Pith. sign in

REVIEW 45 cited by

ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 1806.01246 v2 pith:7EQGDF6B submitted 2018-06-04 cs.CR cs.AIcs.LG

Ahmed Salem , Yang Zhang , Mathias Humbert , Pascal Berrang , Mario Fritz , Michael Backes This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords attacksmodeldatainferencelearningmachinemembershiptraining
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

Machine learning (ML) has become a core component of many real-world applications and training data is a key factor that drives current progress. This huge success has led Internet companies to deploy machine learning as a service (MLaaS). Recently, the first membership inference attack has shown that extraction of information on the training set is possible in such MLaaS settings, which has severe security and privacy implications. However, the early demonstrations of the feasibility of such attacks have many assumptions on the adversary, such as using multiple so-called shadow models, knowledge of the target model structure, and having a dataset from the same distribution as the target model's training data. We relax all these key assumptions, thereby showing that such attacks are very broadly applicable at low cost and thereby pose a more severe risk than previously thought. We present the most comprehensive study so far on this emerging and developing threat using eight diverse datasets which show the viability of the proposed attacks across domains. In addition, we propose the first effective defense mechanisms against such broader class of membership inference attacks that maintain a high level of utility of the ML model.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 45 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Cross-Flow Correlations Survive Synthesis: Measuring Source-Level Privacy Leakage in Synthetic Network Traces

    cs.CR 2025-08 conditional novelty 8.0 of 10

    Synthetic network generators preserve cross-flow correlations enabling source-level membership inference, shown via the TraceBleed attack across five datasets and six generators.

  2. High Accuracy and High Fidelity Extraction of Neural Networks

    cs.LG 2019-09 conditional novelty 8.0 of 10

    Given only prediction access, an adversary can exactly recover the weights of a two-layer ReLU network, and semi-supervised learning makes accuracy extraction far more query-efficient.

  3. ADS-C: Antidistillation Sampling for Classification

    cs.LG 2026-07 accept novelty 7.0 of 10

    ADS-C perturbs served classification probabilities under a per-input margin budget, preserving every top-1 prediction while degrading distilled students by 13–30 percentage points.

  4. Have You Ever Seen Them? Entity-level Membership Inference through Interrogating Large Language Models

    cs.CL 2026-06 unverdicted novelty 7.0 of 10

    Entity-level membership inference determines whether information about a target real-world entity was used in LLM training, using only black-box generated text and achieving AUC up to 0.97 on person entities.

  5. MRMMIA: Membership Inference Attacks on Memory in Chat Agents

    cs.CR 2026-05 unverdicted novelty 7.0 of 10

    MRMMIA is a multi-recall-probe membership inference attack that extracts signals from chat agent memory and outperforms baselines in black-, gray-, and white-box settings.

  6. Single-Sample Black-Box Membership Inference Attack against Vision-Language Models via Cross-modal Semantic Alignment

    cs.CV 2026-05 unverdicted novelty 7.0 of 10

    A cross-modal alignment attack achieves AUC 0.821 for single-sample black-box membership inference on VLMs such as LLaVA-1.5 by quantifying image-generated caption similarity.

  7. ReMIA: a Powerful and Efficient Alternative to Membership Inference Attacks against Synthetic Data Generators

    cs.LG 2026-05 unverdicted novelty 7.0 of 10

    ReMIA offers a practical privacy metric for synthetic data by training two generators and using a classifier to detect source dataset membership, achieving sensitivity comparable to standard MIAs with far less computation.

  8. DistractMIA: Black-Box Membership Inference on Vision-Language Models via Semantic Distraction

    cs.CV 2026-05 unverdicted novelty 7.0 of 10

    DistractMIA performs output-only black-box membership inference on vision-language models by inserting semantic distractors and measuring shifts in generated text responses.

  9. Revisiting Privacy Leakage in Machine Unlearning: Membership Inference Beyond the Forgotten Set

    cs.CR 2026-05 unverdicted novelty 7.0 of 10

    Unlearning increases privacy leakage for the retain set, and a new tri-class membership inference attack distinguishes forget, retain, and unseen data using pre- and post-unlearning model outputs.

  10. Noise Aggregation Analysis Driven by Small-Noise Injection: Efficient Membership Inference for Diffusion Models

    cs.CV 2025-10 unverdicted novelty 7.0 of 10

    Introduces noise aggregation analysis with single-step small-noise injection to enable efficient and accurate membership inference attacks on diffusion models.

  11. SoK: Can Synthetic Images Replace Real Data? A Survey of Utility and Privacy of Synthetic Image Generation

    cs.CR 2025-06 conditional novelty 7.0 of 10

    A systematic survey and benchmark showing that diffusion-based synthetic data can achieve better utility-privacy tradeoffs than DP-SGD on real data for some image classifiers, with the best release strategy depending ...

  12. Vid-SME: Membership Inference Attacks against Large Video Understanding Models

    cs.CV 2025-05 reject novelty 7.0 of 10

    Vid-SME computes Sharma-Mittal entropy differences between natural and reversed video frame sequences to infer training membership in video understanding LLMs, but its effectiveness is confounded by member/non-member ...

  13. Data Lineage Inference: Uncovering Privacy Vulnerabilities of Dataset Pruning

    cs.CR 2024-11 conditional novelty 7.0 of 10

    Data pruned before model training can be re-identified through a new class of membership inference attacks that run on datasets alone.

  14. Bayesian Membership Privacy for Graph Neural Networks

    cs.CR 2026-06 unverdicted novelty 6.0 of 10

    Introduces Bayesian Membership Privacy (BMP) as a sampling-aware node-level privacy definition for GNNs quantified by posterior membership probability, plus an auditing method and benchmark experiments.

  15. idSCD: Identifying Training Datasets through Semantic Correlation Descriptors

    cs.LG 2026-05 unverdicted novelty 6.0 of 10

    idSCD uses semantic correlation descriptors to perform dataset membership inference by comparing learned semantic structures, outperforming baselines in NLI, emotion, and medical text experiments.

  16. A Full-Pipeline Framework for Evaluating Membership Inference Attacks in Machine Learning

    cs.LG 2026-05 unverdicted novelty 6.0 of 10

    Presents a systematic framework for evaluating MIAs across the full ML pipeline with standardized threat models and complementary metrics for different cost scenarios.

  17. Mitigating Membership Inference in Intermediate Representations with Differentially Private Training

    cs.LG 2026-02 unverdicted novelty 6.0 of 10

    LM-DP-SGD estimates layer-specific MIA risks from shadow models and reweights gradients to give stronger protection to vulnerable layers, improving the privacy-utility trade-off over uniform DP-SGD.

  18. Impact of Graph Structure on Membership-Inference Risk for Graph Neural Networks

    cs.LG 2026-01 conditional novelty 6.0 of 10

    Graph construction and inference-time edge access modulate node-level membership-inference advantage in GNNs, and the generalization gap is an incomplete proxy.

  19. FiMMIA: scaling semantic perturbation-based membership inference across modalities

    cs.LG 2025-12 conditional novelty 6.0 of 10

    A perturbation-based membership inference framework for multimodal LLMs reports high AUC-ROC on fine-tuned image/video/audio models and shows that several existing MIA benchmarks are confounded by distribution shifts.

  20. Privacy-Utility Trade-off in Data Publication: A Bilevel Optimization Framework with Curvature-Guided Perturbation

    cs.LG 2025-09 conditional novelty 6.0 of 10

    A bilevel optimization framework with curvature-guided geodesic perturbation reduces membership inference attack success while preserving downstream classification accuracy and sample quality.

  21. Evaluating the Dynamics of Membership Privacy in Deep Learning

    cs.LG 2025-07 conditional novelty 6.0 of 10

    Per-sample membership vulnerability is established early in training, especially for hard-to-learn examples, and can be tracked on an FPR-TPR plane.

  22. Identifying Pre-training Data in LLMs: A Neuron Activation-Based Detection Framework

    cs.AI 2025-07 reject novelty 6.0 of 10

    NA-PDD detects pre-training data in LLMs by comparing which neurons activate for a test text against neurons linked to known training versus non-training texts, and claims large AUC improvements on three benchmarks.

  23. DeSIA: Attribute Inference Attacks Against Limited Fixed Aggregate Statistics

    cs.CR 2025-04 conditional novelty 6.0 of 10

    DeSIA infers sensitive attributes from limited fixed aggregate statistics by first checking whether a value is uniquely forced by the counts, then using a shadow-model classifier, outperforming reconstruction baseline...

  24. Has My System Prompt Been Used? Large Language Model Prompt Membership Inference

    cs.AI 2025-02 conditional novelty 6.0 of 10

    A permutation test on BERT embeddings of LLM outputs can detect, with statistical significance, when response distributions differ because a chat service uses a different system prompt than a candidate prompt.

  25. DocMIA: Document-Level Membership Inference Attacks against DocVQA Models

    cs.LG 2025-02 conditional novelty 6.0 of 10

    Document-level membership inference for DocVQA models is achieved by measuring parameter fine-tuning distance (and step count) per question-answer pair, in white-box and distilled black-box settings.

  26. CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Sampling

    cs.LG 2025-01 reject novelty 6.0 of 10

    CENSOR defends federated learning against gradient inversion by transmitting a loss-optimized random gradient orthogonal to the true gradient, but its security claim is not established against adaptive adversaries.

  27. Sub-optimal Learning in Meta-Classifier Attacks: A Study of Membership Inference on Differentially Private Location Aggregates

    cs.CR 2024-12 conditional novelty 6.0 of 10

    MLP-based membership inference attacks on DP location aggregates learn only a one-threshold rule, which underperforms under Laplace noise, and 200k training samples let them learn the better two-threshold rule.

  28. GraphTheft: Quantifying Privacy Risks in Graph Prompt Learning

    cs.CR 2024-11 conditional novelty 6.0 of 10

    An empirical study showing that graph prompt learning exposes node attributes and links to inference attacks, with prompt tuning adding little extra risk over frozen GNN baselines.

  29. Revisiting Privacy Amplification by Subsampling in Selective Release DPSGD

    cs.LG 2026-06 unverdicted novelty 5.0 of 10

    DPSR-CG corrects the privacy accounting for selective release in DPSGD by addressing sampling probability variation and reports strong empirical results on MNIST, CIFAR-10, IMDB, and FMNIST while claiming strict privacy.

  30. Membership Inference Attacks on Tokenizers of Large Language Models

    cs.CR 2025-10 conditional novelty 5.0 of 10

    Tokenizers leak dataset membership: using distinctive tokens that appear in a dataset's text, an attacker can detect with AUC up to 0.77 whether that dataset was part of tokenizer training.

  31. CompLeak: Deep Learning Model Compression Exacerbates Privacy Leakage

    cs.CR 2025-07 conditional novelty 5.0 of 10

    Compression of deep learning models can increase privacy leakage when multiple compressed versions are available to an attacker, and combining their outputs makes membership inference attacks much stronger.

  32. When Better Features Mean Greater Risks: The Performance-Privacy Trade-Off in Contrastive Learning

    cs.CR 2025-06 conditional novelty 5.0 of 10

    Membership inference against contrastive encoders is more accurate for larger frameworks and backbones, and a lightweight likelihood attack based on feature-vector p-norms matches or beats prior attacks with fewer queries.

  33. Privacy Leaks by Adversaries: Adversarial Iterations for Membership Inference Attack

    cs.CR 2025-06 conditional novelty 5.0 of 10

    Counting the iterations required to craft an adversarial example can reveal whether a sample was in the model's training set.

  34. An Out-Of-Distribution Membership Inference Attack Approach for Cross-Domain Graph Attacks

    cs.LG 2025-05 reject novelty 5.0 of 10

    GOOD-MIA combines invariant risk minimization, a graph information bottleneck, and risk extrapolation to run membership inference attacks against graph neural networks across different data domains.

  35. From Models to Network Topologies: A Topology Inference Attack in Decentralized Federated Learning

    cs.LG 2025-01 conditional novelty 5.0 of 10

    A topology inference attack on decentralized federated learning reconstructs the overlay network from pairwise model similarity, reaching F1 around 0.85 in supervised settings and 0.60 to 0.67 when no labels or datase...

  36. The Impact of Generalization Techniques on the Interplay Among Privacy, Utility, and Fairness in Image Classification

    cs.LG 2024-12 conditional novelty 5.0 of 10

    Combining DP-SAT with De et al.'s generalization techniques reaches 81.11% accuracy under (8, 10^-5)-DP on CIFAR-10, while amplifying bias on skewed datasets.

  37. DeMem: Privacy-Enhanced Robust Adversarial Learning via De-Memorization

    cs.LG 2024-12 conditional novelty 5.0 of 10

    Adding a loss-variance penalty to adversarial training reduces membership inference leakage on CIFAR-10/100 while keeping accuracy mostly intact.

  38. Membership Inference Attacks with False Discovery Rate Control

    stat.ML 2025-08 conditional novelty 4.0 of 10

    A post-hoc wrapper, MIAFdR, converts any membership inference attack scores into conformal p-values and applies a Benjamini-Hochberg correction, guaranteeing that the expected proportion of non-members among flagged m...

  39. AdaDPIGU: Differentially Private SGD with Adaptive Clipping and Importance-Based Gradient Updates for Deep Neural Networks

    cs.LG 2025-07 reject novelty 4.0 of 10

    A DP-SGD variant using top-60% gradient sparsification and coordinate-wise adaptive clipping is proposed; its privacy guarantee is not established for the actual algorithm because the mask comes from private data.

  40. LAPA-based Dynamic Privacy Optimization for Wireless Federated Learning in Heterogeneous Environments

    cs.LG 2025-05 reject novelty 4.0 of 10

    A new adaptive privacy allocation and transmission power control scheme for wireless FL is proposed, with a convergence bound and MNIST/Fashion-MNIST experiments, but the DP sensitivity calibration and noise-switch co...

  41. Securing Genomic Data Against Inference Attacks in Federated Learning Environments

    cs.CR 2025-05 conditional novelty 4.0 of 10

    In a synthetic federated learning setup with 100-SNP genomic data, a gradient-norm membership inference attack reached 0.87 F1-score, outperforming confidence-based membership inference and label inference attacks.

  42. Izhikevich-Inspired Temporal Dynamics for Enhancing Privacy, Efficiency, and Transferability in Spiking Neural Networks

    cs.NE 2025-05 conditional novelty 4.0 of 10

    Poisson-Burst and Delayed-Burst input encodings can lower membership-inference attack success in LIF spiking networks, with Poisson-Burst keeping accuracy close to rate coding.

  43. AdaMixup: A Dynamic Defense Framework for Membership Inference Attack Mitigation

    cs.LG 2025-01 conditional novelty 4.0 of 10

    AdaMixup cuts membership inference attack accuracy to near chance on MNIST, CIFAR-10, LFW, and STL-10 while preserving accuracy, as reported in its experiments.

  44. Federated Diffusion Modeling with Differential Privacy for Tabular Data Synthesis

    cs.LG 2024-12 reject novelty 4.0 of 10

    DP-FedTabDiff wraps an existing federated tabular diffusion model with per-client DP-SGD and reports how the privacy budget, number of clients, and local update count affect synthetic data quality and empirical privacy risk.

  45. Adversarial Attacks in Multimodal Systems: A Practitioner's Survey

    cs.LG 2025-05 conditional novelty 3.0 of 10

    A practitioner-oriented survey that categorizes adversarial attacks across text, image, video, and audio modalities in multimodal AI systems.

Pith tools