pith review of Membership Inference Attacks for Unseen Classes." pith.science (2026). https://pith.science/paper/DGCRZY7E

@misc{pith2026250606488,
  author       = {Pith},
  title        = {Pith review of: Membership Inference Attacks for Unseen Classes},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DGCRZY7E}},
  note         = {Machine review of arXiv:2506.06488}
}
abstract

A key tool in developing safe AI models is \emph{data auditing}, i.e., using statistical tools to determine whether harmful content may have been used in the training data of a black-box model. Unfortunately, most \emph{membership inference attacks} (MIAs) used to perform this type of auditing themselves assume \emph{access} to examples of harmful content from the same distribution as the query data. In real-world auditing scenarios, auditors often face legal and ethical restrictions preventing them from accessing a representative set of samples of harmful content to train MIA models effectively. We abstract and formalize this setting into a new data access model, the ``unseen class'' setting, and show that the state of the art MIAs fail due to the lack of access to the full target distribution. We show in this setting, \emph{quantile regression attacks} outperform approaches typically considered to be SoTA. We demonstrate this both empirically and theoretically, showing that quantile regression attacks achieve up to \textbf{11$\times$ the TPR} of shadow model-based approaches in practice, and providing a theoretical model that outlines the generalization properties required for this approach to succeed. Our work identifies an important failure mode in existing MIAs and provides a cautionary tale for practitioners that aim to directly use existing tools for real-world applications of AI safety.

Figures

Figures reproduced from arXiv: 2506.06488 by the authors.

Figure 1
Figure 1. True positive rates for shadow model attacks in the 1% false positive rate regime for CINIC-10 and CIFAR-100 (we defer the 0.1% regime to Appendix B). Each bar represents the TPR on the indicated class. “Full training” refers to the TPR on class i when no classes are excluded from shadow model training. In yellow, we plot the TPR when that class is excluded from shadow model training. The attack success degrades sig… view at source ↗
Figure 2
Figure 2. True positive rates in the low false positive regime for CINIC-10 and CIFAR-100 (superclass set) on each unseen class. Each bar represents the true positive rate on class i when class i is dropped from the attack training set. We only report results at 1% FPR; the results at 0.1% FPR are not meaningful due to the small sample size of the validation set on a single class (1000 samples). While quantile regression atta… view at source ↗
Figure 3
Figure 3. ROC curves for class and sample drop experiments on ImageNet. Enlarged versions of the plots are provided in Appendix H. remains fixed around 3.8% TPR at 1% FPR (0.4% TPR at 0.1% FPR) when anywhere from 100 to 900 classes are removed, and remains significantly above the marginal baseline even with 990 classes removed. Finally, another realistic setting of data scarcity is one where examples from all classes are avai… view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: True positive rates in the low false positive regime for Texas (tabular) and 20 Newsgroups (text) on sets of unseen classes. Each bar represents the true positive rate on classes C when C are dropped from the attack training set. We only report results at 1% FPR; the r…
Figure 5
Figure 5. Figure 5: Visualization of Gaussian mixture models fit to the (dimension-reduced) embeddings learned by the quantile re￾gression models trained on on subsets of CINIC-10, CIFAR-100, and Imagenet. Dropping a class largely does not change the distribution over embeddings for CIFAR…
Figure 6
Figure 6. Figure 6: True positive rates for shadow model attacks in the 0.1% false positive rate regime for CINIC-10 and CIFAR-100. Each bar represents the TPR on the indicated class. In yellow, we plot the TPR when that class is excluded from shadow model training. The attack success deg…
Figure 7
Figure 7. Figure 7 [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: AUCs for CINIC-10, CIFAR-100, Texas (tabular) and 20 Newsgroups (text) on sets of unseen classes. Each bar represents the AUC on classes C when C are dropped from the attack training set. 15 [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]
Figure 9
Figure 9. Figure 9: TPRs for CINIC-10 and CIFAR-100 on sets of unseen classes. Each bar represents the TPR on classes C when C are dropped from the attack training set. We only report results at 1% FPR; the results at 0.1% FPR are not meaningful due to the small sample size of the validat…
Figure 10
Figure 10. Figure 10: AUCs for CINIC-10 and CIFAR-100 on sets of unseen classes. Each bar represents the AUC on classes C when C are dropped from the attack training set. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_10.png]
Figure 11
Figure 11. Figure 11: AUC and TPR for CINIC-10 and CIFAR-100 on sets of unseen classes. Each bar represents the metric on classes C when C are dropped from the attack training set. We only report results at 1% FPR; the results at 0.1% FPR are not meaningful due to the small sample size of …
Figure 12
Figure 12. Figure 12: ROC curve for class drop experiment on ImageNet (Figure 3a enlarged). 21 [PITH_FULL_IMAGE:figures/full_fig_p021_12.png]
Figure 13
Figure 13. Figure 13: Unseen class ROC curve for class drop experiment on ImageNet (Figure 3b enlarged). 22 [PITH_FULL_IMAGE:figures/full_fig_p022_13.png]
Figure 14
Figure 14. Figure 14: ROC curve for sample drop experiment on ImageNet. (Figure 3c enlarged). 23 [PITH_FULL_IMAGE:figures/full_fig_p023_14.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

28 extracted references · 17 canonical work pages

  1. [1]

    Scalable membership inference attacks via quantile regression.Advances in Neural Information Processing Systems, 36:314–330, 2023

    Martin Bertran, Shuai Tang, Aaron Roth, Michael Kearns, Jamie H Morgenstern, and Steven Z Wu. Scalable membership inference attacks via quantile regression.Advances in Neural Information Processing Systems, 36:314–330, 2023

    2023

  2. [2]

    Membership inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In2022 IEEE symposium on security and privacy (SP), pages 1897–1914. IEEE, 2022

    1914

  3. [3]

    Extracting training data from diffusion models

    Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In32nd USENIX Security Symposium (USENIX Security 23), pages 5253–5270, 2023

    work page 2023

  4. [4]

    Label-only mem- bership inference attacks

    Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only mem- bership inference attacks. InInternational conference on machine learning, pages 1964–1974. PMLR, 2021

    work page 1964

  5. [5]

    Are diffusion models vulnerable to membership inference attacks? InInternational Conference on Machine Learning, pages 8717–8730

    Jinhao Duan, Fei Kong, Shiqi Wang, Xiaoshuang Shi, and Kaidi Xu. Are diffusion models vulnerable to membership inference attacks? InInternational Conference on Machine Learning, pages 8717–8730. PMLR, 2023. 10

    work page 2023

  6. [6]

    Strong membership inference attacks on massive datasets and (moderately) large language models.arXiv preprint arXiv:2505.18773, 2025

    Jamie Hayes, Ilia Shumailov, Christopher A Choquette-Choo, Matthew Jagielski, George Kaissis, KatherineLee,MiladNasr,SahraGhalebikesabi,NiloofarMireshghallah,MeenatchiSundaramMutuSelva Annamalai, et al. Strong membership inference attacks on massive datasets and (moderately) large language models.arXiv preprint arXiv:2505.18773, 2025

    arXiv 2025

  7. [7]

    Kim, Omer Reingold, and Guy N

    Ursula Hebert-Johnson, Michael P. Kim, Omer Reingold, and Guy N. Rothblum. Multicalibration: Calibration for the (computationally-identifiable) masses. InProceedings of the 35th International Conference on Machine Learning (ICML), volume 80, pages 1939–1948. PMLR, 2018

    work page 1939

  8. [8]

    On the societal impact of open foundation models

    Sayash Kapoor, Rishi Bommasani, Kevin Klyman, Shayne Longpre, Ashwin Ramaswami, Peter Cihon, Aspen Hopkins, Kevin Bankston, Stella Biderman, Miranda Bogen, et al. On the societal impact of open foundation models. InInternational Conference on Machine Learning, Position Paper Track, 2024

    work page 2024

Show all 28 references
  1. [9]

    Kim, Christoph Kern, Shafi Goldwasser, Frauke Kreuter, and Omer Reingold

    Michael P. Kim, Christoph Kern, Shafi Goldwasser, Frauke Kreuter, and Omer Reingold. Universal adaptability: Target-independent inference that competes with propensity scoring.Proceedings of the National Academy of Sciences, 119(4):e2108097119, 2022. doi: 10.1073/pnas.21080971...

    2022 doi

  2. [10]

    Stolen memories: Leveraging model memorization for calibrated {White-Box} membership inference

    Klas Leino and Matt Fredrikson. Stolen memories: Leveraging model memorization for calibrated {White-Box} membership inference. In29th USENIX security symposium (USENIX Security 20), pages 1605–1622, 2020

    2020

  3. [11]

    Membership leakage in label-only exposures

    Zheng Li and Yang Zhang. Membership leakage in label-only exposures. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 880–895, 2021

    2021

  4. [12]

    Membership inference attacks by exploiting loss trajectory

    Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. Membership inference attacks by exploiting loss trajectory. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 2085–2098, 2022

    2022

  5. [13]

    Decoupledweightdecayregularization.arXivpreprintarXiv:1711.05101, 2017

    IlyaLoshchilovandFrankHutter. Decoupledweightdecayregularization.arXivpreprintarXiv:1711.05101, 2017

    2017 arXiv

  6. [14]

    Language models are unsupervised multitask learners

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models are unsupervised multitask learners. Technical report, OpenAI, February 2019. OpenAI Blog

    2019

  7. [15]

    Uncertain: Modern topics in uncertainty quantification.https://www.cis.upenn.edu/ ~aaroth/uncertain.html, 2022

    Aaron Roth. Uncertain: Modern topics in uncertainty quantification.https://www.cis.upenn.edu/ ~aaroth/uncertain.html, 2022. Textbook, University of Pennsylvania

    2022

  8. [16]

    In2017 IEEE symposium on security and privacy (SP), pages 3–18

    RezaShokri,MarcoStronati,CongzhengSong,andVitalyShmatikov.Membershipinferenceattacksagainst machine learning models. In2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017

    2017

  9. [17]

    Privacy risks of securing machine learning models against adversarial examples

    Liwei Song, Reza Shokri, and Prateek Mittal. Privacy risks of securing machine learning models against adversarial examples. InProceedings of the 2019 ACM SIGSAC conference on computer and communications security, pages 241–257, 2019

    2019

  10. [18]

    Quantifying privacy risks of public statistics to residents of subsidized housing.arXiv preprint arXiv:2407.04776, 2024

    Ryan Steed, Diana Qing, and Zhiwei Steven Wu. Quantifying privacy risks of public statistics to residents of subsidized housing.arXiv preprint arXiv:2407.04776, 2024

    2024 arXiv

  11. [19]

    Membership inference attacks on diffusion models via quantile regression.arXiv preprint arXiv:2312.05140, 2023

    Shuai Tang, Zhiwei Steven Wu, Sergul Aydore, Michael Kearns, and Aaron Roth. Membership inference attacks on diffusion models via quantile regression.arXiv preprint arXiv:2312.05140, 2023

    2023 arXiv

  12. [20]

    Identifying and eliminating csam in generative ml training data and models.Stanford Internet Observatory, Cyber Policy Center, 23:3, 2023

    David Thiel. Identifying and eliminating csam in generative ml training data and models.Stanford Internet Observatory, Cyber Policy Center, 23:3, 2023

    2023

  13. [21]

    Generative ml and csam: Implications and mitigations

    David Thiel, Melissa Stroebel, and Rebecca Portnoff. Generative ml and csam: Implications and mitigations. InStanford digital repository. 2023. 11

    2023

  14. [22]

    Safety by design for generative ai: Preventing child sexual abuse

    Thorn and All Tech is Human. Safety by design for generative ai: Preventing child sexual abuse. https://info.thorn.org/hubfs/thorn-safety-by-design-for-generative-AI.pdf, 2024

    2024

  15. [23]

    Position: Considerations for differentially private learning with large-scale public pretraining.arXiv preprint arXiv:2212.06470, 2022

    Florian Tramèr, Gautam Kamath, and Nicholas Carlini. Position: Considerations for differentially private learning with large-scale public pretraining.arXiv preprint arXiv:2212.06470, 2022

    2022 arXiv

  16. [24]

    On the importance of difficulty calibration in membership inference attacks.arXiv preprint arXiv:2111.08440, 2021

    Lauren Watson, Chuan Guo, Graham Cormode, and Alex Sablayrolles. On the importance of difficulty calibration in membership inference attacks.arXiv preprint arXiv:2111.08440, 2021

    2021 arXiv

  17. [25]

    Privacy risk in machine learning: Analyzing the connection to overfitting

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In2018 IEEE 31st computer security foundations symposium (CSF), pages 268–282. IEEE, 2018

    2018

  18. [26]

    Assessing membership inference attacks under distribution shifts

    Shi Yichuan, Olivera Kotevska, Viktor Reshniak, and Amir Sadovnik. Assessing membership inference attacks under distribution shifts. In2024 IEEE International Conference on Big Data (BigData), pages 4127–4131. IEEE, 2024

    2024

  19. [27]

    Low-cost high-power membership inference attacks

    Sajjad Zarifzadeh, Philippe Liu, and Reza Shokri. Low-cost high-power membership inference attacks. arXiv preprint arXiv:2312.03262, 2023

    2023 arXiv

  20. [28]

    Membership inference attacks cannot prove that a model was trained on your data.arXiv preprint arXiv:2409.19798, 2024

    Jie Zhang, Debeshee Das, Gautam Kamath, and Florian Tramèr. Membership inference attacks cannot prove that a model was trained on your data.arXiv preprint arXiv:2409.19798, 2024. 12 A Experiments and Implementation Details Shadow models were trained on 2 NVIDIA A100 GPUs using...

    2024 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.