{"id":"8278dad9-99a3-48a3-9fe6-096f74fddbf2","arxiv_id":"2506.13972","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"MIAs expose different members depending on attack method and random seed; the paper quantifies this with coverage/stability and shows ensembling attacks yields stronger, more reliable privacy checks.","lead":"This paper shows that membership inference attacks, which test whether a specific piece of data was used to train a model, flag very different data points depending on which attack is used and how it is run. It proposes coverage and stability metrics plus ensemble strategies to make privacy evaluations more complete and reliable.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claim that MIAs target different member subsets is inferred from low Jaccard overlap without any null baseline, so the 'minimal overlap' may be an artifact of low TPR and small set sizes rather than evidence of systematic disparity.","rationale":"The reader's weakest-assumption concern about six-instance representativeness is real and well-targeted: Section 4.3 shows converging curves only to 16 instances and reports no variance across repeated experiment runs, so the method-level coverage and stability estimates lack statistical confidence intervals. However, I see a more foundational issue: even with a perfectly converged estimate of each attack's coverage and stability sets, the paper's interpretation of low Jaccard overlap as evidence of 'different attacks targeting different subsets' requires comparing those overlaps to a random-selection baseline. At FPR=0.1, an attack with TPR 0.3 selects 4,500 members; two such attacks selecting members independently would have expected Jaccard 0.176, which is not far from many entries in Figure 10a. At low FPR, stability sets of size under ten have near-zero expected Jaccard for any pair of independent selectors, so the near-zero values in the stability matrices carry little information without a null. The ensemble gains are constructive evidence that combining attacks helps, but they do not by themselves prove that the help comes from systematic targeting rather than from thresholding and averaging independent scoring noise. The paper does include useful supporting evidence, including the PCA visualizations in Figure 12, the Top-x Class-NN signal analysis in Figure 13, the canary-sample experiments in Appendix E, and a public code repository; these may ultimately support the disparity claim, and a null-model check would likely strengthen the paper. Since the verdict is already CONDITIONAL and the requested baseline analysis can be added without changing the overall assessment, I keep the reader's verdict unchanged while adding this specific statistical condition.","tokens_in":38597,"tokens_out":4788,"duration_ms":61083,"concrete_test":"Build a null distribution for the Figure 10 Jaccard matrices by resampling. For each attack method at a given FPR, preserve the observed coverage set size (and stability set size) but permute which members are included, drawing uniformly at random among the 15,000 target members. Repeat 1,000 times and record the 95% confidence interval for every attack pair at FPR = 0.1, 0.01, and 0.001. If observed Jaccard values fall inside the null intervals, the 'minimal overlap' claim is not evidence of systematic targeting; if they fall below the 5th percentile, the targeted-subset interpretation is supported. Also apply the same null test to the Figure 4 consistency scores by redrawing each instance's detected member set uniformly at random with the observed per-instance TPR, to verify that 'low consistency' is also beyond chance rather than a consequence of small detected sets.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central inference from Figure 1 and Figure 10 is that minimal pairwise Jaccard overlap means different MIAs 'implicitly target different subsets of members' and that single-attack evaluations are unreliable. This inference is not supported without a null model. Every attack prediction is thresholded to a fixed FPR (0.1 or lower), and Jaccard similarity between two independently selected member subsets with marginal true-positive rates p_i and p_j has expected value p_i*p_j/(p_i+p_j-p_i*p_j). At the coverage TPRs observed in Figure 7 (roughly 0.3-0.5 for several attacks), the independent-selection null expectation is about 0.18-0.33, comparable to the 0.14-0.50 coverage similarities reported in Figure 10a. At FPR=0.001 and 0.01, stability sets shrink to a handful or a few dozen members, so the expected Jaccard under random selection is near zero, matching the near-zero values in Figures 20e-f and 10b. The paper never compares the observed overlaps to this null distribution, so 'minimal overlap' and 'nearly disjoint' may simply reflect low selection probabilities and small set sizes. The ensemble results do not fully rescue the interpretation: a union of diverse detectors can also improve TPR even if each detector's member selection is independent of any stable member-level property. This gap is load-bearing because it underpins Q1-Q3, the 'disjoint subsets' framing, and the recommendation that multiple attacks or instances are needed for reliable privacy evaluation.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper argues that membership inference attacks (MIAs) exhibit large disparities both between different attack methods and between random instances of the same method, and that current privacy evaluations based on a single instance or a single method are therefore unreliable. To quantify these disparities, it introduces consistency, coverage, and stability metrics defined over multiple attack instances, and it reports experiments across seven attacks, five datasets, and four architectures. It then proposes three ensemble strategies—stability, coverage, and majority-voting—that combine instances and attack methods, and reports substantial gains in AUC, balanced accuracy, and TPR@low FPR on image datasets. The authors conclude that privacy auditing, unlearning verification, and defense evaluation should move to multi-instance, multi-method ensembles.","tokens_in":38935,"tokens_out":10515,"duration_ms":100977,"significance":"If the disparity claim holds, the paper makes a useful and timely contribution: it challenges the field's reliance on aggregate metrics and single attack runs, and it offers a concrete evaluation protocol plus open-source code. The breadth of the experiments (seven attacks, five datasets, four architectures) is a genuine strength, and the ensemble improvements on CIFAR-10, CIFAR-100, and CINIC-10 are substantial. However, the significance is currently tempered by two unresolved issues: the low-overlap interpretation lacks a null baseline, and the claim of consistent ensemble superiority is contradicted by the tabular-data appendix. With these issues addressed, the coverage/stability framework could become a practical tool for privacy auditing and unlearning verification.","major_comments":[{"comment":"The central inference that low Jaccard similarity implies that different attacks 'implicitly target different subsets of members' is not supported without a null model. Coverage sets are subsets of members whose sizes are set by each attack's TPR, so independent random subsets of the same sizes have expected Jaccard J = p_i p_j / (p_i + p_j - p_i p_j). At the coverage TPRs shown in Fig. 7 (roughly 0.11 to 0.69 at 16 instances, and lower at the six instances used in Fig. 10), this null expectation ranges from about 0.05 to 0.36. Many observed values in Fig. 10a are close to that null (e.g., Class-NN vs LiRA is 0.34 vs a null of about 0.36), while some are far below it (LOSS vs calibration is 0.03 vs a null of about 0.10). The stability panels are even more affected: at FPR 0.001 and 0.01 the stability sets contain only a handful of members (Appendix Fig. 19), so the expected Jaccard is near zero and the near-zero values in Fig. 20e-f carry little information. The paper should add an explicit random-selection or permutation null baseline and report observed-minus-expected Jaccard for each attack pair. This is load-bearing for Q1-Q3 and for the 'disjoint subsets' framing throughout the paper.","section":"§4.4, Fig. 10 and §1, Fig. 1"},{"comment":"The main results are computed from n=6 instances, justified only by the statement that the metrics 'generally start to converge' plus visual inspection of Figs. 7-9. No variance across repeated draws of seed sets is reported. The caption of Fig. 10 says the values are averages over four experimental runs, but no standard deviations or confidence intervals appear anywhere. Consequently, claims such as 'consistency score below 0.4' and 'Jaccard generally below 0.4' cannot be assessed for statistical stability. Please add error bars or bootstrap confidence intervals, and show that the method-level conclusions and ensemble rankings are robust to the choice of n (e.g., n=6 vs n=10 vs n=16).","section":"§4.1, §4.3, Fig. 10"},{"comment":"The text in §5.2 and Appendix C.3 states that all three full ensemble strategies consistently outperform individual instances. This is contradicted by Appendix Table 5 on the tabular datasets. For Texas100, the Majority-vote multi-attack ensemble achieves AUC/ACC/TPR@0.1% of 0.740/0.718/0.003, while the best single-instance attack (reference) achieves 0.841/0.785/0.066. For Purchase100, the corresponding numbers are 0.694/0.647/0.008 versus 0.729/0.690/0.014. Either the table is mislabeled (the second 'Multi-inst. Coverage' row suggests a copy-paste error) or the general claim must be qualified. As written, the manuscript is internally inconsistent on a point that is central to the practical recommendation that ensembles should replace single-instance evaluations.","section":"§5.2 and Appendix Table 5"},{"comment":"The ensemble gains are presented as 'constructive proof' of Q1-Q3, but they do not discriminate between attacks targeting different subpopulations and attacks that are merely independent noisy detectors with the same marginal TPR. A union of six independent random detectors with per-instance TPR p attains coverage TPR 1-(1-p)^6, which can also improve TPR@low FPR relative to a single detector. To support the disparity interpretation, the ensemble results should be compared against a null ensemble of independent random detectors matched in per-instance TPR, or against an ensemble that resamples instances without replacement. Without such a comparison, the improved ensemble numbers are consistent with the null hypothesis that all attacks are equally capable on every member and differ only by random noise.","section":"§5.2 and §6"}],"minor_comments":[{"comment":"The y-axis label contains a typo: 'Attak' should be 'Attack'.","section":"Fig. 4"},{"comment":"The ground truth construction is typeset with garbled symbols ('gt =®1len(...)⊕®0len(...)'); this should be a vector of ones concatenated with a vector of zeros.","section":"Algorithm 2, line 4"},{"comment":"The table contains two consecutive 'Multi-inst. Coverage' rows; the second row appears intended to be 'Multi-inst. Majority' based on the structure of Table 1.","section":"Appendix Table 5"},{"comment":"The final values printed at the ends of the curves are difficult to read and overlap; consider using a legend or a separate table of terminal values.","section":"Figs. 7, 8, 9"},{"comment":"The notation 'x ∉ Ø_{B≠A} Stability(B)' is nonstandard and should use a union symbol; as written it is confusing.","section":"§3.3, Eq. (9)"},{"comment":"The sentence 'All Ensemble are performed with 6 instances' has a grammar error and should be 'All ensembles are performed with 6 instances.'","section":"Appendix Fig. 24 caption"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is a good fit for a security conference and the empirical scope is impressive. The two issues I see as blocking are the missing null baseline for the Jaccard-overlap interpretation and the clear contradiction in Appendix Table 5 for the majority-vote ensemble on tabular data. The latter is especially concerning because the abstract and Section 5.2 make unqualified claims of consistent ensemble superiority. I would be willing to re-review a revision that adds a permutation null, error bars, and either fixes or qualifies the tabular results."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper does something genuinely useful: it shows that a single random instance of an MIA is a shaky basis for privacy evaluation, and it packages that observation into coverage/stability metrics plus three ensemble strategies. The instance-level variance finding is real and well demonstrated across five datasets and four architectures, and the convergence curves in Section 4.3 make a fair case that six instances capture most of the behavior. The code is public, the writing is clear, and the cost analysis in Section 5.3 is a nice practical touch.\n\nThe problem is the paper's headline interpretation. Low Jaccard overlap between attack member sets is presented as evidence that different attacks \"target different subsets\" of members, and that single-attack evaluations are therefore misleading. But no null baseline is ever computed. At FPR=0.1 the coverage TPRs are roughly 0.3-0.7, so two independently chosen sets of that size have expected Jaccard around 0.2-0.35. That is exactly the range of the observed coverage similarities in Figure 10a. The \"minimal overlap\" is therefore close to what chance alone would produce. The same holds for stability at low FPR, where tiny set sizes make near-zero Jaccard inevitable. The ensemble results also don't rescue the interpretation: a union of independent detectors with the same marginal TPR will always give higher coverage, regardless of whether any stable member-level property is being exploited.\n\nSo the central claim—that different attacks expose genuinely different, stable subsets of vulnerable members—is not supported by the current evidence. What remains is a solid demonstration that MIA outputs are noisy and that aggregating attacks/instances improves coverage. That is still worth publishing, but the paper overreaches. The authors should add a permutation or independence baseline, or at least compare observed overlap to the expected Jaccard under random selection. If the overlap is not significantly different from chance, they should soften the \"disparity\" language and frame the contribution as instability-aware evaluation.\n\nMinor issues: no error bars or repeated-run variances anywhere, the four ensemble attacks are chosen post-hoc, and the abstract's 36%/24%/5x improvements don't exactly match Table 1. All fixable in revision.\n\nI'd send this to serious reviewers—the evaluation-protocol question matters and the empirical groundwork is real—but I'd expect the authors to add the null analysis or explicitly back off the \"different targets\" interpretation. As is, the paper deserves a conditional accept with major revision, not a straight accept.","headline":"Useful evaluation protocol, but the 'disjoint subsets' claim needs a null model before it can carry the paper's conclusion.","tokens_in":39452,"tokens_out":3360,"would_cite":false,"duration_ms":38688,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Different membership-inference attacks expose mostly disjoint sets of training members, so single-instance privacy evaluations understate risk.","keywords":["membership inference attacks","privacy auditing","machine unlearning","coverage and stability","ensemble attacks","shadow models","disparity analysis","TPR at low FPR"],"falsifier":"Repeat the six-instance coverage and stability protocol many times on the same dataset and model and measure the variance of the pairwise Jaccard similarities. If a pair of attacks sometimes looks nearly disjoint and sometimes largely overlapping, or if adding instances beyond six changes coverage substantially, the claim of stable method-level disparity is not supported. A sharper test is to find a dataset and model where one attack's stability set contains most members in the union of all attacks' coverage, which would contradict the minimal-overlap picture.","tokens_in":38428,"feed_emoji":"🕵️","tokens_out":6498,"duration_ms":66318,"temperature":0.7,"pith_summary":"This paper argues that the standard way of judging membership inference attacks—by AUC, accuracy, and true-positive rate at low false positive rate, measured for one attack instance—misses a structural fact: different attacks, and different random runs of the same attack, flag largely disjoint sets of training members. The authors introduce coverage (the union of members detected across instances) and stability (the intersection) to quantify this, and show pairwise Jaccard similarities are low, especially stability at low false positive rates. They then build ensembles that combine several attacks through multi-instance intersection, union, or majority voting, followed by a union across attacks, and these outperform every single instance on standard metrics. If the paper is right, privacy audits, machine-unlearning checks, and defense evaluations that rely on one attack instance systematically understate exposure.","feed_headline":"Membership attacks find mostly different victims","feed_subtitle":"Privacy checks that run a single attack or seed miss most vulnerable samples; ensembles recover them.","key_machinery":"Coverage and stability are the two load-bearing quantities. Given several instances of an attack built from the same auxiliary data with different random seeds, coverage is the union of their true-positive member sets (all members any run exposes) and stability is the intersection (members every run exposes); averaging pairwise Jaccard similarities between instance-level member sets gives a consistency score. The ensemble framework then operates on these: a multi-instance step applies logical AND for the stability ensemble, logical OR for the coverage ensemble, or majority voting, followed by a logical OR across attack methods to pool the complementary vulnerabilities each attack finds.","core_discovery":"The central claim is that different attacks implicitly target different subsets of members, and the same is true of multiple instances of one attack built with different random seeds. Across CIFAR-10, CIFAR-100, CINIC-10, Purchase100, and Texas100, pairwise Jaccard similarity between attacks' detected member sets is generally below 0.4 for coverage and below 0.1 for stability at an instance FPR of 0.1, meaning an attack that looks weaker by aggregate metrics can still expose members another attack misses. The paper treats this not as a curiosity but as a reliability problem: evaluations that report a single instance reflect only the subset that instance happens to catch. As constructive evidence, combining four attacks with six instances each improves ROC AUC by 36%, balanced accuracy by 24%, and TPR at 0.1% FPR by a factor of five on CIFAR-10 compared with the best single instance.","pith_inferences":["The disjointness result suggests a per-sample vulnerability profile: instead of ranking attacks by a single scalar, one could label each training member by which attack signals expose it, and use those profiles to direct auditing effort toward samples invisible to the strongest attack.","The same protocol could transfer to LLM membership evaluations, where distribution shift between member and non-member data already inflates metrics; coverage and stability would at least separate attack-specific from instance-specific detection effects.","A direct stress test of the method-level claim would compute coverage and stability with 16 or more instances across many repeated experiment runs; if pairwise Jaccard similarities remain stable, the six-instance protocol can serve as a standard evaluation block, and if not, the ensemble conclusions need instance-count-dependent qualification."],"forward_implications":["A privacy evaluation that reports a single attack instance is incomplete: members that one instance misses can be found by another instance of the same attack, so the reported exposure is a lower bound rather than the full risk.","An attack with modest AUC still contributes to privacy assessment if it detects a high-disparity set of members that stronger attacks miss; combining such attacks is what produces the largest ensemble gains.","Ensemble evaluation can be made practical: attacks that share shadow models, such as LiRA and the Reference Attack, can be combined at nearly the cost of one, and the calibration attack is a cheap add-on requiring only one shadow model.","Coverage and stability should be reported alongside AUC and TPR at low FPR as complementary descriptors of what an attack reveals and how consistently it reveals it."],"supporting_citations":[{"why":"Supplies the likelihood-ratio attack (LiRA) whose detection sets anchor the disparity comparisons.","marker":"[3]"},{"why":"Supplies the loss-trajectory attack, one of the four attacks used in the ensemble and a core comparison method.","marker":"[30]"},{"why":"Supplies the Class-NN attack, whose multiple instances show especially low consistency and strongly disjoint member sets.","marker":"[44]"},{"why":"Supplies the Reference Attack, a compared method that shares shadow models with LiRA and therefore enables low-cost ensembling.","marker":"[51]"},{"why":"Supplies the difficulty-calibration loss attack, a base attack and the cheap add-on used in the ensemble.","marker":"[50]"},{"why":"Supplies the LOSS attack, the deterministic baseline with no randomness whose consistency is exactly one.","marker":"[52]"},{"why":"Supplies the augmentation-based label-only attack, included in the disparity and signal-analysissuites.","marker":"[8]"},{"why":"Supports the premise that random initialization makes neural-network training explore different function-space modes, motivating instance-level disparity.","marker":"[12]"},{"why":"Supplies the ROC computation used to convert membership scores to equal-FPR predictions across instances.","marker":"[40]"}],"fun_headline_variants":["Different membership attacks catch different victims","One attack misses what another finds","Ensembles of attacks find more leaked data","Privacy attacks disagree on who is exposed","Single attack blind spots fixed by ensembles"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper's method-level conclusions rest on the assumption that six random instances of an attack are enough to represent the method, so that coverage, stability, and pairwise similarities have converged; without a statistical bound, more instances or repeated runs could shift these sets.","fun_headline_variants_meta":{"raw":{"variants":["Different membership attacks catch different victims","One attack misses what another finds","Ensembles of attacks find more leaked data","Privacy attacks disagree on who is exposed","Single attack blind spots fixed by ensembles"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000199,"raw_usage":{"total_tokens":1360,"prompt_tokens":921,"completion_tokens":439,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":537,"completion_tokens_details":{"reasoning_tokens":379}},"tokens_in":537,"tokens_out":439,"duration_ms":5593,"temperature":1.0,"reasoning_tokens":379,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T00:25:31.500553+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Repeat the six-instance coverage and stability protocol many times on the same dataset and model and measure the variance of the pairwise Jaccard similarities. If a pair of attacks sometimes looks nearly disjoint and sometimes largely overlapping, or if adding instances beyond six changes coverage substantially, the claim of stable method-level disparity is not supported. A sharper test is to find a dataset and model where one attack's stability set contains most members in the union of all attacks' coverage, which would contradict the minimal-overlap picture.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Class-NN attack, whose multiple instances show especially low consistency and strongly disjoint member sets."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the difficulty-calibration loss attack, a base attack and the cheap add-on used in the ensemble."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the augmentation-based label-only attack, included in the disparity and signal-analysissuites."}],"review_version":1}