Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble

Chengyu Zhang; Lei Yu; Nathalie Baracaldo; Swanand Kadhe; Yuetian Chen; Zhiqi Wang

REVIEW 4 major objections 6 minor 60 references

Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Different membership-inference attacks expose mostly disjoint sets of training members, so single-instance privacy evaluations understate risk.

desk verdict Useful evaluation protocol, but the 'disjoint subsets' claim needs a null model before it can carry the paper's conclusion. read the letter →

arxiv 2506.13972 v2 pith:BSE77VLP submitted 2025-06-16 cs.LG

Zhiqi Wang , Chengyu Zhang , Yuetian Chen , Nathalie Baracaldo , Swanand Kadhe , Lei Yu This is my paper

classification cs.LG

keywords membershipinferenceattacksprivacyauditingmachineunlearningcoverageandstabilityensembleshadowmodelsdisparityanalysisTPRatlowFPR

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the standard way of judging membership inference attacks—by AUC, accuracy, and true-positive rate at low false positive rate, measured for one attack instance—misses a structural fact: different attacks, and different random runs of the same attack, flag largely disjoint sets of training members. The authors introduce coverage (the union of members detected across instances) and stability (the intersection) to quantify this, and show pairwise Jaccard similarities are low, especially stability at low false positive rates. They then build ensembles that combine several attacks through multi-instance intersection, union, or majority voting, followed by a union across attacks, and these outperform every single instance on standard metrics. If the paper is right, privacy audits, machine-unlearning checks, and defense evaluations that rely on one attack instance systematically understate exposure.

What carries the argument

Coverage and stability are the two load-bearing quantities. Given several instances of an attack built from the same auxiliary data with different random seeds, coverage is the union of their true-positive member sets (all members any run exposes) and stability is the intersection (members every run exposes); averaging pairwise Jaccard similarities between instance-level member sets gives a consistency score. The ensemble framework then operates on these: a multi-instance step applies logical AND for the stability ensemble, logical OR for the coverage ensemble, or majority voting, followed by a logical OR across attack methods to pool the complementary vulnerabilities each attack finds.

What would settle it

Repeat the six-instance coverage and stability protocol many times on the same dataset and model and measure the variance of the pairwise Jaccard similarities. If a pair of attacks sometimes looks nearly disjoint and sometimes largely overlapping, or if adding instances beyond six changes coverage substantially, the claim of stable method-level disparity is not supported. A sharper test is to find a dataset and model where one attack's stability set contains most members in the union of all attacks' coverage, which would contradict the minimal-overlap picture.

Watch

Extended reading notes

Core claim

The central claim is that different attacks implicitly target different subsets of members, and the same is true of multiple instances of one attack built with different random seeds. Across CIFAR-10, CIFAR-100, CINIC-10, Purchase100, and Texas100, pairwise Jaccard similarity between attacks' detected member sets is generally below 0.4 for coverage and below 0.1 for stability at an instance FPR of 0.1, meaning an attack that looks weaker by aggregate metrics can still expose members another attack misses. The paper treats this not as a curiosity but as a reliability problem: evaluations that report a single instance reflect only the subset that instance happens to catch. As constructive evidence, combining four attacks with six instances each improves ROC AUC by 36%, balanced accuracy by 24%, and TPR at 0.1% FPR by a factor of five on CIFAR-10 compared with the best single instance.

Load-bearing premise

The paper's method-level conclusions rest on the assumption that six random instances of an attack are enough to represent the method, so that coverage, stability, and pairwise similarities have converged; without a statistical bound, more instances or repeated runs could shift these sets.

Editorial extensions

If this is right

A privacy evaluation that reports a single attack instance is incomplete: members that one instance misses can be found by another instance of the same attack, so the reported exposure is a lower bound rather than the full risk.
An attack with modest AUC still contributes to privacy assessment if it detects a high-disparity set of members that stronger attacks miss; combining such attacks is what produces the largest ensemble gains.
Ensemble evaluation can be made practical: attacks that share shadow models, such as LiRA and the Reference Attack, can be combined at nearly the cost of one, and the calibration attack is a cheap add-on requiring only one shadow model.
Coverage and stability should be reported alongside AUC and TPR at low FPR as complementary descriptors of what an attack reveals and how consistently it reveals it.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The disjointness result suggests a per-sample vulnerability profile: instead of ranking attacks by a single scalar, one could label each training member by which attack signals expose it, and use those profiles to direct auditing effort toward samples invisible to the strongest attack.
The same protocol could transfer to LLM membership evaluations, where distribution shift between member and non-member data already inflates metrics; coverage and stability would at least separate attack-specific from instance-specific detection effects.
A direct stress test of the method-level claim would compute coverage and stability with 16 or more instances across many repeated experiment runs; if pairwise Jaccard similarities remain stable, the six-instance protocol can serve as a standard evaluation block, and if not, the ensemble conclusions need instance-count-dependent qualification.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The paper does something genuinely useful: it shows that a single random instance of an MIA is a shaky basis for privacy evaluation, and it packages that observation into coverage/stability metrics plus three ensemble strategies. The instance-level variance finding is real and well demonstrated across five datasets and four architectures, and the convergence curves in Section 4.3 make a fair case that six instances capture most of the behavior. The code is public, the writing is clear, and the cost analysis in Section 5.3 is a nice practical touch.

The problem is the paper's headline interpretation. Low Jaccard overlap between attack member sets is presented as evidence that different attacks "target different subsets" of members, and that single-attack evaluations are therefore misleading. But no null baseline is ever computed. At FPR=0.1 the coverage TPRs are roughly 0.3-0.7, so two independently chosen sets of that size have expected Jaccard around 0.2-0.35. That is exactly the range of the observed coverage similarities in Figure 10a. The "minimal overlap" is therefore close to what chance alone would produce. The same holds for stability at low FPR, where tiny set sizes make near-zero Jaccard inevitable. The ensemble results also don't rescue the interpretation: a union of independent detectors with the same marginal TPR will always give higher coverage, regardless of whether any stable member-level property is being exploited.

So the central claim—that different attacks expose genuinely different, stable subsets of vulnerable members—is not supported by the current evidence. What remains is a solid demonstration that MIA outputs are noisy and that aggregating attacks/instances improves coverage. That is still worth publishing, but the paper overreaches. The authors should add a permutation or independence baseline, or at least compare observed overlap to the expected Jaccard under random selection. If the overlap is not significantly different from chance, they should soften the "disparity" language and frame the contribution as instability-aware evaluation.

Minor issues: no error bars or repeated-run variances anywhere, the four ensemble attacks are chosen post-hoc, and the abstract's 36%/24%/5x improvements don't exactly match Table 1. All fixable in revision.

I'd send this to serious reviewers—the evaluation-protocol question matters and the empirical groundwork is real—but I'd expect the authors to add the null analysis or explicitly back off the "different targets" interpretation. As is, the paper deserves a conditional accept with major revision, not a straight accept.

Referee Report

4 major / 6 minor

Summary. The paper argues that membership inference attacks (MIAs) exhibit large disparities both between different attack methods and between random instances of the same method, and that current privacy evaluations based on a single instance or a single method are therefore unreliable. To quantify these disparities, it introduces consistency, coverage, and stability metrics defined over multiple attack instances, and it reports experiments across seven attacks, five datasets, and four architectures. It then proposes three ensemble strategies—stability, coverage, and majority-voting—that combine instances and attack methods, and reports substantial gains in AUC, balanced accuracy, and TPR@low FPR on image datasets. The authors conclude that privacy auditing, unlearning verification, and defense evaluation should move to multi-instance, multi-method ensembles.

Significance. If the disparity claim holds, the paper makes a useful and timely contribution: it challenges the field's reliance on aggregate metrics and single attack runs, and it offers a concrete evaluation protocol plus open-source code. The breadth of the experiments (seven attacks, five datasets, four architectures) is a genuine strength, and the ensemble improvements on CIFAR-10, CIFAR-100, and CINIC-10 are substantial. However, the significance is currently tempered by two unresolved issues: the low-overlap interpretation lacks a null baseline, and the claim of consistent ensemble superiority is contradicted by the tabular-data appendix. With these issues addressed, the coverage/stability framework could become a practical tool for privacy auditing and unlearning verification.

major comments (4)

[§4.4, Fig. 10 and §1, Fig. 1] The central inference that low Jaccard similarity implies that different attacks 'implicitly target different subsets of members' is not supported without a null model. Coverage sets are subsets of members whose sizes are set by each attack's TPR, so independent random subsets of the same sizes have expected Jaccard J = p_i p_j / (p_i + p_j - p_i p_j). At the coverage TPRs shown in Fig. 7 (roughly 0.11 to 0.69 at 16 instances, and lower at the six instances used in Fig. 10), this null expectation ranges from about 0.05 to 0.36. Many observed values in Fig. 10a are close to that null (e.g., Class-NN vs LiRA is 0.34 vs a null of about 0.36), while some are far below it (LOSS vs calibration is 0.03 vs a null of about 0.10). The stability panels are even more affected: at FPR 0.001 and 0.01 the stability sets contain only a handful of members (Appendix Fig. 19), so the expected Jaccard is near zero and the near-zero values in Fig. 20e-f carry little information. The paper should add an explicit random-selection or permutation null baseline and report observed-minus-expected Jaccard for each attack pair. This is load-bearing for Q1-Q3 and for the 'disjoint subsets' framing throughout the paper.
[§4.1, §4.3, Fig. 10] The main results are computed from n=6 instances, justified only by the statement that the metrics 'generally start to converge' plus visual inspection of Figs. 7-9. No variance across repeated draws of seed sets is reported. The caption of Fig. 10 says the values are averages over four experimental runs, but no standard deviations or confidence intervals appear anywhere. Consequently, claims such as 'consistency score below 0.4' and 'Jaccard generally below 0.4' cannot be assessed for statistical stability. Please add error bars or bootstrap confidence intervals, and show that the method-level conclusions and ensemble rankings are robust to the choice of n (e.g., n=6 vs n=10 vs n=16).
[§5.2 and Appendix Table 5] The text in §5.2 and Appendix C.3 states that all three full ensemble strategies consistently outperform individual instances. This is contradicted by Appendix Table 5 on the tabular datasets. For Texas100, the Majority-vote multi-attack ensemble achieves AUC/ACC/TPR@0.1% of 0.740/0.718/0.003, while the best single-instance attack (reference) achieves 0.841/0.785/0.066. For Purchase100, the corresponding numbers are 0.694/0.647/0.008 versus 0.729/0.690/0.014. Either the table is mislabeled (the second 'Multi-inst. Coverage' row suggests a copy-paste error) or the general claim must be qualified. As written, the manuscript is internally inconsistent on a point that is central to the practical recommendation that ensembles should replace single-instance evaluations.
[§5.2 and §6] The ensemble gains are presented as 'constructive proof' of Q1-Q3, but they do not discriminate between attacks targeting different subpopulations and attacks that are merely independent noisy detectors with the same marginal TPR. A union of six independent random detectors with per-instance TPR p attains coverage TPR 1-(1-p)^6, which can also improve TPR@low FPR relative to a single detector. To support the disparity interpretation, the ensemble results should be compared against a null ensemble of independent random detectors matched in per-instance TPR, or against an ensemble that resamples instances without replacement. Without such a comparison, the improved ensemble numbers are consistent with the null hypothesis that all attacks are equally capable on every member and differ only by random noise.

minor comments (6)

[Fig. 4] The y-axis label contains a typo: 'Attak' should be 'Attack'.
[Algorithm 2, line 4] The ground truth construction is typeset with garbled symbols ('gt =®1len(...)⊕®0len(...)'); this should be a vector of ones concatenated with a vector of zeros.
[Appendix Table 5] The table contains two consecutive 'Multi-inst. Coverage' rows; the second row appears intended to be 'Multi-inst. Majority' based on the structure of Table 1.
[Figs. 7, 8, 9] The final values printed at the ends of the curves are difficult to read and overlap; consider using a legend or a separate table of terminal values.
[§3.3, Eq. (9)] The notation 'x ∉ Ø_{B≠A} Stability(B)' is nonstandard and should use a union symbol; as written it is confusing.
[Appendix Fig. 24 caption] The sentence 'All Ensemble are performed with 6 instances' has a grammar error and should be 'All ensembles are performed with 6 instances.'

Circularity Check

0 steps flagged · score 1.0 of 10

No circularity: coverage/stability and the ensemble formulas are defined directly from membership predictions, and the only overlapping-author citation is contextual and non-load-bearing.

full rationale

The paper's chain is empirical rather than derivational. Coverage (Eq. 7) and stability (Eq. 8) are defined directly as the union and intersection of per-instance thresholded membership predictions, and consistency (Eq. 6) is the average pairwise Jaccard index of those same sets. No quantity in these definitions is fitted to the paper's conclusions, and the ensemble equations (11)-(16) are fixed boolean combinations with no learned parameters, so the reported AUC, accuracy, and TPR gains are independent measurements rather than consequences of the definitions. The only overlapping-author citation, [53] (Lei Yu et al.), is used in the introduction merely as one of several privacy-threat survey references and is not load-bearing for the disparity analysis. The choice of six instances and FPR=0.1 is a meta-parameter selected from convergence curves, not a fitted parameter renamed as a prediction. The skeptic's concern that low Jaccard overlap is not compared against a random-selection null baseline is a substantive validity question about the interpretation of the overlap values, but it is not circularity: the minimal-overlap numbers are computed from the data, and whether they imply that different attacks target different subsets is an inferential claim, not a tautology. No equation in the paper reduces to its own input by construction, and no result is imported from a self-citation chain. Hence no circular step is identified; the score of 1 reflects only the contextual self-citation, which is not load-bearing.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The framework depends on a small number of methodological choices (six instances, FPR=0.1, the four selected attacks) and on standard assumptions about the MIA threat model. No new entities or parameters are fitted to data.

free parameters (3)

Number of instances (n=6) = 6
Used for coverage, stability, consistency, and ensemble. Justified by observed convergence in Section 4.3, but chosen by the authors; results (e.g., Jaccard similarities, stability sizes) depend on this number.
FPR level (beta=0.1) = 0.1
Main evaluation threshold. Chosen as a standard low-FPR operating point; disparities are larger at lower FPR, so the headline conclusions are sensitive to this choice.
Ensemble attack selection = LiRA, Reference, Loss Trajectory, Difficulty Calibration
Only these four attacks are used in the full ensemble because they show improved stable precision in Figure 9b; this post-hoc selection may favor the reported ensemble gains.

assumptions (5)

domain assumption Random seeds abstract all randomness in MIA construction (shuffling, initialization, batching).
Stated in Section 3.1; if real-world randomness is not seed-equivalent, the consistency results may not transfer.
domain assumption The auxiliary dataset is from a similar distribution as the target training set.
Standard MIA setting; the paper also tests a distribution mismatch in Appendix C.4, but main claims rely on this assumption.
domain assumption Coverage and stability computed from binary predictions at a fixed FPR are meaningful measures of privacy risk.
The evaluation framework relies on thresholding with ground-truth labels (Algorithm 1), which assumes the evaluator knows the membership labels.
domain assumption Convergence of coverage/stability by six instances justifies using n=6 as method-level behavior.
Supported by Figures 7 and 8, but no statistical guarantee is given.
domain assumption The observed disparities generalize across datasets, architectures, and attack implementations.
The paper tests five datasets and four architectures, but generalization to other settings is assumed.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble." pith.science (2026). https://pith.science/paper/BSE77VLP

@misc{pith2026250613972,
  author       = {Pith},
  title        = {Pith review of: Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BSE77VLP}},
  note         = {Machine review of arXiv:2506.13972}
}

read the original abstract

Membership inference attacks (MIAs) pose a significant threat to the privacy of machine learning models and are widely used as tools for privacy assessment, auditing, and machine unlearning. While prior MIA research has primarily focused on performance metrics such as AUC, accuracy, and TPR@low FPR - either by developing new methods to enhance these metrics or using them to evaluate privacy solutions - we found that it overlooks the disparities among different attacks. These disparities, both between distinct attack methods and between multiple instantiations of the same method, have crucial implications for the reliability and completeness of MIAs as privacy evaluation tools. In this paper, we systematically investigate these disparities through a novel framework based on coverage and stability analysis. Extensive experiments reveal significant disparities in MIAs, their potential causes, and their broader implications for privacy evaluation. To address these challenges, we propose an ensemble framework with three distinct strategies to harness the strengths of state-of-the-art MIAs while accounting for their disparities. This framework not only enables the construction of more powerful attacks but also provides a more robust and comprehensive methodology for privacy evaluation.

Figures

Figures reproduced from arXiv: 2506.13972 by the authors.

**Figure 2.** Venn Diagram of three MIA instances at FPR = 0.1 for different attack methods. Each set represents the true positive [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** MIA Multi-Instance Analysis Pipeline. The process [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Figures from the paper (20 more)

**Figure 4.** Figure 4: Consistency score shows inherent disparities among pairs of instances of MIAs (except LOSS attack) across datasets [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 6.** Figure 6: Number of shadow models’ relation with Consis [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

**Figure 7.** Figure 7: Trends in TPR and FPR for coverage under different [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

**Figure 8.** Figure 8: Trends in TPR and FPR for stability, following the [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]

**Figure 9.** Figure 9: Precision of coverage and stability corresponding [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]

**Figure 10.** Figure 10: MIA Method Disparity. The values represent the [PITH_FULL_IMAGE:figures/full_fig_p009_10.png]

**Figure 11.** Figure 11: Correlation of Disparity and FPR. The line is a [PITH_FULL_IMAGE:figures/full_fig_p009_11.png]

**Figure 13.** Figure 13: Top-x Class-NN Attack-Covered Samples with Dif [PITH_FULL_IMAGE:figures/full_fig_p010_13.png]

**Figure 12.** Figure 12: PCA of 𝒜-unique Members. We conduct PCA on all the target model 𝐹𝑇 ’s logits of all samples in target dataset 𝒟𝑇 , and plot 𝒜-unique members (defined in Section 3.3) for each attack. It is obtained with six instances at FPR@0.1. Figure 12a and Figure 12b are picked to…

**Figure 16.** Figure 16: ROC Curves of Different Ensemble Strategies. [PITH_FULL_IMAGE:figures/full_fig_p012_16.png]

**Figure 15.** Figure 15: ROC Curve for Ensemble. Dashed lines show single-instance ROC, solid lines show multi-instance ROC and the [PITH_FULL_IMAGE:figures/full_fig_p013_15.png]

**Figure 17.** Figure 17: Performance vs. Cost Analysis for CIFAR-10 using different ensembles. [PITH_FULL_IMAGE:figures/full_fig_p013_17.png]

**Figure 18.** Figure 18: Trend of Coverage with Varying Numbers of In [PITH_FULL_IMAGE:figures/full_fig_p016_18.png]

**Figure 19.** Figure 19: Trend of Stability. Each line shows the stability of [PITH_FULL_IMAGE:figures/full_fig_p017_19.png]

**Figure 20.** Figure 20: Disparity of Membership Inference Attacks Across Different FPRs. The values represent the average Jaccard similarity [PITH_FULL_IMAGE:figures/full_fig_p018_20.png]

**Figure 22.** Figure 22: Comparison of ensemble strategies (Stability Ensemble, Majority Vote Ensemble, Coverage Ensemble) across different [PITH_FULL_IMAGE:figures/full_fig_p019_22.png]

**Figure 24.** Figure 24: Comparison of ensemble ROC curves for different attack combinations on the CIFAR-10 dataset. Each row compares [PITH_FULL_IMAGE:figures/full_fig_p020_24.png]

**Figure 26.** Figure 26: Consistency on Outliers VS Regular Samples. [PITH_FULL_IMAGE:figures/full_fig_p020_26.png]

**Figure 27.** Figure 27: Disparity of Membership Inference Attacks on [PITH_FULL_IMAGE:figures/full_fig_p021_27.png]

**Figure 28.** Figure 28: Set size of coverage and stability on canary and [PITH_FULL_IMAGE:figures/full_fig_p022_28.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

60 extracted references · 22 canonical work pages

[1]

Michael Aerni, Jie Zhang, and Florian Tramèr. 2024. Evaluations of Machine Learning Privacy Defenses are Misleading. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (Salt Lake City, UT, USA) (CCS ’24). Association for Computing Machinery, New York, NY, USA, 1271–1284. doi:10.1145/3658644.3690194

work page arXiv 2024
[2]

Choquette-Choo, Hen- grui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot

Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hen- grui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Machine Unlearning. In 2021 IEEE Symposium on Security and Privacy (SP) . 141–

work page 2021
[3]

Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. 2022. Membership Inference Attacks From First Principles. In2022 IEEE Symposium on Security and Privacy (SP) . 1897–1914. doi:10.1109/SP46214. 2022.9833649

arXiv 2022
[4]

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21) . 2633–2650

2021
[5]

Dingfan Chen, Ning Yu, and Mario Fritz. 2022. RelaxLoss: Defending Membership Inference Attacks without Losing Utility. arXiv:2207.05801 [cs.LG] https://arxiv. org/abs/2207.05801

arXiv 2022
[6]

Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. 2020. Gan-leaks: A taxon- omy of membership inference attacks against generative models. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security . 343–362

work page 2020
[7]

Dasol Choi and Dongbin Na. 2023. Towards Machine Unlearning Bench- marks: Forgetting the Personal Identities in Facial Recognition Systems. arXiv:2311.02240 [cs.CV] https://arxiv.org/abs/2311.02240

arXiv 2023
[8]

Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nico- las Papernot. 2021. Label-only membership inference attacks. In International conference on machine learning . PMLR, 1964–1974

work page 2021

Show all 60 references

[9]

Debeshee Das, Jie Zhang, and Florian Tramèr. 2025. Blind Baselines Beat Mem- bership Inference Attacks for Foundation Models. arXiv:2406.16201 [cs.CR] https://arxiv.org/abs/2406.16201

2025 arXiv
[10]

Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. 2024. Do membership inference attacks work on large language models? arXiv preprint arXiv:2402.07841 (2024)

2024 arXiv
[11]

Christophe Dupuy, Radhika Arava, Rahul Gupta, and Anna Rumshisky. 2022. An efficient dp-sgd mechanism for large scale nlu models. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 4118–4122

2022
[12]

Stanislav Fort, Huiyi Hu, and Balaji Lakshminarayanan. 2019. Deep ensembles: A loss landscape perspective. arXiv preprint arXiv:1912.02757 (2019)

2019 arXiv
[13]

Jack Foster, Stefan Schoepf, and Alexandra Brintrup. 2024. Fast machine unlearn- ing without retraining through selective synaptic dampening. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 38. 12043–12051

2024
[14]

Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. 2015. Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communica- tions Security (Denver, Colorado, USA) (CCS ’15). Associ...

2015
[15]

Gunter, and Nikita Borisov

Karan Ganju, Qi Wang, Wei Yang, Carl A. Gunter, and Nikita Borisov. 2018. Property Inference Attacks on Fully Connected Neural Networks using Per- mutation Invariant Representations. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (Toro...

2018
[16]

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2015. Deep Residual Learning for Image Recognition. arXiv:1512.03385 [cs.CV]

2015 arXiv
[17]

Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2015. Distilling the Knowledge in a Neural Network. arXiv:1503.02531

2015 arXiv
[18]

Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. 2022. Membership inference attacks on machine learning: A survey.ACM Computing Surveys (CSUR) 54, 11s (2022), 1–37

2022
[19]

Abhyuday Jagannatha, Bhanu Pratap Singh Rawat, and Hong Yu. 2021. Member- ship inference attack susceptibility of clinical language models. arXiv preprint arXiv:2104.08305 (2021)

2021 arXiv
[20]

Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong. 2019. MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples. arXiv:1909.10594 [cs.CR]

2019 arXiv
[21]

Mishaal Kazmi, Hadrien Lautraite, Alireza Akbari, Mauricio Soroco, Qiaoyue Tang, Tao Wang, Sébastien Gambs, and Mathias Lécuyer. 2024. PANORAMIA: Privacy Auditing of Machine Learning Models without Retraining. arXiv preprint arXiv:2402.09477 (2024)

2024 arXiv
[22]

Sasi Kumar and Reza Shokri. 2020. ML Privacy Meter: Aiding regulatory compli- ance by quantifying the privacy risks of machine learning. In Workshop on Hot Topics in Privacy Enhancing Technologies (HotPETs)

2020
[23]

Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou
[24]

Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafil- lou. 2023. Towards Unbounded Machine Unlearning. In Advances in Neural Information Processing Systems , A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (Eds.), Vol. 36. Curran Associa...

2023
[25]

Jiacheng Li, Ninghui Li, and Bruno Ribeiro. 2021. Membership Inference At- tacks and Defenses in Classification Models. In Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy (CODASPY ’21) . ACM. doi:10.1145/3422337.3447836

2021
[26]

Jiacheng Li, Ninghui Li, and Bruno Ribeiro. 2024. MIST: defending against membership inference attacks through membership-invariant subspace training. In Proceedings of the 33rd USENIX Conference on Security Symposium(Philadelphia, PA, USA) (SEC ’24). USENIX Association, USA, ...

2024
[27]

Qinbin Li, Junyuan Hong, Chulin Xie, Jeffrey Tan, Rachel Xin, Junyi Hou, Xavier Yin, Zhun Wang, Dan Hendrycks, Zhangyang Wang, Bo Li, Bingsheng He, and Dawn Song. 2024. LLM-PBE: Assessing Data Privacy in Large Language Models. Proc. VLDB Endow. 17, 11 (July 2024), 3201–3214. d...

2024
[28]

Gaoyang Liu, Chen Wang, Kai Peng, Haojun Huang, Yutong Li, and Wenqing Cheng. 2019. SocInf: Membership inference attacks on social media health data with machine learning. IEEE Transactions on Computational Social Systems 6, 5 (2019), 907–921

2019
[29]

Han Liu, Yuhao Wu, Zhiyuan Yu, and Ning Zhang. 2024. Please tell me more: Privacy impact of explainability through the lens of membership inference attack. In 2024 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 120–120

2024
[30]

Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. 2022. Membership Inference Attacks by Exploiting Loss Trajectory. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (Los Angeles, CA, USA) (CCS ’22). Association for Computing Mach...

2022
[31]

Ilya Loshchilov and Frank Hutter. 2017. SGDR: Stochastic Gradient Descent with Warm Restarts. arXiv:1608.03983 [cs.LG]

2017 arXiv
[32]

Tomoya Matsumoto, Takayuki Miura, and Naoto Yanai. 2023. Membership inference attacks against diffusion models. In 2023 IEEE Security and Privacy Workshops (SPW). IEEE, 77–83

2023
[33]

Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schölkopf, Mrinmaya Sachan, and Taylor Berg-Kirkpatrick. 2023. Membership inference attacks against language models via neighbourhood comparison. arXiv preprint arXiv:2305.18462 (2023)

2023 arXiv
[34]

Matthieu Meeus, Igor Shilov, Shubham Jain, Manuel Faysse, Marek Rei, and Yves-Alexandre de Montjoye. 2025. SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It). arXiv:2406.17975 [cs.CL] https: //arxiv.org/abs/2406.17975

2025 arXiv
[35]

Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg- Kirkpatrick, and Reza Shokri. 2022. Quantifying privacy risks of masked language Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble CCS ’25, October 13–17, 2025, Taipei, Taiwa...

2022 arXiv
[36]

Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In2019 IEEE symposium on security and privacy (SP). IEEE, 739–753

2019
[37]

Milad Nasr, Shuang Songi, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlin. 2021. Adversary instantiation: Lower bounds for differentially private machine learning. In 2021 IEEE Symposium on security and privacy (SP) . IEEE, 866–882

2021
[38]

Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. 2022. A survey of machine unlearning. arXiv preprint arXiv:2209.02299 (2022)

2022 arXiv
[39]

Nicolas Papernot, Patrick McDaniel, Arunesh Sinha, and Michael P Wellman
[40]

Pedregosa, G

F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cour- napeau, M. Brucher, M. Perrot, and E. Duchesnay. 2011. Scikit-learn: Machine Learning in Python. Journal of Machine ...

2011
[41]

Shahbaz Rezaei, Zubair Shafiq, and Xin Liu. 2023. Accuracy-privacy trade-off in deep ensemble: A membership inference perspective. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 364–381

2023
[42]

Maria Rigaki and Sebastian Garcia. 2023. A survey of privacy attacks in machine learning. Comput. Surveys 56, 4 (2023), 1–34

2023
[43]

Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang- Chieh Chen. 2019. MobileNetV2: Inverted Residuals and Linear Bottlenecks. arXiv:1801.04381 [cs.CV]

2019 arXiv
[44]

Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Mem- bership inference attacks against machine learning models. In 2017 IEEE sympo- sium on security and privacy (SP) . IEEE, 3–18

2017
[45]

Karen Simonyan and Andrew Zisserman. 2015. Very Deep Convolutional Net- works for Large-Scale Image Recognition. InInternational Conference on Learning Representations

2015
[46]

Liwei Song and Prateek Mittal. 2021. Systematic evaluation of privacy risks of machine learning models. In 30th USENIX Security Symposium (USENIX Security 21). 2615–2632

2021
[47]

Nexhi Sula, Abhinav Kumar, Jie Hou, Han Wang, and Reza Tourani. 2024. Sil- ver Linings in the Shadows: Harnessing Membership Inference for Machine Unlearning. arXiv:2407.00866 [cs.LG] https://arxiv.org/abs/2407.00866

2024 arXiv
[48]

Florian Tramer, Andreas Terzis, Thomas Steinke, Shuang Song, Matthew Jagielski, and Nicholas Carlini. 2022. Debugging differential privacy: A case study for privacy auditing. arXiv preprint arXiv:2202.12219 (2022)

2022 arXiv
[49]

Taiyu Wang, Qinglin Yang, Kaiming Zhu, Junbo Wang, Chunhua Su, and Kento Sato. 2023. Lds-fl: Loss differential strategy based federated learning for privacy preserving. IEEE Transactions on Information Forensics and Security (2023)

2023
[50]

Lauren Watson, Chuan Guo, Graham Cormode, and Alexandre Sablayrolles. 2022. On the Importance of Difficulty Calibration in Membership Inference Attacks. In International Conference on Learning Representations . https://openreview.net/ forum?id=3eIrli0TwQ

2022
[51]

Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. 2022. Enhanced Membership Inference Attacks against Machine Learning Models. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (Los Angeles, CA, USA) ...

2022 doi
[52]

Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. 2018. Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting. In 2018 IEEE 31st Computer Security Foundations Symposium (CSF) . 268–282. doi:10.1109/CSF. 2018.00027

2018
[53]

Lei Yu, Meng Han, Yiming Li, Changting Lin, Yao Zhang, Mingyang Zhang, Yan Liu, Haiqin Weng, Yuseok Jeon, Ka-Ho Chow, and Stacy Patterson. 2024. A Survey of Privacy Threats and Defense in Vertical Federated Learning: From Model Life Cycle Perspective. arXiv preprint arXiv: 240...

2024 arXiv
[54]

Sergey Zagoruyko and Nikos Komodakis. 2017. Wide Residual Networks. arXiv:1605.07146 [cs.CV]

2017 arXiv
[55]

Sajjad Zarifzadeh, Philippe Liu, and Reza Shokri. 2024. Low-Cost High-Power Membership Inference Attacks. arXiv:2312.03262 [stat.ML] https://arxiv.org/ abs/2312.03262

2024 arXiv
[56]

Jie Zhang, Debeshee Das, Gautam Kamath, and Florian Tramèr. 2025. Member- ship Inference Attacks Cannot Prove that a Model Was Trained On Your Data. arXiv:2409.19798 [cs.LG] https://arxiv.org/abs/2409.19798

2025 arXiv
[57]

Ac- quire Valued Shoppers

Minxing Zhang, Zhaochun Ren, Zihan Wang, Pengjie Ren, Zhunmin Chen, Pengfei Hu, and Yang Zhang. 2021. Membership inference attacks against recom- mender systems. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 864–879. A Experiment Set...

2021
[159]

doi:10.1109/SP40001.2021.00019

2021
[2018]

In 2018 IEEE European symposium on security and privacy (EuroS&P)

Sok: Security and privacy in machine learning. In 2018 IEEE European symposium on security and privacy (EuroS&P) . IEEE, 399–414

2018
[2023]

arXiv:2302.09880 [cs.LG] https: //arxiv.org/abs/2302.09880

Towards Unbounded Machine Unlearning. arXiv:2302.09880 [cs.LG] https: //arxiv.org/abs/2302.09880

arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Michael Aerni, Jie Zhang, and Florian Tramèr. 2024. Evaluations of Machine Learning Privacy Defenses are Misleading. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (Salt Lake City, UT, USA) (CCS ’24). Association for Computing Machinery, New York, NY, USA, 1271–1284. doi:10.1145/3658644.3690194

work page arXiv 2024

[2] [2]

Choquette-Choo, Hen- grui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot

Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hen- grui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Machine Unlearning. In 2021 IEEE Symposium on Security and Privacy (SP) . 141–

work page 2021

[3] [3]

Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. 2022. Membership Inference Attacks From First Principles. In2022 IEEE Symposium on Security and Privacy (SP) . 1897–1914. doi:10.1109/SP46214. 2022.9833649

arXiv 2022

[4] [4]

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21) . 2633–2650

2021

[5] [5]

Dingfan Chen, Ning Yu, and Mario Fritz. 2022. RelaxLoss: Defending Membership Inference Attacks without Losing Utility. arXiv:2207.05801 [cs.LG] https://arxiv. org/abs/2207.05801

arXiv 2022

[6] [6]

Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. 2020. Gan-leaks: A taxon- omy of membership inference attacks against generative models. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security . 343–362

work page 2020

[7] [7]

Dasol Choi and Dongbin Na. 2023. Towards Machine Unlearning Bench- marks: Forgetting the Personal Identities in Facial Recognition Systems. arXiv:2311.02240 [cs.CV] https://arxiv.org/abs/2311.02240

arXiv 2023

[8] [8]

Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nico- las Papernot. 2021. Label-only membership inference attacks. In International conference on machine learning . PMLR, 1964–1974

work page 2021