{"id":"3114567e-21d0-4ee0-acdb-d9f1e517db85","arxiv_id":"2506.00701","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":3.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"A Bayesian membership inference method using Gaussian likelihoods over post-hoc metrics is shown on synthetic data, but it confuses 'same distribution as training data' with 'actually in the training set'.","lead":"This paper proposes a Bayesian method to guess whether a dataset was used to train a machine learning model, using model outputs like prediction error, confidence, entropy, and weight changes after brief fine-tuning. The authors test it on synthetic data and report high posterior probabilities for member-like datasets, but the results mostly show the method detects distributional similarity, not actual training membership.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported experiments conflate distributional similarity with membership: a held-out dataset sampled from the member-generating distribution receives posterior 0.9996, so the evidence does not establish a membership inference method.","rationale":"The central claim requires that p(M=1|z) be higher for a dataset actually used in training than for a dataset of equal distribution that was not. Section 4.2 violates this directly. The mechanism is transparent: z includes feature means and variances, and mu_{i,1} are calibrated on a member dataset; the likelihood is a product of Gaussians with a pooled sigma, so the posterior is essentially a distance-to-centroid classifier between the calibration member and non-member datasets. The 'new similar dataset' is a same-distribution non-member and gets posterior 0.9996, while the true member gets 0.9993, meaning a false positive rate of essentially 1 for the case that matters. The authors' own limitation list does not mention this confound; it only notes Gaussian fit, prior sensitivity, and metric independence. Re-running with multiple same-distribution non-members and reporting separation or AUC would settle the matter. The reader's REJECT verdict is therefore supported and no adjustment is needed.","tokens_in":7561,"tokens_out":3382,"duration_ms":32829,"concrete_test":"Construct a controlled grid using the paper's own synthetic procedure: generate 20 datasets from the member Gaussian (class separation 1.0), train the MLP on 10 of them, and treat the remaining 10 as same-distribution non-members; generate 20 from the distinct distribution (class separation 3.0, noise 0.2) as clearly different non-members. Calibrate mu and sigma exactly as in Section 4.1 (one member plus one distinct non-member), then apply Algorithm 1 to all 40 datasets. Report posterior distributions and the AUC separating true members from same-distribution non-members. If AUC is near 0.5, or both groups exceed 0.99 as the 'new similar dataset' suggests, the posterior is not a membership score and the central claim is falsified.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The single most load-bearing flaw is that the reported experiments do not test membership; they test distributional similarity. In Section 4.2, Experiment 1, the paper's own 'new similar dataset' is deliberately sampled from the same distribution used to generate the member training data but is never used in training, and it receives posterior probability 0.9996, essentially identical to the true member subset (0.9993). This is not an edge case; it is the direct consequence of the construction in Section 3: the metric vector z includes the means and variances of the 10 input features, and the likelihood means mu_{i,1} are calibrated from a member dataset. Under the assumed conditionally independent Gaussian product with a uniform prior, p(M=1|z) is a monotone function of the distance between z and the calibrated member centroid. Any dataset with the same generative distribution as a calibration member will therefore be assigned near-certain 'member' status regardless of whether it was in the training set. Thus the method cannot discriminate a held-out same-distribution non-member from a member, which is the minimal requirement for a membership inference attack. The paper's conclusion conflates 'member-like' with 'member'; the limitation list in Section 4.3 acknowledges calibration sensitivity but does not address this confound.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a Bayesian inference method for membership inference attacks (MIAs). Given a trained model and a test dataset, the method extracts 23 metrics (prediction error, entropy, perturbation magnitude, and feature means/variances), models their likelihoods as conditionally independent Gaussians calibrated using known member and non-member datasets, and computes the posterior probability p(M=1|z) with a uniform prior. The authors report experiments on synthetic binary classification data in which a member subset receives posterior about 0.9993, a 'new similar dataset' (never in training) receives about 0.9996, and a 'distinct' dataset receives about 0.0238 (Experiment 1). They interpret this as evidence that the method distinguishes member from non-member datasets. The central claim is that this provides an efficient, interpretable, black-box-query MIA without shadow models or extensive training.","tokens_in":7838,"tokens_out":3037,"duration_ms":30946,"significance":"If the central claim held, the method would be a useful contribution: it is computationally light (O(E·n·m)), interpretable, and does not require shadow models. The paper also provides pseudocode, a complexity analysis, and a public code/data link. However, the reported experiments do not establish membership inference; they establish detection of distributional similarity. The paper's own 'new similar dataset'—explicitly not in the training set—receives a posterior of 0.9996, essentially equal to (and even slightly higher than) the true member subset's 0.9993. This is exactly the failure mode that a membership inference method must avoid: a non-member drawn from the same distribution as the training data is indistinguishable from a member. The Gaussian likelihood is calibrated on the same member-generating distribution, so the posterior is a monotone function of distance to the member centroid. The results are therefore forced by construction and do not support the claimed capability.","major_comments":[{"comment":"The key result is self-contradictory with the paper's claim of membership discrimination. The 'new similar dataset' is described as 'a re-sampled dataset with the same distribution as the member dataset' and is explicitly not part of the training set. It receives a posterior probability of 0.9996, which is higher than the actual member subset's 0.9993. Under any valid membership inference method, a non-member must receive a lower membership score than a member when all else is controlled. Here the method cannot distinguish a genuine member from a never-seen same-distribution dataset; it is simply measuring how close the test dataset's metrics are to the calibrated member centroid. This is detection of distributional similarity, not membership. The conclusion in §5 that the method 'accurately identifies member-like datasets' implicitly concedes this conflation.","section":"§4.2, Experiment 1 (Fig. 1b)"},{"comment":"The calibration procedure ensures that high posteriors for same-distribution datasets are forced by construction. Section 4.1 states that µ_{i,1} are computed from member datasets, µ_{i,0} from non-member datasets, and σ_i as the pooled standard deviation across both. The metric vector z includes the means and variances of the 10 input features, so a dataset drawn from the same generative distribution as the member calibration data will have z nearly identical to the member centroid. With a uniform prior and a product of Gaussians, p(M=1|z) is a monotone function of the distance between z and the member centroid. Therefore any dataset from the member-generating distribution receives near-certain 'member' status. The paper never tests the critical condition where a non-member is drawn from the same distribution as a calibration member but is excluded from training; the 'new similar dataset' is precisely this condition and the method fails. This invalidates the claim that the posterior represents membership probability.","section":"§4.1 and §3 (likelihood construction)"},{"comment":"The limitations paragraph acknowledges calibration sensitivity (item 2) and independence assumptions (item 3) but does not address the confound between membership and distributional similarity. The conclusion explicitly says the method 'accurately identifies member-like datasets'—but 'member-like' is distributional similarity, not membership. A membership inference attack must discriminate a training member from a held-out sample of the same population; the reported experiments do not even attempt this. The methodology as presented cannot support the central claim without a new experimental setup that includes same-distribution non-members as a negative control, and even then the likelihood model would need to be parameterized in a way that is not trivially determined by the calibration distribution.","section":"§4.3, Discussion and §5, Conclusion"}],"minor_comments":[{"comment":"There is a typo: 'moer informed prior' should be 'more informed prior'. Also, the sentence 'An moer informed prior , e.g.p(M = 1) = 0.3, can be used' lacks proper punctuation.","section":"§3, paragraph on prior"},{"comment":"The text says 'We created 6 a synthetic dataset'—the '6' appears to be a leftover footnote marker. Also, the fine-tuning step for perturbation magnitude is not fully specified: the number of epochs is given as 5, but the optimizer, learning rate, and whether labels are used are not stated. Since the attack scenario presumably requires access to labels for the test dataset, this should be made explicit.","section":"§4.1, Experimental Procedure"},{"comment":"The posterior values in Experiment 2 are reported only in prose ('0.9948 and 0.9974') and are not shown in Figure 2b with axis labels. Adding a table of posteriors for all three test sets in both experiments would improve reproducibility and clarity.","section":"§4.2, Results"},{"comment":"The complexity O(E·n·m) is stated, but the memory complexity O(m+d) ignores the storage of the fine-tuned weights (another m parameters) and the dataset (n·d). This is a minor imprecision but should be corrected.","section":"§3, Complexity"},{"comment":"The related work is too brief for the security literature. It omits recent membership inference methods such as Salem et al. (2018) and Sablayrolles et al. (2019), which are directly relevant to black-box and metric-based MIAs. The reader is left unsure how this method compares to existing low-cost attacks.","section":"§2, Related Work"}],"recommendation":"reject","confidential_remarks":"The manuscript's own experimental results are internally inconsistent with its main claim. The 'new similar dataset'—a never-trained same-distribution dataset—receives a posterior of 0.9996, higher than the actual member's 0.9993. This is not a minor flaw; it means the method is measuring distributional match, not membership. The paper would need a fundamentally different evaluation (e.g., same-distribution held-out non-members as negative controls) and likely a different likelihood model to have any chance of supporting the claim. Given the scope of the required changes, rejection is appropriate. The paper's only strength is its presentation of a simple interpretable framework, but that does not outweigh the validity failure."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this paper does not do what it claims. The Bayesian formulation is a clean, interpretable way to calibrate a threshold on metric distances, but the experiments only show that datasets from the same generating distribution as the calibration member data get high posterior probabilities. The 'new similar dataset' in Experiment 1 was never in training and gets 0.9996, slightly higher than the actual member subset's 0.9993. That is the whole ballgame: membership inference requires separating held-out same-distribution points from training points, and this method cannot.\n\nWhat's actually here: the idea of replacing shadow-model training with a few Gaussian likelihoods over post-hoc metrics is reasonable, and the paper does spell out the calibration procedure clearly. The write-up is honest about some limitations (metric independence, sensitivity to likelihood parameters). If the goal were a distribution-shift detector, the approach might be a usable baseline, though with no error bars or baselines it's hard to say.\n\nThe soft spots are not minor. The likelihood means are fitted on known member datasets, so the posterior is essentially a distance to a centroid. Any query set drawn from the same generative distribution as the calibration member data will land near that centroid, regardless of membership. That is exactly what happens. The paper's conclusion conflates 'member-like' with 'member.' The limitation list in Section 4.3 doesn't address this confound. Also missing: any comparison to threshold-based MIAs (LiRA et al.), no variance across seeds, no real data, and the GitHub link is not actually included (just the words 'this github repository').\n\nThis is a one-experiment paper on synthetic data whose single result undermines its main claim. It could be a useful starting point for a discussion of why distributional similarity is not membership, but as a submission it should be rejected. Recommendation: desk reject.","headline":"The paper's own Experiment 1 shows the method detects distributional similarity, not membership: a held-out same-distribution dataset scores 0.9996, so the central claim is refuted by the reported results.","tokens_in":8326,"tokens_out":1710,"would_cite":false,"duration_ms":16329,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes that whether a dataset was part of a model's training pool can be answered as a Bayesian posterior over post-hoc metrics: prediction error, predictive entropy, perturbation magnitude, and dataset statistics.","keywords":["membership inference","Bayesian inference","posterior probability","privacy auditing","distribution shift","Gaussian likelihood","post-hoc metrics","machine learning privacy"],"falsifier":"Generate a test set as a held-out sample from the same two-cluster Gaussian mixture used to create the member training data, run the calibrated procedure on it, and compare the posterior with a set that actually appears in training: if both sit near 0.999, the score tracks distributional proximity rather than membership; if they separate, the method has genuine membership signal beyond similarity.","tokens_in":7357,"feed_emoji":"🔍","tokens_out":8520,"duration_ms":77525,"temperature":0.7,"pith_summary":"The paper tries to establish that membership of a dataset in a trained model's training pool can be inferred in a fully Bayesian way from the model's behavior on that dataset, without training shadow models or accessing model internals. A candidate dataset is passed through the trained model, 23 metrics are extracted, and these metrics are fed into a product-of-Gaussians likelihood whose means and variances are calibrated on known member and non-member datasets; Bayes' rule then yields a posterior probability $p(M=1|z)$ reported as the membership score. The claim matters because it promises an efficient, interpretable privacy audit that works with only black-box queries and a short fine-tuning pass, and because the same score can be read as a distribution-shift detector. In the paper's synthetic experiments, the score separates a true member and a re-sampled same-distribution dataset (posteriors near 0.999) from a distinct dataset (posterior near 0.02), which is the evidence offered for the claim.","feed_headline":"Bayesian posteriors flag training-set membership without shadow models","feed_subtitle":"A single posterior over 23 post-hoc metrics promises cheap, interpretable privacy checks after training.","key_machinery":"The object that carries the argument is the posterior $p(M=1|z)$, computed by Bayes' rule with a Bernoulli prior and a product-of-independent-Gaussians likelihood: $$p(M=1|z)=\\frac{p(z|M=1)p(M=1)}{p(z|M=1)p(M=1)+p(z|M=0)p(M=0)},$$ where $z$ stacks prediction error, average predictive entropy, fine-tuning perturbation magnitude, and per-feature means and variances. The load-bearing step is calibration: each metric's mean under each hypothesis and a pooled standard deviation are estimated from known member and non-member datasets, turning the posterior into a normalized distance score to those fitted centroids. This calibrated Gaussian likelihood is what converts raw model outputs into a claimed probability of membership.","core_discovery":"The central claim is that the membership status of an entire dataset is a Bayesian hypothesis, $M\\in\\{0,1\\}$, and that the posterior $p(M=1|z)$ computed from post-hoc metrics is a valid membership-inference score. The likelihood $p(z|M)$ is taken to be a product of independent Gaussian densities over prediction error, entropy, perturbation magnitude, and feature means and variances, with parameters $\\mu_{i,M}$ and $\\sigma_i$ calibrated from known member and non-member datasets or set by hand. With a uniform prior $p(M=1)=p(M=0)=0.5$, the score is the normalized likelihood ratio. On the synthetic binary-classification setup, the paper reports posterior probabilities of 0.9993 for a retrieved member subset, 0.9996 for a freshly re-sampled dataset drawn from the member distribution, and 0.0238 for a distinct dataset in the first experiment; adding a similar non-member dataset to calibration moves these to 0.9948, 0.9974, and 0.0048. The paper argues these numbers show the method distinguishes member-like from distinct datasets, at computational cost dominated by fine-tuning, $O(E\\cdot n\\cdot m)$.","pith_inferences":["Read as a distance-to-centroid score, the posterior measures distributional similarity rather than actual training presence; the paper's own 'new similar dataset' result (posterior 0.9996 with no training exposure) makes this explicit, though the paper does not draw that conclusion.","A direct test of the membership interpretation would train on one half of a distribution and probe the other half: a score that cannot separate same-distribution held-out data from training data is a distribution-shift detector, not a membership oracle.","The independence and Gaussian assumptions could be relaxed to a multivariate Gaussian likelihood with a covariance matrix; one testable question is whether that changes the near-certain posteriors on member-like data or only their calibration sensitivity.","One could construct a null distribution for the posterior under the non-member hypothesis and quote false-positive rates, turning the method into a formal hypothesis test with calibrated thresholds rather than raw posterior values."],"forward_implications":["Membership auditing becomes a post-hoc query: pass a candidate dataset through the trained model, fine-tune briefly, and read off a probability, with no shadow-model training or internal gradient access.","The reported time complexity $O(E\\cdot n\\cdot m)$ means the main cost is the short fine-tuning pass, so the procedure scales to deployment settings where only the trained model is available.","Because the same posterior compares a dataset to the calibrated member distribution, a low membership score doubles as a signal of distribution shift away from the reference data.","Adding more non-member datasets whose distributions resemble the candidate sharpens the separation, so the score's meaning is tied to the calibration set used.","The posterior is directly interpretable as a probability and can be thresholded for decisions, in contrast to raw confidence- or loss-based membership scores."],"supporting_citations":[{"why":"Defines the shadow-model membership-inference baseline whose computational cost this paper's method is designed to avoid.","marker":"[9]"},{"why":"LiRA, the likelihood-ratio attack that the paper positions as effective but expensive in model queries, motivating the Bayesian alternative.","marker":"[2]"},{"why":"Enhanced membership inference attacks using loss and confidence features, the line of work this paper extends by replacing trained attack classifiers with a calibrated likelihood.","marker":"[10]"},{"why":"Provides the synthetic data generator used to construct the member, non-member, and test datasets in the experiments.","marker":"[8]"},{"why":"Survey that frames the accuracy-cost-access trade-offs among membership-inference strategies, used to motivate the need for efficient interpretable methods.","marker":"[6]"}],"fun_headline_variants":["Bayesian scores reveal training-set membership cheaply","Post-hoc metrics, Bayesian verdict: data was in training?","No shadow models: Bayesian inference detects membership","Interpretable MIAs: Bayesian posteriors from model outputs","Bayesian method spots training data and distribution shifts"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method's Gaussian likelihood parameters are calibrated on known member and non-member datasets, and the reported separation depends on those calibration sets being representative of the candidate dataset's true generative distribution; if the candidate is drawn from the same distribution as the member calibration data, a high posterior is forced by construction regardless of whether the candidate was ever in the training set.","fun_headline_variants_meta":{"raw":{"variants":["Bayesian scores reveal training-set membership cheaply","Post-hoc metrics, Bayesian verdict: data was in training?","No shadow models: Bayesian inference detects membership","Interpretable MIAs: Bayesian posteriors from model outputs","Bayesian method spots training data and distribution shifts"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000193,"raw_usage":{"total_tokens":1332,"prompt_tokens":909,"completion_tokens":423,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":525,"completion_tokens_details":{"reasoning_tokens":348}},"tokens_in":525,"tokens_out":423,"duration_ms":4314,"temperature":1.0,"reasoning_tokens":348,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T11:59:16.132209+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate a test set as a held-out sample from the same two-cluster Gaussian mixture used to create the member training data, run the calibrated procedure on it, and compare the posterior with a set that actually appears in training: if both sit near 0.999, the score tracks distributional proximity rather than membership; if they separate, the method has genuine membership signal beyond similarity.","supporting_citations":[{"cited_title":"Membership Inference Attacks Against Machine Learning Models","cited_arxiv_id":null,"evidence_quote":"Defines the shadow-model membership-inference baseline whose computational cost this paper's method is designed to avoid."},{"cited_title":"Membership inference attacks from first principles","cited_arxiv_id":null,"evidence_quote":"LiRA, the likelihood-ratio attack that the paper positions as effective but expensive in model queries, motivating the Bayesian alternative."},{"cited_title":"Enhanced membership inference attacks against machine learning models","cited_arxiv_id":null,"evidence_quote":"Enhanced membership inference attacks using loss and confidence features, the line of work this paper extends by replacing trained attack classifiers with a calibrated likelihood."},{"cited_title":"Scikit-learn: Machine learning in python","cited_arxiv_id":null,"evidence_quote":"Provides the synthetic data generator used to construct the member, non-member, and test datasets in the experiments."}],"review_version":1}