Pith. sign in

REVIEW 4 major objections 5 minor 72 references

Cascading and Proxy Membership Inference Attacks

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that membership inference attacks become markedly stronger when the attacker exploits dependencies between query items and uses look-alike proxy samples to approximate in-training behavior, with the largest gains at very…

desk verdict Two new MIA mechanisms with solid experiments, but the headline adaptive gain is confounded by compute and missing confidence intervals. read the letter →

arxiv 2507.21412 v3 pith:OD5USZVU submitted 2025-07-29 cs.CR cs.LG

Yuntao Du , Jiacheng Li , Yuetian Chen , Kaiyuan Zhang , Zhizhen Yuan , Hanshen Xiao , Bruno Ribeiro , Ninghui Li This is my paper
classification cs.CRcs.LG
keywords membershipinferenceattacksshadowmodelsadaptivenon-adaptiveconditionaltrainingproxydataposterioroddstestprivacyauditing
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that existing membership inference attacks leave substantial signal unused, and that two new attacks can capture it. In the adaptive setting, it argues that a model's outputs on a whole query set create statistical dependencies between which instances were training members, so membership should be decided jointly rather than one instance at a time; its Cascading MIA (CMIA) feeds high-confidence memberships back into shadow training to amplify attack power. In the non-adaptive setting, where shadow models must be trained before queries arrive, it argues that an attacker can approximate the in-training confidence distribution of a query by watching proxy instances that behave similarly, and its Proxy MIA (PMIA) turns this into a likelihood-ratio test. If these claims hold, privacy auditors get stronger worst-case estimates of leakage, since the largest gains appear at the very low false-positive rates used to certify models.

What carries the argument

CMIA uses conditional shadow training: each iteration trains shadow models on datasets that include confirmed anchor members and exclude confirmed non-members, then runs a base shadow-based attack to score all queries and select new anchors, approximating a single greedy step of Gibbs sampling over the joint membership vector. PMIA uses proxy likelihood approximation: before seeing queries it trains shadow models, then for each query it selects proxies (all data, same-class data, or top-10 similar instances by cosine similarity in a pretrained image-embedding space, or by Wasserstein distance on raw features), collects those proxies' logit-scaled confidence scores from the shadow models' in-training sets, fits Gaussian distributions to the in and out score sets, and computes a likelihood ratio $\tilde{\Lambda}$ as the membership score.

What would settle it

Run PMIA against a target model while shadow models are trained on a different data distribution, and then isolate query instances whose nearest neighbors in the attacker's dataset are far away; if the membership-score distributions for true members and non-members overlap completely at 0.001% FPR, the proxy-similarity premise is falsified.

Watch

Extended reading notes

Core claim

The paper claims that membership inference is substantially stronger than previously measured once two overlooked signals are used: conditional dependencies among query memberships, and behavioral similarity between query and proxy data. In the adaptive setting, conditioning on the model's full output creates a collider that makes membership indicators dependent, and CMIA exploits this by cascading: it locks in high-confidence anchor members and retrains shadow models conditioned on those anchors, which improves inference on the rest of the query set. In the non-adaptive setting, PMIA approximates the likelihood ratio of the Bayesian posterior odds test by substituting proxy samples' in-training confidence distributions for the query's own, which recovers much of the gap between one-sided offline LiRA and the full posterior test.

Load-bearing premise

The load-bearing premise is that the confidence-score distribution of proxy samples, when those proxies are training members, is a faithful stand-in for the query sample's own confidence-score distribution when the query is a training member.

Editorial extensions

If this is right

  • CMIA lifts every base attack it is applied to, with the largest gains in the low-FPR regime: on MNIST it raises LiRA's TPR at 0.001% FPR from 0.12% to 0.77%, a more than 5x improvement.
  • PMIA outperforms all non-adaptive baselines on the four image datasets; on CIFAR-100 it reaches 5.90% TPR at 0.001% FPR, more than twice the best baseline's 2.73%.
  • PMIA answers queries cheaply at inference time (about 15.8 seconds on MNIST), compared with RMIA's more than 400,000 seconds, making it practical for large query sets.
  • Both attacks weaken substantially under DP-SGD, confirming differential privacy as a mitigation.
  • The benefit of joint inference is monotone in query-set size: splitting 60,000 MNIST queries into 60,000 individual queries drops TPR at 0.001% FPR from 0.77% to 0.12%.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • I infer that the collider-dependency argument generalizes beyond shadow training: any attack that pools evidence across queries could gain from joint inference, though the paper only demonstrates the effect through conditional shadow training.
  • I infer that PMIA's accuracy will be uneven across a query population, since instances with no close proxies should show much lower attack success; privacy auditors using PMIA should therefore report subgroup or worst-case TPR rather than averages.
  • A testable extension is to replace the fixed proxy-selection metric with a learned similarity trained on shadow-model behaviors, which should improve PMIA under distribution shift because the paper's shift experiment identifies proxy quality as the bottleneck.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper formalizes membership inference as a query-set game, splitting attacks into adaptive (shadow models after queries) and non-adaptive. It proposes CMIA, an adaptive framework that iteratively trains shadow models conditioned on inferred 'anchor' members to exploit joint membership dependence, and PMIA, a non-adaptive attack that approximates the in-membership likelihood of a query using proxy instances from the adversary's dataset. Both are evaluated against six baselines on four image and two tabular datasets with four architectures, with claims of substantial TPR gains at low FPR, plus a Gibbs-convergence theorem and a posterior-odds derivation in the appendix.

Significance. The paper is likely useful for privacy auditing: it offers a clean distinction between adaptive and non-adaptive MIAs, an attack-agnostic wrapper (CMIA) that improves several baselines, and a low-cost non-adaptive attack (PMIA) that consistently improves TPR at low FPR. Table IX provides direct evidence that membership-dependence exploitation matters, and Figure 8 shows PMIA degrades gracefully with fewer shadow models. The release of code, the breadth of the benchmark (six datasets, five architectures), and the DP-SGD evaluation are strengths. However, the central 'substantially outperform' claim currently rests on comparisons that are not budget-matched in the main tables and on five-seed point averages without uncertainty, so the strength of the empirical claim is not yet fully pinned down.

major comments (4)
  1. [V-B, Tables I and III] The headline claim that 'CMIA improves LiRA by more than 5x' is made at an unequal compute budget. On MNIST, Table I reports a TPR increase from 0.12% to 0.77% at 0.001% FPR, but Table III reports 13.30 hours for CMIA versus 2.25 hours for LiRA, a 5.9x increase in wall-clock time. Since the main tables report the full CMIA with K=10 iterations, the gain may largely reflect the additional shadow models rather than the cascading mechanism. Figure 4's CMIA_opt and CMIA_loss partially address this, but only for LiRA on MNIST and CIFAR-10. Please make the same-budget comparison a primary result for all datasets and base attacks, or clearly separate the 'higher compute' claim from the 'same compute' claim in the main text.
  2. [V-A, Tables I and II] The evaluation reports point averages over five seeds with no variance, and the low-FPR metric is not robust to this omission. At 0.001% FPR on the adaptive MNIST setup, the non-member set is about 30,000 instances (D1 has 60,000 and the target is trained on 50%), so the threshold admits only about 0.3 false positives per seed; TPR estimates are therefore highly seed-sensitive and granular. To support the 'more than 5x' claim, the paper should report per-seed results or confidence intervals, and ideally the distribution of TPR across seeds for both baseline and CMIA/PMIA.
  3. [IV-B, Theorem 1 and Algorithm 2] Theorem 1 is an exact statement about the query instance, but PMIA replaces the in-membership likelihood N(mu_in, sigma_in^2) with the proxy-instance distribution N(mu_tilde_in, sigma_tilde_in^2) estimated from Algorithm 2, lines 15-22. No formal condition or error bound characterizes when proxy behavior approximates the query's in-membership behavior. This is a load-bearing approximation: Figure 7 shows a visible degradation under distribution shift, and the choice of top-10 CLIP/Wasserstein proxies is a heuristic. Please either provide an analysis of the approximation error or explicitly state that PMIA's proxy substitution is an empirically motivated heuristic rather than an instantiation of Theorem 1.
  4. [III-B, Algorithm 1 and Theorem 2] The theoretical support for CMIA is currently limited to a standard convergence theorem for the exact Gibbs sampler (Appendix A), while the algorithm itself is a greedy, single-pass heuristic that conditions shadow models on pseudo-labeled anchors. No result shows that this procedure approximates the joint posterior or that the cascade improves MAP estimation; Section III-B explicitly calls CMIA 'a heuristic.' The abstract's claim of 'theoretical analyses for both attacks' should be tempered, or an approximation guarantee for the greedy cascade should be supplied.
minor comments (5)
  1. [Table II] Several cells lack percent signs (e.g., '6.64', '11.5%', '80.4%'), and '6.64' should be '6.64%' for consistency with the rest of the table.
  2. [Algorithm 1, line 24] The stopping condition refers to M_t_in and M_t_out, which are not defined; it should refer to M^k_in and M^k_out.
  3. [V-E, first paragraph] The text says 'select the top 10 proxy models for each query instance'; this should read 'proxy instances'.
  4. [Table VI] The Canary inference cost is listed as '>400,000' with no unit or explanation; please clarify or correct this entry.
  5. [Related Work] The phrase 'Closedly connected' is a typo and should be 'Closely connected'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reported gains are measured against external target models and independent baselines, and the anchor/proxy heuristics are approximations rather than definitional restatements of the inputs.

full rationale

I walked the claimed derivation chain for both CMIA and PMIA and found no step in which an output is definitionally equal to an input or in which a fitted parameter is renamed as a prediction. PMIA's Theorem 1 is a direct Bayes-rule expansion, and the attack's key step is an explicit approximation: 'we aim to find proxy data D_proxy from the adversary's dataset D_non-adapt_adv and use their behaviors (i.e., N(\tilde{\mu}_in, \tilde{\sigma}_in)) to approximate the behavior of a query instance N(i.e., (\mu_in, \sigma^2_in))' (Section IV-B). This is a stated transfer assumption, not a circular definition, and the paper tests it under distribution shift in Figure 7. CMIA's anchor selection is calibrated on a ground-truth shadow model: 'Since the adversary knows the ground truth about the members (i.e., the training set) of the selected shadow model, we set the decision thresholds by ordering the membership scores' (Section III-C). The final membership scores are then computed by re-running the base attack over all accumulated shadow models without applying those thresholds (Algorithm 1, lines 29-33), so the reported TPR at low FPR comes from the final score distribution on the target model rather than from the anchor labels. The self-referential anchor loop is a self-training heuristic, not a reduction by construction. The paper cites prior work by its own authors ([11], [46]) only in related-work contexts and does not use a self-citation as the load-bearing justification for either attack, nor does it import a uniqueness theorem. The main risks are empirical: Table III shows CMIA-LiRA costs 13.30h versus 2.25h for LiRA on MNIST, and the proxy-transfer assumption can miscalibrate under distribution shift, but these are correctness/validity concerns rather than circularity. I therefore find no significant circularity.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claims rest on standard shadow-model threat models and several hand-set hyperparameters. No new physical or conceptual entities are introduced; the contributions are algorithmic.

free parameters (5)
  • Cascading iterations K = 10
    Chosen by hand for all experiments (Section III-C); Table IV shows K affects TPR, with larger K generally better.
  • Stopping criterion delta = 30
    Fixed threshold on new anchors per iteration (Section III-C); Table IV shows sensitivity.
  • tau_out tolerance rank r = 10
    Selects 10th lowest score among members as the non-member threshold (Section III-C); Table V shows optimal near r=10.
  • Top-k proxy instances = 10
    Instance-level proxy selection uses top-10 similar samples via CLIP or Wasserstein distance (Section IV-B); Figure 5 shows robustness to k.
  • Augmentations per sample n = 9
    Number of data augmentations for Gaussian fitting, inherited from LiRA (Section IV-B).
assumptions (4)
  • standard math Gibbs sampler convergence under irreducibility and aperiodicity
    Theorem 2 in Appendix A invokes mild conditions, nonzero membership probabilities, to ensure ergodicity; not verified for the actual CMIA heuristic.
  • domain assumption Gaussian approximation of logit confidence scores
    PMIA assumes phi(f(x)_y) follows a normal distribution, following LiRA [9]; if the normality assumption fails, the likelihood ratio is miscalibrated.
  • domain assumption Adversary has access to the target data distribution
    Definition 1 grants the adversary access to data distribution D; standard in MIA literature but strong in real-world settings.
  • standard math Collider dependence: outputs induce conditional dependence among memberships
    Section III-A and Figure 1 argue M_i and M_j are marginally independent but dependent given o_theta; a property of the graphical model.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Cascading and Proxy Membership Inference Attacks." pith.science (2026). https://pith.science/paper/OD5USZVU

@misc{pith2026250721412,
  author       = {Pith},
  title        = {Pith review of: Cascading and Proxy Membership Inference Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OD5USZVU}},
  note         = {Machine review of arXiv:2507.21412}
}
read the original abstract

A Membership Inference Attack (MIA) assesses how much a trained machine learning model reveals about its training data by determining whether specific query instances were included in the dataset. We classify existing MIAs into adaptive or non-adaptive, depending on whether the adversary is allowed to train shadow models on membership queries. In the adaptive setting, where the adversary can train shadow models after accessing query instances, we highlight the importance of exploiting membership dependencies between instances and propose an attack-agnostic framework called Cascading Membership Inference Attack (CMIA), which incorporates membership dependencies via conditional shadow training to boost membership inference performance. In the non-adaptive setting, where the adversary is restricted to training shadow models before obtaining membership queries, we introduce Proxy Membership Inference Attack (PMIA). PMIA employs a proxy selection strategy that identifies samples with similar behaviors to the query instance and uses their behaviors in shadow models to perform a membership posterior odds test for membership inference. We provide theoretical analyses for both attacks, and extensive experimental results demonstrate that CMIA and PMIA substantially outperform existing MIAs in both settings, particularly in the low false-positive regime, which is crucial for evaluating privacy risks.

Figures

Figures reproduced from arXiv: 2507.21412 by the authors.

Figure 1
Figure 1. Statistical dependencies of joint MIA shows that con [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Demonstration of CMIA. The adversary ① constructs conditional shadow datasets by sampling from D adapt adv and incorporating the membership of anchors, ② performs the base attack M, ③ uses the computed membership scores to identify new anchors (Min/Mout), ④ repeats the above processes to enhance the inference of the remaining instances. based on their membership scores relative to learned decision thresholds (lines … view at source ↗
Figure 3
Figure 3. The impact of number of cascading iterations in [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: The impact of selecting different proxy data in [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: The impact of architecture differences between the [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: The impact of distribution shift between the target [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 9
Figure 9. Figure 9: The ROC curves of LIRA and CMIA (base: LiRA) on ResNet50 models trained on four image datasets. 10 5 10 4 10 3 10 2 10 1 10 0 False Positive Rate 10 5 10 4 10 3 10 2 10 1 10 0 True Positive Rate PMIA (Ours) Loss Entropy Calibration Attack-R LiRA (offline) Canary (offli…
Figure 10
Figure 10. Figure 10: The ROC curves of non-adaptive attack results on ResNet50 models trained on four image datasets. [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

72 extracted references · 50 canonical work pages

  1. [1]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in2017 IEEE symposium on security and privacy (SP), 2017, pp. 3–18

    work page 2017

  2. [2]

    Differential Privacy,

    C. Dwork, “Differential Privacy,” inAutomata, Languages and Program- ming, 2006, pp. 1–12

    work page 2006

  3. [3]

    ML privacy meter: Aiding regulatory compliance by quantifying the privacy risks of machine learning,

    S. K. Murakonda and R. Shokri, “ML privacy meter: Aiding regulatory compliance by quantifying the privacy risks of machine learning,”arXiv preprint arXiv:2007.09339, 2020

    arXiv 2007

  4. [4]

    Introducing a New Privacy Testing Library in TensorFlow,

    S. Song and D. Marn, “Introducing a New Privacy Testing Library in TensorFlow,” 2022. [Online]. Available: https://blog.tensorflow.org/ 2020/06/introducing-new-privacy-testing-library.html

    work page 2022

  5. [5]

    Extracting training data from large language models,

    N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-V oss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingssonet al., “Extracting training data from large language models,” in30th USENIX security symposium (USENIX Security 21), 2021, pp. 2633–2650

    2021

  6. [6]

    Extracting training data from diffusion models,

    N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V . Sehwag, F. Tramer, B. Balle, D. Ippolito, and E. Wallace, “Extracting training data from diffusion models,” in32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 5253–5270

    work page 2023

  7. [7]

    Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries,

    Y . Wen, A. Bansal, H. Kazemi, E. Borgnia, M. Goldblum, J. Geiping, and T. Goldstein, “Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries,” inThe Eleventh International Conference on Learning Representations, 2023

    work page 2023

  8. [8]

    Is Difficulty Calibration All We Need? Towards More Practical Member- ship Inference Attacks,

    Y . He, B. Li, Y . Wang, M. Yang, J. Wang, H. Hu, and X. Zhao, “Is Difficulty Calibration All We Need? Towards More Practical Member- ship Inference Attacks,” inProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 1226–1240

    work page 2024

Show all 72 references
  1. [9]

    Membership inference attacks from first principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership inference attacks from first principles,” in2022 IEEE symposium on security and privacy (SP). IEEE, 2022, pp. 1897–1914

    2022

  2. [10]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in2019 IEEE symposium on security and privacy (SP), 2019, pp. 739–753

    2019

  3. [11]

    Membership Inference Attacks and Defenses in Classification Models,

    J. Li, N. Li, and B. Ribeiro, “Membership Inference Attacks and Defenses in Classification Models,” inEleventh ACM Conference on Data and Application Security and Privacy, 2021, pp. 5–16

    2021

  4. [12]

    Scalable membership inference attacks via quantile regression,

    M. Bertran, S. Tang, A. Roth, M. Kearns, J. H. Morgenstern, and S. Z. Wu, “Scalable membership inference attacks via quantile regression,” in Advances in Neural Information Processing Systems, 2023, pp. 314–330

    2023

  5. [13]

    SeqMIA: Sequential-metric based membership inference attack,

    H. Li, Z. Li, S. Wu, C. Hu, Y . Ye, M. Zhang, D. Feng, and Y . Zhang, “SeqMIA: Sequential-metric based membership inference attack,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 3496–3510

    2024

  6. [14]

    Low-Cost High-Power Mem- bership Inference Attacks,

    S. Zarifzadeh, P. Liu, and R. Shokri, “Low-Cost High-Power Mem- bership Inference Attacks,” inInternational Conference on Machine Learning, 2024, pp. 58 244–58 282

    2024

  7. [15]

    Privacy risk in machine learning: Analyzing the connection to overfitting,

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in2018 IEEE 31st computer security foundations symposium (CSF), 2018, pp. 268–282

    2018

  8. [16]

    Revis- iting membership inference under realistic assumptions,

    B. Jayaraman, L. Wang, K. Knipmeyer, Q. Gu, and D. Evans, “Revis- iting membership inference under realistic assumptions,”arXiv preprint arXiv:2005.10881, 2020

    2005 arXiv

  9. [17]

    Online algorithms: a survey,

    S. Albers, “Online algorithms: a survey,”Mathematical Programming, vol. 97, no. 1, pp. 3–26, 2003

    2003

  10. [18]

    Luby,Pseudorandomness and cryptographic applications

    M. Luby,Pseudorandomness and cryptographic applications. Princeton University Press, 1996, vol. 1

    1996

  11. [19]

    Chosen ciphertext attacks against protocols based on the RSA encryption standard PKCS# 1,

    D. Bleichenbacher, “Chosen ciphertext attacks against protocols based on the RSA encryption standard PKCS# 1,” inAdvances in Cryptol- ogy—CRYPTO’98: 18th Annual International Cryptology Conference Santa Barbara, California, USA August 23–27, 1998 Proceedings 18. Springer, 1998...

    1998

  12. [20]

    Sampling-based approaches to calculat- ing marginal densities,

    A. E. Gelfand and A. F. Smith, “Sampling-based approaches to calculat- ing marginal densities,”Journal of the American statistical association, vol. 85, no. 410, pp. 398–409, 1990

    1990

  13. [21]

    Surprising convergence properties of some simple Gibbs samplers under various scans,

    G. O. Roberts and J. S. Rosenthal, “Surprising convergence properties of some simple Gibbs samplers under various scans,”International Journal of Statistics and Probability, vol. 5, no. 1, pp. 51–60, 2015

    2015

  14. [22]

    Scan order in Gibbs sampling: Models in which it matters and bounds on how much,

    B. D. He, C. M. De Sa, I. Mitliagkas, and C. R ´e, “Scan order in Gibbs sampling: Models in which it matters and bounds on how much,” Advances in neural information processing systems, vol. 29, 2016

    2016

  15. [23]

    Adaptive Gibbs samplers and related MCMC methods,

    K. Łatuszy ´nski, G. O. Roberts, and J. S. Rosenthal, “Adaptive Gibbs samplers and related MCMC methods,”The Annals of Applied Proba- bility, vol. 23, no. 1, pp. 66–99, 2013

    2013

  16. [24]

    White-box vs black-box: Bayes optimal strategies for membership inference,

    A. Sablayrolles, M. Douze, C. Schmid, Y . Ollivier, and H. J ´egou, “White-box vs black-box: Bayes optimal strategies for membership inference,” inInternational Conference on Machine Learning, 2019, pp. 5558–5567

    2019

  17. [25]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clarket al., “Learning transferable visual models from natural language supervision,” inInternational conference on machine learning, 2021, pp. 8748–8763

    2021

  18. [26]

    The Faiss library,

    M. Douze, A. Guzhva, C. Deng, J. Johnson, G. Szilvasy, P.-E. Mazar ´e, M. Lomeli, L. Hosseini, and H. J´egou, “The Faiss library,”arXiv preprint arXiv:2401.08281, 2024

    2024 arXiv

  19. [27]

    The MNIST database of handwritten digits,

    Y . LeCun, C. Cortes, and C. J. Burges, “The MNIST database of handwritten digits,” http://yann.lecun.com/exdb/mnist/, 1998

    1998

  20. [28]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,”arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  21. [29]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” 2009

    2009

  22. [30]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778

    2016

  23. [31]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,”arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  24. [32]

    Densely connected convolutional networks,

    G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” inProceedings of the IEEE confer- ence on computer vision and pattern recognition, 2017, pp. 4700–4708

    2017

  25. [33]

    Mobilenetv2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “Mobilenetv2: Inverted residuals and linear bottlenecks,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 4510–4520

    2018

  26. [34]

    A simple weight decay can improve gener- alization,

    A. Krogh and J. Hertz, “A simple weight decay can improve gener- alization,”Advances in neural information processing systems, vol. 4, 1991

    1991

  27. [35]

    SGDR: Stochastic gradient descent with warm restarts,

    I. Loshchilov and F. Hutter, “SGDR: Stochastic gradient descent with warm restarts,”arXiv preprint arXiv:1608.03983, 2016

    2016 arXiv

  28. [36]

    Random erasing data augmentation,

    Z. Zhong, L. Zheng, G. Kang, S. Li, and Y . Yang, “Random erasing data augmentation,” inProceedings of the AAAI conference on artificial intelligence, 2020, pp. 13 001–13 008

    2020

  29. [37]

    On the Impor- tance of Difficulty Calibration in Membership Inference Attacks,

    L. Watson, C. Guo, G. Cormode, and A. Sablayrolles, “On the Impor- tance of Difficulty Calibration in Membership Inference Attacks,” inThe Tenth International Conference on Learning Representations, 2022

    2022

  30. [38]

    En- hanced membership inference attacks against machine learning models,

    J. Ye, A. Maddi, S. K. Murakonda, V . Bindschaedler, and R. Shokri, “En- hanced membership inference attacks against machine learning models,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 3093–3106

    2022

  31. [39]

    Systematic evaluation of privacy risks of ma- chine learning models,

    L. Song and P. Mittal, “Systematic evaluation of privacy risks of ma- chine learning models,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2615–2632

    2021

  32. [40]

    Ge- nomic privacy and limits of individual detection in a pool,

    S. Sankararaman, G. Obozinski, M. I. Jordan, and E. Halperin, “Ge- nomic privacy and limits of individual detection in a pool,”Nature genetics, vol. 41, no. 9, pp. 965–967, 2009

    2009

  33. [41]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in2009 IEEE conference on computer vision and pattern recognition. Ieee, 2009, pp. 248–255

    2009

  34. [42]

    Cinic-10 is not imagenet or cifar-10,

    L. N. Darlow, E. J. Crowley, A. Antoniou, and A. J. Storkey, “Cinic-10 is not imagenet or cifar-10,”arXiv preprint arXiv:1810.03505, 2018

    2018 arXiv

  35. [43]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 308–318

    2016

  36. [44]

    Model inversion attacks that exploit confidence information and basic countermeasures,

    M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, 2015, pp. 1322–1333

    2015

  37. [45]

    Property inference attacks on fully connected neural networks using permutation invariant representations,

    K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov, “Property inference attacks on fully connected neural networks using permutation invariant representations,” inProceedings of the 2018 ACM SIGSAC conference on computer and communications security, 2018, pp. 619– 633

    2018

  38. [46]

    Membership privacy: A unifying framework for privacy definitions,

    N. Li, W. Qardaji, D. Su, Y . Wu, and W. Yang, “Membership privacy: A unifying framework for privacy definitions,” inProceedings of the 2013 ACM SIGSAC conference on Computer & communications security, 2013, pp. 889–900

    2013

  39. [47]

    Adversary instantiation: Lower bounds for differentially private machine learning,

    M. Nasr, S. Songi, A. Thakurta, N. Papernot, and N. Carlin, “Adversary instantiation: Lower bounds for differentially private machine learning,” in2021 IEEE Symposium on security and privacy (SP), 2021, pp. 866– 882

    2021

  40. [48]

    Auditing differentially private machine learning: How private is private sgd?

    M. Jagielski, J. Ullman, and A. Oprea, “Auditing differentially private machine learning: How private is private sgd?” inAdvances in Neural Information Processing Systems, vol. 33, 2020, pp. 22 205–22 216

    2020

  41. [49]

    Stolen memories: Leveraging model memorization for calibrated White-Box membership inference,

    K. Leino and M. Fredrikson, “Stolen memories: Leveraging model memorization for calibrated White-Box membership inference,” in29th USENIX security symposium, 2020, pp. 1605–1622

    2020

  42. [50]

    Understanding membership inferences on well- generalized learning models,

    Y . Long, V . Bindschaedler, L. Wang, D. Bu, X. Wang, H. Tang, C. A. Gunter, and K. Chen, “Understanding membership inferences on well- generalized learning models,”arXiv preprint arXiv:1802.04889, 2018

    2018 arXiv

  43. [51]

    ML-Doctor: Holistic risk assessment of inference attacks against machine learning models,

    Y . Liu, R. Wen, X. He, A. Salem, Z. Zhang, M. Backes, E. De Cristofaro, M. Fritz, and Y . Zhang, “ML-Doctor: Holistic risk assessment of inference attacks against machine learning models,” in31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 4525–4542

    2022

  44. [52]

    ML-Leaks: Model and Data Independent Membership Inference At- tacks and Defenses on Machine Learning Models,

    A. Salem, Y . Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “ML-Leaks: Model and Data Independent Membership Inference At- tacks and Defenses on Machine Learning Models,” in26th Annual Network and Distributed System Security Symposium, 2019

    2019

  45. [53]

    Membership leakage in label-only exposures,

    Z. Li and Y . Zhang, “Membership leakage in label-only exposures,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 880–895

    2021

  46. [54]

    Label- only membership inference attacks,

    C. A. Choquette-Choo, F. Tramer, N. Carlini, and N. Papernot, “Label- only membership inference attacks,” inInternational conference on machine learning, 2021, pp. 1964–1974

    2021

  47. [55]

    Students parrot their teachers: Membership inference on model distillation,

    M. Jagielski, M. Nasr, K. Lee, C. A. Choquette-Choo, N. Carlini, and F. Tramer, “Students parrot their teachers: Membership inference on model distillation,” inAdvances in Neural Information Processing Systems, 2023, pp. 44 382–44 397

    2023

  48. [56]

    Membership Inference Attacks by Exploiting Loss Trajectory,

    Y . Liu, Z. Zhao, M. Backes, and Y . Zhang, “Membership Inference Attacks by Exploiting Loss Trajectory,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, H. Yin, A. Stavrou, C. Cremers, and E. Shi, Eds., 2022, pp. 2085–2098

    2022

  49. [57]

    A pragmatic approach to membership inferences on machine learning models,

    Y . Long, L. Wang, D. Bu, V . Bindschaedler, X. Wang, H. Tang, C. A. Gunter, and K. Chen, “A pragmatic approach to membership inferences on machine learning models,” in2020 IEEE European Symposium on Security and Privacy (EuroS&P), 2020, pp. 521–534

    2020

  50. [58]

    The privacy onion effect: Memorization is relative,

    N. Carlini, M. Jagielski, C. Zhang, N. Papernot, A. Terzis, and F. Tramer, “The privacy onion effect: Memorization is relative,” inAdvances in Neural Information Processing Systems, 2022, pp. 13 263–13 276

    2022

  51. [59]

    User-Level Membership Inference Attack against Metric Embedding Learning,

    G. Li, S. Rezaei, and X. Liu, “User-Level Membership Inference Attack against Metric Embedding Learning,” inICLR 2022 Workshop on PAIR2Struct: Privacy, Accountability, Interpretability, Robustness, Reasoning on Structured Data, 2022

    2022

  52. [60]

    Did the neurons read your book? document-level membership inference for large language models,

    M. Meeus, S. Jain, M. Rei, and Y .-A. de Montjoye, “Did the neurons read your book? document-level membership inference for large language models,” in33rd USENIX Security Symposium, 2024, pp. 2369–2385

    2024

  53. [61]

    Logan: Mem- bership inference attacks against generative models,

    J. Hayes, L. Melis, G. Danezis, and E. De Cristofaro, “Logan: Mem- bership inference attacks against generative models,”arXiv preprint arXiv:1705.07663, 2017

    2017 arXiv

  54. [62]

    Are diffusion models vulnerable to membership inference attacks?

    J. Duan, F. Kong, S. Wang, X. Shi, and K. Xu, “Are diffusion models vulnerable to membership inference attacks?” inInternational Conference on Machine Learning. PMLR, 2023, pp. 8717–8730

    2023

  55. [63]

    Do membership inference attacks work on large language models?

    M. Duan, A. Suri, N. Mireshghallah, S. Min, W. Shi, L. Zettlemoyer, Y . Tsvetkov, Y . Choi, D. Evans, and H. Hajishirzi, “Do membership inference attacks work on large language models?”arXiv preprint arXiv:2402.07841, 2024

    2024 arXiv

  56. [64]

    Williams,Probability with martingales

    D. Williams,Probability with martingales. Cambridge university press, 1991

    1991

  57. [65]

    Markov chains for exploring posterior distributions,

    L. Tierney, “Markov chains for exploring posterior distributions,”the Annals of Statistics, pp. 1701–1728, 1994. 14

    1994

  58. [66]

    Peskun’s theorem and a modified discrete-state Gibbs sampler

    J. S. Liu, “Peskun’s theorem and a modified discrete-state Gibbs sampler.”Biometrika, vol. 83, no. 3, 1996

    1996

  59. [67]

    General state space Markov chains and MCMC algorithms,

    G. O. Roberts and J. S. Rosenthal, “General state space Markov chains and MCMC algorithms,”Probability Surveys, 2004

    2004

  60. [68]

    S. P. Meyn and R. L. Tweedie,Markov chains and stochastic stability. Springer Science & Business Media, 2012

    2012

  61. [69]

    R. Douc, E. Moulines, P. Priouret, P. Soulier, R. Douc, E. Moulines, P. Priouret, and P. Soulier,Markov chains: Basic definitions. Springer, 2018

    2018

  62. [70]

    Meyn and R

    S. Meyn and R. L. Tweedie,Markov Chains and Stochastic Stability. Cambridge University Press, 2009. APPENDIX A. Convergence of Joint MIA Gibbs Sampling Theorem 2(Convergence of Joint MIA Gibbs Sampling).Let M= (M 1, M2, . . . , Mn)be the vector of membership sta- tuses, whereM...

    2009

  63. [71]

    The sequence of statesM (t) forms a Markov chain with stationary distributionπ(M|o θ) = Pr(M|oθ)

  64. [72]

    Proof.We prove the above theorem by establishing that the Gibbs sampling procedure forms a Markov chain that satisfies the conditions for the Martingale Convergence Theorem [64]

    For any measurable MIA performance metricLwith Eπ[|L(M, D)|]<∞, the sequence ST = 1 T TX t=1 L(M(t), D) converges almost surely toE π[L(M, D)]asT→ ∞. Proof.We prove the above theorem by establishing that the Gibbs sampling procedure forms a Markov chain that satisfies the cond...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.