A new membership inference attack that spots memorization in generative and predictive models: Loss-Based with Reference Model algorithm (LBRM)

Faiz Taleb; Ivan Gazeau; Maryline Laurent

REVIEW 5 major objections 6 minor 15 references

A new membership inference attack that spots memorization in generative and predictive models: Loss-Based with Reference Model algorithm (LBRM)

T0 review · 5 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A reference-model loss ratio separates memorized from unseen time series, lifting membership inference AUROC by roughly 40–60%.

desk verdict A known reference-model loss-ratio trick applied to time-series imputation, with a plausible empirical claim but sloppy internal contradictions that block acceptance in current form. read the letter →

arxiv 2505.03490 v1 pith:CQXQWBG5 submitted 2025-05-06 cs.LG cs.AI

Faiz Taleb , Ivan Gazeau , Maryline Laurent This is my paper · ORCID

classification cs.LGcs.AI

keywords membershipinferenceattackmemorizationtimeseriesimputationreferencemodellossratiodynamicwarpinggenerativemodelsprivacyleakage

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Generative and predictive time-series imputation models can memorize training rows, and this paper asks whether an attacker with black-box query access can detect which rows were in training. The proposed answer, LBRM, masks one value of a candidate series, has the target model and a reference model both impute it, and uses the ratio of their Dynamic Time Warping losses as the membership score; a low target-to-reference ratio marks the series as memorized. The paper's claim is that this comparison exposes a memorization signal that raw loss hides, because a memorized series fits the target much better than an equally capable reference while an unseen series fits both about the same. If correct, the method lifts membership-inference AUROC from near-random values to 0.71–0.90 across two imputation architectures, with reported average gains of roughly 40% without fine-tuning and 60% with fine-tuning.

What carries the argument

The carrying object is the reference-model loss ratio $R(x)=L_T(x)/L_R(x)$, evaluated with Dynamic Time Warping on a one-value-masked version of the candidate series. The reference model $R$ acts as an unbiased witness: it is trained on public data only and is chosen to have performance equivalent to $T$, so a large performance gap on $x$ is attributed to $T$ having memorized $x$ rather than to $T$ being a better imputer overall. The threshold $\theta$ can come from the ratio distribution on known non-members (mean plus $n$ standard deviations) or from a top-$n\%$ ranking, and the authors argue the attack is insensitive to this choice. The essential requirement, stated in Section 4.1 and checked in Section 5.2, is that $T$ and $R$ have comparable accuracy; otherwise the ratio reflects model-quality differences rather than memorization.

What would settle it

Run LBRM with a deliberately mismatched reference model—for example, one trained on a different distribution or with a much weaker architecture—and compare the AUROC against the matched-reference case. If the AUROC stays high, performance parity is not the mechanism; if it drops toward 0.5, the paper's parity requirement is confirmed.

Watch

Extended reading notes

Core claim

LBRM turns membership inference into a two-model comparison. For each candidate series $x$, the attacker masks one value to form $x_{\mathrm{masked}}$, asks the target model $T$ and a reference model $R$ to impute it, and measures both imputations against the original series with the Dynamic Time Warping loss, a distance that aligns two time series to minimize pointwise differences: $L_T(x)=\mathrm{DTW}(\hat y_t,x)$ and $L_R(x)=\mathrm{DTW}(\hat y_r,x)$. The membership statistic is the ratio $R(x)=L_T(x)/L_R(x)$, and $x$ is declared a training member when $R(x)\le \theta$. The paper's central claim is that this ratio detects memorization even when the target model shows little overfitting: in their experiments the naive loss-only attack has AUROC near 0.42–0.55, while LBRM reaches 0.71–0.90, with the largest gains in the fine-tuned scenario of public pretraining followed by private fine-tuning. The authors further report that the choice of $\theta$ does not drive the result, since the ROC curves stay wide across thresholds, and that the method works for both a predictive attention-based model and a generative autoencoder.

Load-bearing premise

The paper's own conclusion acknowledges the method's dependency on the reference model; the load-bearing premise is that the attacker can obtain a reference model whose imputation performance is closely matched to the target's, since otherwise the loss ratio stops separating members from non-members.

Editorial extensions

If this is right

A black-box attacker with query access to a time series imputation API can recover membership information by training a comparable public reference model and comparing DTW losses on masked candidates.
Fine-tuning on private data after public pretraining appears to increase vulnerability: in the paper's experiments SAITS AUROC reaches 0.90 in the fine-tuned scenario, up from 0.71 when trained from scratch.
The threshold can be set from public data (mean plus $n$ standard deviations of the ratio) or from a top-$n\%$ ranking, so the attacker does not need to know the exact size of the private training set.
Both a predictive attention-based architecture and a generative autoencoder show the effect, so time series imputation models as a class should be treated as exposed to this attack.
Because LBRM succeeds where naive loss fails, memorization—not general overfitting—is the usable membership signal in these models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper does not test mismatched reference models in the main evaluation; the parity requirement predicts AUROC should degrade toward 0.5 when $R$ is weaker or trained on a different distribution, which would make reference-model construction the attacker's critical bottleneck.
The one-value masking step invites a natural family of variants: multiple masks, random masks, or masked windows might produce smoother or stronger membership scores, and other alignment-invariant losses beyond DTW could be substituted.
The same ratio principle should transfer to other data-to-data generative settings where a missing-value task can be defined—image inpainting, audio restoration, tabular imputation—provided the attacker can build a comparable reference model.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this paper is a reasonable starting point for a niche problem, but it is not close to publishable as-is. The core idea — compare the target model's loss to a reference model's loss and use the ratio as a membership score — is a known MIA construction, and the authors miss the relevant shadow-model and reference-model citations. What is new is the application to multivariate time-series imputation, using DTW as the loss and testing on SAITS and an autoencoder. That is a modest but genuine extension, and the reported AUROC gains over a naive loss baseline point in the plausible direction.

Where it falls apart is the reporting. Algorithm 1 says return member if R <= theta; Section 4.3 says the opposite. The DTW formula is not DTW; it is a double sum over all pairs. Table 3 and the text disagree on the AE baseline AUROC (0.42 vs 0.55) and on which model produced which gains. There are no error bars, no seeds, no code, and no discussion of variance. The paper also contains a direct internal contradiction about the attack setup: Section 5.1.4 says Scenario 1 trains T only on private data P, while Section 5.1.5 says T is trained on O union P. That is not a minor typo — if T sees the public set and R does not, the loss ratio is contaminated by distribution shift and training-set size, which could explain part of the memorization signal. The authors assert parity between T and R but do not demonstrate it cleanly for Scenario 1.

I would not sink the idea. The reference-model loss-ratio is a legitimate tool, and time-series imputation is a real gap in the MIA literature. But the paper needs major revision: correct the threshold rule, fix the DTW formula, reconcile the contradictory setup descriptions, add multiple runs with error bars, and release code or at least precise hyperparameters. The citation gap to shadow-model and reference-model attacks should also be addressed. With those fixes, this could become a solid workshop-level or small journal contribution.

Worth a serious referee? Yes — the application is real and the core mechanism is sound. My recommendation is to send it back for major revision, not accept. I would not cite it in its current state.

Referee Report

5 major / 6 minor

Summary. The paper proposes the Loss-Based with Reference Model (LBRM) algorithm, a membership inference attack for time series imputation models. The attack masks one unit of information in a suspicious data point, obtains imputations from both the target model T and a reference model R, computes a Dynamic Time Warping loss for each, and classifies the point as a training member based on the ratio L_T/L_R. The method is evaluated against a naive loss-based baseline on two architectures (SAITS and an autoencoder) and in two scenarios (without and with fine-tuning). The authors report average AUROC improvements of approximately 40% without fine-tuning and 60% with fine-tuning, and they claim the approach is robust across different architectures and threat scenarios.

Significance. If substantiated, a reference-model-based membership signal for time series imputation would be a useful addition to the privacy-attack toolbox, especially because the attack is black-box and does not require access to training data. The central idea of comparing the target model's loss with a reference model's loss is conceptually reasonable and deserves rigorous evaluation. However, the current manuscript contains internal inconsistencies in the experimental setup and in key numerical results, and it provides no code, seeds, or error bars, so the quantitative claims cannot currently be considered established. The paper does not ship machine-checked proofs or reproducible code; its contribution is an empirical method and a set of results that, once corrected and properly documented, could become significant.

major comments (5)

[§5.1.4 vs §5.1.5] The experimental setup for Scenario 1 is contradictory. Section 5.1.4 states that in Scenario 1 the target model T is trained only on the private dataset P and that P and O are from different distributions, whereas Section 5.1.5 states that 'The models T are trained on the public dataset O combined with the private dataset P. The models R are trained solely on the public dataset O.' If T is trained on O ∪ P and R is trained on O alone, then the ratio L_T/L_R is not a clean membership statistic: it also encodes the distribution mismatch between O and P and the difference in training-set size between T and R. The reported AUROC gains could then reflect this mismatch rather than memorization. Please specify exactly which setup was used, and either align the two sections or re-run the experiments so that Scenario 1 isolates membership.
[§5.3 / Table 3] The text and Table 3 disagree on the AE baseline in Scenario 1. Section 5.3 states that 'the AE model's AUROC improved from 0.55 (also close to random) to 0.77,' but Table 3 reports the AE Naive Loss AUROC as 0.42 and the AE LBRM AUROC as 0.77. The conclusion in Section 6 repeats the 0.55 baseline and states a 40% improvement for AE, which is inconsistent with the table. If Table 3 is correct, the improvement is from 0.42 to 0.77, an 83% relative increase, not 40%; if the text is correct, Table 3 is wrong. This discrepancy directly affects the headline quantitative claim and must be resolved.
[§4.2 / Algorithm 1 / §4.3] The classification rule for the threshold is stated inconsistently. Algorithm 1 returns 1 (member) if R ≤ θ, and Section 4.2 says 'Classify x as a member of the training data if R(x) ≤ θ.' However, Section 4.3 says the opposite: 'If the ratio R(x) exceeds the threshold, it indicates that the data point x is likely to be part of the training set.' Since θ is an input to the attack, the direction of the inequality determines the meaning of the reported TPR values. Please specify the exact rule used in the experiments and reconcile the text with Algorithm 1.
[§4.2, DTW loss] The Dynamic Time Warping loss formula is not the standard DTW recurrence. The displayed equation, LossDTW(y1,y2) = min over alignments of the sum over all i,j of d(y1(i), y2(j)), is not well-defined as written: standard DTW minimizes over warping paths that satisfy boundary, monotonicity, and step-size constraints, and it computes a cumulative cost via dynamic programming, not a free minimization over all pairs. Because LT(x) and LR(x) are the entire basis of the R(x) score, the paper must provide a correct, implementable definition of the DTW loss, including the recurrence and constraints, or cite a specific implementation.
[§5.3 / Table 3] All reported AUROC and TPR values are single point estimates with no error bars, confidence intervals, or multiple seeds. The comparisons in Table 3 involve small differences in some cases (e.g., SAITS Scenario 1 TPR@top25% is 60% vs 52%), and the claims of consistent 40% and 60% improvements rest on these point estimates. The paper should report results over multiple random dataset splits and training runs, with standard deviations, and should provide code or detailed hyperparameters to allow reproducibility.

minor comments (6)

[Title and running head] The algorithm is named LBRM, but the running head and some sections use 'LRBM'; please standardize the abbreviation throughout.
[§4.2] In the DTW equation, the quantities N and M are not defined in the displayed formula. Please define them as the lengths of the two time series.
[§5.3.1] The sentence 'For our experiments, we set the n = 25% because in our experiments we know we need to evaluate 50% as private data and 50% as test' is unclear. If the class balance is 50/50, the reason for choosing the top 25% of scores rather than, say, the top 50% is not explained. Please clarify the decision rule and its relationship to the threshold θ.
[Table 2] The header of Table 2 is confusing: 'MAE Model T Model T Model R Model T Model R' does not indicate which scenario or model each column refers to. Please restructure the table so scenario, model, and T/R are clearly labeled.
[References] The citations for the datasets appear as 'noa [a]' and 'noa [b]' in the text and are formatted inconsistently in the reference list. Please use standard citation keys and formats.
[§5.1.5] The text says 'Data preparation: each dataset is divided randomly into public, private, and test sets,' but the preceding sentence in Scenario 1 says P and O must be from different distributions. Random division does not guarantee different distributions. Please clarify whether the datasets are randomly split or distributionally separated, since this affects the interpretation of the reference-model comparison.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: LBRM's membership signal is a ratio of losses from two independently trained models, and the reported AUROC is threshold-independent; the reference-parity requirement is an assumption, not a circular reduction.

full rationale

The LBRM algorithm computes R(x)=L_T(x)/L_R(x) using a target model T and an independently trained reference model R, then thresholds R to decide membership. This is an empirical statistic, not the definition of membership and not a fitted parameter: membership is defined by inclusion in the private dataset P, while R is constructed from the public dataset O (Section 5.1.5). The reported AUROC values are threshold-independent, so the threshold selection in Section 4.3 and the top-n operating point in Section 5.3.1 do not fit the target quantity. No load-bearing self-citations appear in the argument; all cited works are external background or architecture sources. The method does rely on the assumption that R has performance comparable to T (Sections 4.1, 5.2), but the paper states and tests this parity rather than smuggling it in through citation. There is an internal inconsistency between Section 5.1.4 Scenario 1 ('The target model T is trained only on the private dataset (P)') and Section 5.1.5 ('The models T are trained on the public dataset O combined with the private dataset P'), and the resulting distribution mismatch between O and P could confound the reference-model comparison. That concern is about experimental validity and threat-model realism, not about the derivation being equivalent to its inputs. Accordingly, no circular step can be exhibited, and the paper receives a non-circularity score of 0.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The ledger shows that the method rests on attacker capability assumptions rather than new mathematical content. The only explicit parameters are the threshold and the top-n percentile, both chosen post hoc. No new entities are postulated.

free parameters (2)

Threshold theta = mean(R(xtest)) + n x std(R(xtest)); n not specified
LBRM labels x as member when R(x) is below theta; the paper gives no principled method for choosing theta and claims the risk is independent of it without a supporting derivation.
Top n% cutoff = n = 25% in experiments
TPR@top25% requires the attacker to know the proportion of members in the queried set; the paper sets n=25% because the evaluation set is half private, half test.

assumptions (4)

domain assumption Reference model R and target model T must have comparable performance and architecture.
Stated as essential in Section 4.1 and verified only for the two in-house trained models in Section 5.2; real attackers may not be able to match a private model.
domain assumption A single masked unit and DTW loss produce a loss that is a valid membership signal.
The paper provides no formal or empirical justification that the DTW distance between imputed and original values is discriminative beyond the reported AUROC.
ad hoc to paper In Scenario 1 the public data O and private data P are from different distributions.
Section 5.1.4 asserts different distributions, but Section 5.1.5 says the datasets are split randomly from the same source, so the claim is internally inconsistent.
domain assumption The attacker knows the target architecture and hyperparameters.
Section 5.1.5 says the attacker trains using the same methodologies; this is a strong capability assumption for a black-box attack.

how reviews work

0 comments

Cite this review

Pith. "Pith review of A new membership inference attack that spots memorization in generative and predictive models: Loss-Based with Reference Model algorithm (LBRM)." pith.science (2026). https://pith.science/paper/CQXQWBG5

@misc{pith2026250503490,
  author       = {Pith},
  title        = {Pith review of: A new membership inference attack that spots memorization in generative and predictive models: Loss-Based with Reference Model algorithm (LBRM)},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CQXQWBG5}},
  note         = {Machine review of arXiv:2505.03490}
}

read the original abstract

Generative models can unintentionally memorize training data, posing significant privacy risks. This paper addresses the memorization phenomenon in time series imputation models, introducing the Loss-Based with Reference Model (LBRM) algorithm. The LBRM method leverages a reference model to enhance the accuracy of membership inference attacks, distinguishing between training and test data. Our contributions are twofold: first, we propose an innovative method to effectively extract and identify memorized training data, significantly improving detection accuracy. On average, without fine-tuning, the AUROC improved by approximately 40\%. With fine-tuning, the AUROC increased by approximately 60\%. Second, we validate our approach through membership inference attacks on two types of architectures designed for time series imputation, demonstrating the robustness and versatility of the LBRM approach in different contexts. These results highlight the significant enhancement in detection accuracy provided by the LBRM approach, addressing privacy risks in time series imputation models.

Figures

Figures reproduced from arXiv: 2505.03490 by the authors.

**Figure 2.** Result of the membership attack for scenario 2 (fine tuning) [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

15 extracted references · 2 canonical work pages

[4]

Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implications

URL http://arxiv.org/abs/2110.08760. arXiv:2110.08760 [cs]. Xinlei He, Rui Wen, Yixin Wu, Michael Backes, Yun Shen, and Yang Zhang. Node-Level Membership Inference Attacks Against Graph Neural Networks, February

work page Pith review arXiv
[5]

arXiv:2102.05429 [cs]

URL http://arxiv.org/abs/2102.05429. arXiv:2102.05429 [cs]. Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership Inference Attacks From First Principles, April 2022a. URL http://arxiv.org/abs/2112.03570. arXiv:2112.03570. Ryan Webster, Julien Rabin, Loic Simon, and Frederic Jurie. This Person (Probably) Ex...

arXiv
[6]

arXiv:2107.06018

URL http://arxiv.org/abs/2107.06018. arXiv:2107.06018. Iyiola E. Olatunji, Wolfgang Nejdl, and Megha Khosla. Membership Inference Attack on Graph Neural Networks, December

arXiv
[7]

Membership Inference Attack on Graph Neural Networks

URL http://arxiv.org/abs/2101.06570. arXiv:2101.06570. Minxing Zhang, Ning Yu, Rui Wen, Michael Backes, and Yang Zhang. Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Models. pages 4839–4849,

work page Pith review arXiv
[10]

arXiv:2302.13971

URL http: //arxiv.org/abs/2302.13971. arXiv:2302.13971. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, ...

arXiv
[11]

arXiv:2310.06825

URL http://arxiv.org/abs/2310.06825. arXiv:2310.06825. Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. Membership Inference Attacks by Exploiting Loss Trajectory, August

arXiv
[14]

doi:10.1016/j.eswa.2023.119619

ISSN 09574174. doi:10.1016/j.eswa.2023.119619. URL http: //arxiv.org/abs/2202.08516. arXiv:2202.08516 [cs]. Chun Fu, Matias Quintana, Zoltan Nagy, and Clayton Miller. Filling time-series gaps using image techniques: Multidimensional context autoencoder approach for building energy data imputation. Applied Thermal Engineering, 236:121545, January

arXiv 2023
[15]

doi:10.1016/j.applthermaleng.2023.121545

ISSN 1359-4311. doi:10.1016/j.applthermaleng.2023.121545. URL https://www. sciencedirect.com/science/article/pii/S1359431123015740. 10 LRBM approach for MIA A PREPRINT Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privac...

arXiv 2023

Show all 15 references

[2018]

arXiv:1705.07663

URL http://arxiv.org/abs/1705.07663. arXiv:1705.07663. Wenjie Du, David Cote, and Yan Liu. SAITS: Self-Attention-based Imputation for Time Series. Expert Systems with Applications , 219:119619, June

arXiv
[2019]

arXiv:1802.08232

URL http://arxiv.org/abs/1802.08232. arXiv:1802.08232. Hongbin Liu, Jinyuan Jia, Wenjie Qu, and Neil Zhenqiang Gong. EncoderMI: Membership Inference against Pre- trained Encoders in Contrastive Learning. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communic...

2021 arXiv
[2021]

ISBN 978-1-4503-8454-4

Association for Computing Machinery. ISBN 978-1-4503-8454-4. doi:10.1145/3460120.3484749. URL https://dl.acm.org/ doi/10.1145/3460120.3484749. Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Practical Membership Inference Attacks against Fine-tuned La...
[2022]

arXiv:2208.14933 [cs]

URL http://arxiv.org/abs/2208.14933. arXiv:2208.14933 [cs]. Benjamin Hilprecht, Martin Härterich, and Daniel Bernau. Monte Carlo and Reconstruction Membership Inference Attacks against Generative Models. volume 2019, July 2019a. doi:10.2478/popets-2019-0067. Benjamin Hilprecht...

2019 arXiv
[2023]

arXiv:2311.06062 [cs]

URL http: //arxiv.org/abs/2311.06062. arXiv:2311.06062 [cs]. Bang Wu, Xiangwen Yang, Shirui Pan, and Xingliang Yuan. Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implications, October

arXiv
[2024]

arXiv:2303.08774

URLhttp://arxiv.org/abs/2303.08774. arXiv:2303.08774. Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aurelien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume...

arXiv
[2025]

arXiv:2402.04059 [cs]

URL http: //arxiv.org/abs/2402.04059. arXiv:2402.04059 [cs]. OpenAI et al. GPT-4 Technical Report, March

arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [4]

Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implications

URL http://arxiv.org/abs/2110.08760. arXiv:2110.08760 [cs]. Xinlei He, Rui Wen, Yixin Wu, Michael Backes, Yun Shen, and Yang Zhang. Node-Level Membership Inference Attacks Against Graph Neural Networks, February

work page Pith review arXiv

[2] [5]

arXiv:2102.05429 [cs]

URL http://arxiv.org/abs/2102.05429. arXiv:2102.05429 [cs]. Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership Inference Attacks From First Principles, April 2022a. URL http://arxiv.org/abs/2112.03570. arXiv:2112.03570. Ryan Webster, Julien Rabin, Loic Simon, and Frederic Jurie. This Person (Probably) Ex...

arXiv

[3] [6]

arXiv:2107.06018

URL http://arxiv.org/abs/2107.06018. arXiv:2107.06018. Iyiola E. Olatunji, Wolfgang Nejdl, and Megha Khosla. Membership Inference Attack on Graph Neural Networks, December

arXiv

[4] [7]

Membership Inference Attack on Graph Neural Networks

URL http://arxiv.org/abs/2101.06570. arXiv:2101.06570. Minxing Zhang, Ning Yu, Rui Wen, Michael Backes, and Yang Zhang. Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Models. pages 4839–4849,

work page Pith review arXiv

[5] [10]

arXiv:2302.13971

URL http: //arxiv.org/abs/2302.13971. arXiv:2302.13971. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, ...

arXiv

[6] [11]

arXiv:2310.06825

URL http://arxiv.org/abs/2310.06825. arXiv:2310.06825. Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. Membership Inference Attacks by Exploiting Loss Trajectory, August

arXiv

[7] [14]

doi:10.1016/j.eswa.2023.119619

ISSN 09574174. doi:10.1016/j.eswa.2023.119619. URL http: //arxiv.org/abs/2202.08516. arXiv:2202.08516 [cs]. Chun Fu, Matias Quintana, Zoltan Nagy, and Clayton Miller. Filling time-series gaps using image techniques: Multidimensional context autoencoder approach for building energy data imputation. Applied Thermal Engineering, 236:121545, January

arXiv 2023

[8] [15]

doi:10.1016/j.applthermaleng.2023.121545

ISSN 1359-4311. doi:10.1016/j.applthermaleng.2023.121545. URL https://www. sciencedirect.com/science/article/pii/S1359431123015740. 10 LRBM approach for MIA A PREPRINT Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privac...

arXiv 2023