Pith. sign in

REVIEW 4 major objections 6 minor 43 references

CLMIA: Membership Inference Attacks via Unsupervised Contrastive Learning

T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Unsupervised contrastive learning on a model's output probabilities can expose which samples were in its training set.

desk verdict Contrastive learning for MIA is a real idea, but the paper's own numbers undercut its advertised advantage. read the letter →

arxiv 2411.11144 v1 pith:PQPJ5WXT submitted 2024-11-17 cs.LG cs.AIcs.CR

Depeng Chen , Xiao Liu , Jie Cui , Hong Zhong (School of Computer Science , Technology , Anhui University) This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords membershipinferenceattackcontrastivelearningblack-boxshadowmodeldropoutaugmentationposteriorprobabilitiesprivacyleakageNT-Xentloss
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that membership inference attacks—determining whether a specific sample was in a model's training set—can be built almost entirely without labeled member/non-member data. The proposed attack, CLMIA, trains a contrastive encoder on the target model's output probabilities alone, treating two dropout-perturbed posterior vectors of the same input as a positive pair and all other inputs in the batch as negatives. Only a small labeled dataset is used, to fine-tune a single MLP head. The authors report that this beats six existing attacks across three datasets and three model architectures, with the largest gains when labeled identity information is scarce. If true, it means an attacker with very little prior knowledge can still effectively probe a model's training set.

What carries the argument

The machinery is dropout-based positive-pair generation combined with a contrastive objective (NT-Xent, the normalized temperature-scaled cross-entropy loss) over posterior-derived features. Because the target model returns only one output per input, the attacker builds two shadow models with the same architecture as the target plus dropout layers at different rates, so the same sample yields two distinct posterior vectors treated as a positive pair; every other sample in the batch serves as a negative. Each posterior is augmented before contrastive training by concatenating its maximum probability and entropy, which injects the classic MIA signals into the learned representation. This contrastively pretrained encoder is then frozen and topped with a small MLP trained on a handful of labeled members/non-members.

What would settle it

Use a target model whose architecture is kept secret and train the CLMIA shadow models with a deliberately wrong architecture; if balanced accuracy then falls to the level of the best threshold baseline rather than the reported figures, the claimed advantage depends on architecture knowledge. Alternatively, run CLMIA against a target whose inference path disables dropout and returns deterministic posteriors; the positive-pair construction would produce identical views and the contrastive training would collapse.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that the membership signal in a model's posterior probabilities is learnable by unsupervised contrastive learning. CLMIA constructs an attack training set from an unlabeled target dataset: each sample's posterior vector is passed through two shadow models that share the target's architecture plus dropout layers, producing two positive views; the input feature is the raw posterior concatenated with its maximum value and entropy. Training with the NT-Xent loss pulls these pairs together and pushes different inputs apart, without any membership labels. The resulting encoder already separates members from non-members; a final MLP layer, trained on a small labeled set, turns the embedding into a membership decision. The paper claims this outperforms threshold-based, prediction-correctness, and shadow-model baselines, especially in the low false-positive regime and when labeled data are scarce.

Load-bearing premise

The method's core premise is that the attacker can build shadow models with the same architecture as the target and add dropout layers to generate paired outputs; if the attacker truly does not know the target's structure, as the paper's threat model states, this premise does not hold.

Editorial extensions

If this is right

  • Realistic attackers, who typically have far fewer labeled members than non-members, can mount effective MIAs rather than needing a large balanced labeled set.
  • The attack transfers across model architectures (CNN, VGG-19, ResNet-18) and datasets, so it is not tied to one target configuration.
  • In the low-FPR regime—where prior work says MIAs must be evaluated—CLMIA claims the best performance, meaning a small number of false positives can still yield true membership disclosures.
  • Attack accuracy depends on the ratio of labeled members to non-members, rising as the member share grows; this gives defenders a lever, such as making member data less identifiable.
  • Only a single additional MLP layer is tuned during supervised fine-tuning, so the attack remains cheap even after unsupervised pretraining.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The stated black-box threat model is not fully met: creating the shadow models requires knowing the target's architecture and inserting dropout, so the practical assumption is knowledge of the model family, not just its outputs.
  • The improvement over the 'only FC layer' baseline may come partly from the max/entropy feature augmentation rather than from contrastive learning per se; a non-contrastive encoder trained on the same augmented features would isolate the contribution.
  • The same dropout-positive-pair trick could be applied to label-only or decision-based queries, where the attacker sees only the predicted class; whether contrastive learning still separates members there is a testable extension.
  • If contrastive pretraining does encode membership from unlabeled posteriors, then simply observing a model's API outputs over time—without any labeled data—could let an attacker train a reusable membership probe for any similarly structured model.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes CLMIA, a membership inference attack that trains an attack model with unsupervised contrastive learning on posterior-probability vectors obtained from dropout-augmented shadow models, followed by supervised fine-tuning on a small labeled set. The authors claim that CLMIA outperforms existing MIAs across different datasets and model architectures, especially when little labeled identity information is available, and evaluate it on CIFAR-10, CIFAR-100, and STL-10 with CNN, VGG-19, and ResNet-18 target models.

Significance. If the central claims were supported, the paper would make a useful practical contribution by attacking models with very little labeled membership data, which is a realistic constraint. The experimental comparison against an 'Only FC layer' baseline (Table III) does suggest that contrastive pretraining adds value over using the fine-tuning head alone. However, the manuscript's own quantitative results contradict the headline claim of universal superiority over prior attacks, and the threat model is internally inconsistent. The core privacy contribution is therefore not established by the present experiments, although the underlying idea of contrastive learning on model posteriors may be worth further study.

major comments (4)
  1. [Abstract and Section IV-B, Table II and Table V] The abstract and Section IV-B claim that CLMIA 'performs better than existing attack methods for different datasets and model structures.' This is directly contradicted by the paper's own tables. In Table II, on CIFAR-100 with ResNet-18, the NN attack reaches balanced accuracy 0.970 and F1 0.970, while CLMIA reaches only 0.894 and 0.903, respectively. In Table V, on CIFAR-10 with VGG-19, prediction correctness reaches balanced accuracy 0.962 and F1 0.963, while CLMIA reaches 0.619 and 0.745, respectively. These are substantial gaps on exactly the dataset/model combinations the claim is meant to cover. The main claim of the paper is thus not supported by its own reported data.
  2. [Section III-A vs. Section III-C and Figure 2] The threat model in Section III-A states that the attacker does not know the structure of the target model and only has access to its posterior probabilities. However, the attack pipeline in Section III-C and Figure 2 requires training shadow models that have the same structure as the target model and that incorporate dropout layers with rates d1 and d2. Without knowledge of the target's architecture, the positive-pair generation via such shadow models cannot be implemented. This is an internal inconsistency in the core method. Additionally, the paper does not specify what data are used to train the shadow models; the stated attacker resources Dt and Dl do not obviously include an auxiliary dataset drawn from the target's training distribution, which is normally required for shadow models.
  3. [Algorithm 1 and Section III-C, positive-pair construction] The description of how the attack training features are built is ambiguous. Algorithm 1 line 3 indicates that two positive samples xi, xj are obtained from the two shadow models S+d1_1 and S+d2_2, but line 4 computes p* = p ⊕ max(p) ⊕ entropy(p) for a single p, without specifying whether p is xi, xj, or some other posterior vector. It is also unclear whether the attack model's contrastive loss operates on pairs of vectors (xi, xj) or on single vectors augmented with max and entropy features. This ambiguity prevents replication and obscures what exactly the contrastive learner sees.
  4. [Section IV-B and Figure 4, low-FPR and low-label claims] Section IV-B claims that CLMIA achieves the best performance 'in the low-FPR regime' across most scenarios, but no numeric TPR-at-low-FPR results are reported; ROC curves alone do not substantiate this. Likewise, the important secondary claim that CLMIA is especially effective when labeled identity information is scarce is supported only by Figure 4, which shows a single dataset/model combination (CIFAR-100, ResNet-18) with no error bars, no multiple runs, and no statistical test. These claims require more extensive evidence before they can be accepted.
minor comments (6)
  1. [Table II caption] The caption says additional results can be found in 'Section VIII-A', but the additional results are in the unnumbered Appendix A; the reference should be corrected.
  2. [Section IV-A, baselines] The name 'Lein et al.' for prediction correctness should be 'Leino et al.' (reference [21]).
  3. [Section III-C and Figure 2] The text says the adversary 'adds the dropout layer to the output of the last layer of the target model,' but the pipeline actually uses shadow models with dropout. This wording should be corrected to say the shadow models are augmented with dropout, not the target model itself.
  4. [Equation (3)] The notation S1 + d1 → S+d1_1 is confusing; it is not clear what the '+' operation means, and the subscript/superscript formatting makes it hard to read. A clearer definition of the shadow models is needed.
  5. [Experimental setup] The main tables do not report the size of the labeled set Dl used in the primary comparisons; Figure 4 uses specific sizes, but the reader cannot tell whether Table II and Table V use the same sizes. This should be stated explicitly.
  6. [Figure 2] The system model figure contains handwritten-style annotations such as '11,, nn xy xy' and is generally hard to read; a clean, typeset diagram would greatly improve clarity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: CLMIA's contrastive training and fine-tuning are not equivalent to the membership labels by construction, and no load-bearing self-citation chain is present.

full rationale

The derivation chain in Sections III-C through V is not circular. The attack representation p* is built from target-model posteriors (Eq. 4), the contrastive loss (Eq. 2) is applied to unlabeled posterior pairs, and membership labels enter only in the fine-tuning stage (Algorithm 2), where a single MLP head is trained on a small labeled set Dl. Thus the final membership prediction is not defined in terms of itself: the labels are external inputs, and the contrastive objective does not reduce to the membership loss by construction. The paper's reliance on shadow models with the same architecture as the target (Section III-C) conflicts with the black-box threat model stated in Section III-A ('does not know the structure of the target model'), but that is a threat-model inconsistency, not a circular derivation. The empirical claim that CLMIA 'performs better than existing attack methods' is also contradicted by the paper's own Table II (NN attack 0.970 vs CLMIA 0.894 on CIFAR-100/ResNet-18) and Table V (Prediction correctness 0.962 vs CLMIA 0.619 on CIFAR-10/VGG-19); however, an unsupported or refuted empirical claim is a correctness matter, not a circularity matter. There are no load-bearing self-citations: the only self-reference is the footnote identifying this as an extended version of an ACM CCS 2023 poster, and that footnote does not justify any technical step. The known contrastive-learning citations [6], [11] are used for standard loss and data-augmentation components, not to import an unverified uniqueness claim. Accordingly, no step in the paper is equivalent to its inputs by construction, and the appropriate circularity score is 0.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the availability of shadow models with the same architecture and on the validity of dropout-generated positive pairs. Neither is justified theoretically or empirically beyond the ablation results, and the shadow model requirement conflicts with the stated black-box assumption.

free parameters (2)
  • Dropout rates d1 and d2 for shadow models = 0.1 and 0.1 (for CIFAR-100/ResNet-18)
    Chosen via ablation study in Section V-C; used for the headline results without reporting selection on held-out data.
  • Temperature parameter tau in NT-Xent loss = 0.05
    Optimal value found via sweep in Section V-D; the reported main results use this value.
assumptions (4)
  • domain assumption Attacker knows the target model architecture and can train shadow models with the same structure.
    Section III-C describes training shadow models S1 and S2 with the same structure as the target, which requires architecture knowledge; Section III-A claims the attacker does not know the structure.
  • ad hoc to paper Dropout-augmented posteriors of the same input are valid positive pairs for contrastive learning.
    The design intuition in Section III-B assumes that two dropout versions of the same sample carry a shared membership signal, but no evidence is given that this holds for classifier posteriors.
  • domain assumption Member and non-member posterior distributions are distinguishable in the augmented feature space.
    This is the standard premise of all MIAs, supported by Figure 1, and is not specific to CLMIA.
  • domain assumption The unlabeled target dataset Dt can be used both for unsupervised pretraining and for the final membership evaluation without leakage.
    The evaluation in Section IV does not describe a held-out split for the attack model, so training and evaluation may use the same samples.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CLMIA: Membership Inference Attacks via Unsupervised Contrastive Learning." pith.science (2026). https://pith.science/paper/PQPJ5WXT

@misc{pith2026241111144,
  author       = {Pith},
  title        = {Pith review of: CLMIA: Membership Inference Attacks via Unsupervised Contrastive Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PQPJ5WXT}},
  note         = {Machine review of arXiv:2411.11144}
}
read the original abstract

Since machine learning model is often trained on a limited data set, the model is trained multiple times on the same data sample, which causes the model to memorize most of the training set data. Membership Inference Attacks (MIAs) exploit this feature to determine whether a data sample is used for training a machine learning model. However, in realistic scenarios, it is difficult for the adversary to obtain enough qualified samples that mark accurate identity information, especially since most samples are non-members in real world applications. To address this limitation, in this paper, we propose a new attack method called CLMIA, which uses unsupervised contrastive learning to train an attack model without using extra membership status information. Meanwhile, in CLMIA, we require only a small amount of data with known membership status to fine-tune the attack model. Experimental results demonstrate that CLMIA performs better than existing attack methods for different datasets and model structures, especially with data with less marked identity information. In addition, we experimentally find that the attack performs differently for different proportions of labeled identity information for member and non-member data. More analysis proves that our attack method performs better with less labeled identity information, which applies to more realistic scenarios.

Figures

Figures reproduced from arXiv: 2411.11144 by the authors.

Figure 1
Figure 1. (a) Maximum output value of the last layer of the target model. The first 5000 samples are members, and the last 5000 are non-members. (b) Information entropy of the posterior probabilities of the target model. [26], [33] have focused on improving attack methods through more fine-grained analysis or reducing the background knowl￾edge and computing power required to conduct an attack. Specifically, most of MIA method… view at source ↗
Figure 2
Figure 2. System Model of Our CLMIA Algorithm 1: Unsupervised training of attack models Input: fϑ, Dt, τ, ε, S+d1 1 , S+d2 2 Output: Aϑ 1 Preparing attack training dataset; 2 for x ∈ Dt do 3 S +d1 1 (x), S+d2 2 (x) → xi , xj → p; 4 p ∗ ← p ⊕ max(p) ⊕ entropy(p); 5 Da ← p ∗ + Da; 6 end 7 Training attack model; 8 for xi , xj ∈ Da do 9 zi , zj ← Aϑ(xi , xj ); 10 sim(zi , zj ) = z T i · zj/∥zi∥∥zj∥; 11 Li,j = − log P exp(sim(zi,z… view at source ↗
Figure 3
Figure 3. ROC curves for attacks on three different datasets and three model architectures (from top to bottom: Simple CNN, Resnet-18, VGG-19) 6 [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The effect of the size of the labeled dataset on the balanced accuracy in the CIFAR-100 dataset, with a model structure of Resnet-18. • Top1 threshold. Salem et al. [34] calculate the maxi￾mum value of the target model by its output posterior and judge it as a member i…
Figure 5
Figure 5. Figure 5: The performance of CLMIA and Only FC layer on the test dataset during training. Where (a) denotes performance on dataset CIFAR￾100 and model structure Resnet-18. (b) denotes performance on dataset CIFAR-100 and model structure VGG-19. A. Only FC Layer In this part, we …
Figure 6
Figure 6. Figure 6: Impact of different member and non-member data ratios on attack balance accuracy for the same label data size, where (a) has a label status data size of 600 and (b) is 800. the membership information in the whole training dataset. In a realistic scenario, the adversary…
Figure 8
Figure 8. Figure 8: Effect of different temperature coefficients τ in the Resnet-18 model structure The loss function, one of the most fundamental and critical elements of machine learning, is used to express the degree of disparity between predictions and actual data. In contrastive lear…
Figure 7
Figure 7. Figure 7: The impact of different dropout rates of the shadow model on the attack balance accuracy in CIFAR-100 dataset and model structure of Resnet-18, where p1 denotes the dropout used by shadow model S +d1 1 and p2 is the dropout rates used by shadow model S +d2 2 . In contr…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 26 canonical work pages

  1. [1]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 308–318

    2016

  2. [2]

    Membership inference attacks from first principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership inference attacks from first principles,” in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1897– 1914

    2022

  3. [3]

    The secret sharer: Evaluating and testing unintended memorization in neural net- works,

    N. Carlini, C. Liu, ´U. Erlingsson, J. Kos, and D. Song, “The secret sharer: Evaluating and testing unintended memorization in neural net- works,” in 28th USENIX Security Symposium (USENIX Security 19) , 2019, pp. 267–284

    work page 2019

  4. [4]

    Relaxloss: defending membership infer- ence attacks without losing utility,

    D. Chen, N. Yu, and M. Fritz, “Relaxloss: defending membership infer- ence attacks without losing utility,” arXiv preprint arXiv:2207.05801 , 2022

    arXiv 2022

  5. [5]

    Practical membership inference attack against collaborative inference in industrial iot,

    H. Chen, H. Li, G. Dong, M. Hao, G. Xu, X. Huang, and Z. Liu, “Practical membership inference attack against collaborative inference in industrial iot,” IEEE Transactions on Industrial Informatics , vol. 18, no. 1, pp. 477–487, 2020

    work page 2020

  6. [6]

    A simple framework for contrastive learning of visual representations,

    T. Chen, S. Kornblith, M. Norouzi, and G. Hinton, “A simple framework for contrastive learning of visual representations,” in International conference on machine learning . PMLR, 2020, pp. 1597–1607

    2020

  7. [7]

    Predicting future earnings changes using machine learning and detailed financial data,

    X. Chen, Y . H. Cho, Y . Dou, and B. Lev, “Predicting future earnings changes using machine learning and detailed financial data,” Journal of Accounting Research, vol. 60, no. 2, pp. 467–515, 2022

    work page 2022

  8. [8]

    Exploring simple siamese representation learning,

    X. Chen and K. He, “Exploring simple siamese representation learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2021, pp. 15 750–15 758

    work page 2021

Show all 43 references
  1. [9]

    Exploring simple siamese representation learning,

    ——, “Exploring simple siamese representation learning,” in Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 15 750–15 758

    2021

  2. [10]

    Leveraging adversarial examples to quantify membership information leakage,

    G. Del Grosso, H. Jalalzai, G. Pichler, C. Palamidessi, and P. Piantanida, “Leveraging adversarial examples to quantify membership information leakage,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 10 399–10 409

    2022

  3. [11]

    Simcse: Simple contrastive learning of sentence embeddings,

    T. Gao, X. Yao, and D. Chen, “Simcse: Simple contrastive learning of sentence embeddings,” in Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing , 2021, pp. 6894– 6910

    2021

  4. [12]

    Bootstrap your own latent-a new approach to self-supervised learning,

    J.-B. Grill, F. Strub, F. Altch ´e, C. Tallec, P. Richemond, E. Buchatskaya, C. Doersch, B. Avila Pires, Z. Guo, M. Gheshlaghi Azar et al. , “Bootstrap your own latent-a new approach to self-supervised learning,” Advances in neural information processing systems, vol. 33, pp. ...

    2020

  5. [13]

    Momentum contrast for unsupervised visual representation learning,

    K. He, H. Fan, Y . Wu, S. Xie, and R. Girshick, “Momentum contrast for unsupervised visual representation learning,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 9729–9738

    2020

  6. [14]

    Segmentations-leak: Membership inference attacks and defenses in semantic image segmen- tation,

    Y . He, S. Rahimian, B. Schiele, and M. Fritz, “Segmentations-leak: Membership inference attacks and defenses in semantic image segmen- tation,” in European Conference on Computer Vision . Springer, 2020, pp. 519–535

    2020

  7. [15]

    Mem- bership inference via backdooring,

    H. Hu, Z. Sal ˇci´c, G. Dobbie, J. Chen, L. Sun, and X. Zhang, “Mem- bership inference via backdooring,” in Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence , vol. 23, 2022, pp. 3832–3838

    2022

  8. [16]

    Practical blind membership inference attack via differential comparisons,

    B. Hui, Y . Yang, H. Yuan, P. Burlina, N. Z. Gong, and Y . Cao, “Practical blind membership inference attack via differential comparisons,” in ISOC Network and Distributed System Security Symposium (NDSS) , 2021

    2021

  9. [17]

    Demystifying the membership inference attack,

    P. Irolla and G. Ch ˆatel, “Demystifying the membership inference attack,” in 2019 12th CMI Conference on Cybersecurity and Privacy (CMI). IEEE, 2019, pp. 1–7

    2019

  10. [18]

    Memguard: Defending against black-box membership inference attacks via adver- sarial examples,

    J. Jia, A. Salem, M. Backes, Y . Zhang, and N. Z. Gong, “Memguard: Defending against black-box membership inference attacks via adver- sarial examples,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security , 2019, pp. 259–274

    2019

  11. [19]

    When does data augmentation help with membership inference attacks?

    Y . Kaya and T. Dumitras, “When does data augmentation help with membership inference attacks?” in International conference on machine learning. PMLR, 2021, pp. 5345–5355

    2021

  12. [20]

    On the effectiveness of reg- ularization against membership inference attacks,

    Y . Kaya, S. Hong, and T. Dumitras, “On the effectiveness of reg- ularization against membership inference attacks,” arXiv preprint arXiv:2006.05336, 2020

    2006 arXiv

  13. [21]

    Stolen memories: Leveraging model memorization for calibrated {White-Box} membership inference,

    K. Leino and M. Fredrikson, “Stolen memories: Leveraging model memorization for calibrated {White-Box} membership inference,” in 29th USENIX security symposium (USENIX Security 20) , 2020, pp. 1605–1622

    2020

  14. [22]

    User-level membership inference attack against metric embedding learning,

    G. Li, S. Rezaei, and X. Liu, “User-level membership inference attack against metric embedding learning,” arXiv preprint arXiv:2203.02077 , 2022

    2022 arXiv

  15. [23]

    Membership inference attacks and defenses in classification models,

    J. Li, N. Li, and B. Ribeiro, “Membership inference attacks and defenses in classification models,” in Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy , 2021, pp. 5–16

    2021

  16. [24]

    Membership leakage in label-only exposures,

    Z. Li and Y . Zhang, “Membership leakage in label-only exposures,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 880–895

    2021

  17. [25]

    Socinf: Membership inference attacks on social media health data with machine learning,

    G. Liu, C. Wang, K. Peng, H. Huang, Y . Li, and W. Cheng, “Socinf: Membership inference attacks on social media health data with machine learning,” IEEE Transactions on Computational Social Systems , vol. 6, no. 5, pp. 907–921, 2019

    2019

  18. [26]

    Membership inference attacks by exploiting loss trajectory,

    Y . Liu, Z. Zhao, M. Backes, and Y . Zhang, “Membership inference attacks by exploiting loss trajectory,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2085–2098

    2022

  19. [27]

    Membership inference attacks by exploiting loss trajectory,

    ——, “Membership inference attacks by exploiting loss trajectory,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’22. New York, NY , USA: Association for Computing Machinery, 2022, p. 2085–2098. [Online]. Available: https://...

    2022

  20. [28]

    Understanding membership inferences on well- generalized learning models,

    Y . Long, V . Bindschaedler, L. Wang, D. Bu, X. Wang, H. Tang, C. A. Gunter, and K. Chen, “Understanding membership inferences on well- generalized learning models,” arXiv preprint arXiv:1802.04889 , 2018

    2018 arXiv

  21. [29]

    The audio auditor: User-level membership inference in internet of things voice services,

    Y . Miao, M. Xue, C. Chen, L. Pan, J. Zhang, B. Z. H. Zhao, D. Kaafar, and Y . Xiang, “The audio auditor: User-level membership inference in internet of things voice services,” Proceedings on Privacy Enhancing Technologies, vol. 1, pp. 209–228, 2021

    2021

  22. [30]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in 2019 IEEE symposium on security and privacy (SP) . IEEE, 2019, pp. 739–753

    2019

  23. [31]

    Knock knock, who’s there? membership inference on aggregate location data,

    A. Pyrgelis, C. Troncoso, and E. De Cristofaro, “Knock knock, who’s there? membership inference on aggregate location data,” arXiv preprint arXiv:1708.06145, 2017

    2017 arXiv

  24. [32]

    Differential privacy defenses and sampling attacks for membership inference,

    S. Rahimian, T. Orekondy, and M. Fritz, “Differential privacy defenses and sampling attacks for membership inference,” in Proceedings of the 14th ACM Workshop on Artificial Intelligence and Security , 2021, pp. 193–202

    2021

  25. [33]

    White-box vs black-box: Bayes optimal strategies for membership inference,

    A. Sablayrolles, M. Douze, C. Schmid, Y . Ollivier, and H. J ´egou, “White-box vs black-box: Bayes optimal strategies for membership inference,” in International Conference on Machine Learning . PMLR, 2019, pp. 5558–5567

    2019

  26. [34]

    Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,

    A. Salem, Y . Zhang, M. Humbert, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” in Network and Distributed Systems Security Symposium 2019 . Internet Society, 2019

    2019

  27. [35]

    Evaluating the vulnerability of end-to-end automatic speech recogni- tion models to membership inference attacks

    M. A. Shah, J. Szurley, M. Mueller, A. Mouchtaris, and J. Droppo, “Evaluating the vulnerability of end-to-end automatic speech recogni- tion models to membership inference attacks.” in Interspeech, 2021, pp. 891–895

    2021

  28. [36]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18. 10

    2017

  29. [37]

    Systematic evaluation of privacy risks of ma- chine learning models,

    L. Song and P. Mittal, “Systematic evaluation of privacy risks of ma- chine learning models,” in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2615–2632

    2021

  30. [38]

    Privacy risks of securing machine learning models against adversarial examples,

    L. Song, R. Shokri, and P. Mittal, “Privacy risks of securing machine learning models against adversarial examples,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 241–257

    2019

  31. [39]

    Unsupervised feature learning via non-parametric instance discrimination,

    Z. Wu, Y . Xiong, S. X. Yu, and D. Lin, “Unsupervised feature learning via non-parametric instance discrimination,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 3733– 3742

    2018

  32. [40]

    Privacy risk in machine learning: Analyzing the connection to overfitting,

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in 2018 IEEE 31st computer security foundations symposium (CSF) . IEEE, 2018, pp. 268–282

    2018

  33. [41]

    Label-only membership inference attacks and defenses in semantic segmentation models,

    G. Zhang, B. Liu, T. Zhu, M. Ding, and W. Zhou, “Label-only membership inference attacks and defenses in semantic segmentation models,” IEEE Transactions on Dependable and Secure Computing , 2022

    2022

  34. [42]

    Membership inference attacks against recommender systems,

    M. Zhang, Z. Ren, Z. Wang, P. Ren, Z. Chen, P. Hu, and Y . Zhang, “Membership inference attacks against recommender systems,” in Pro- ceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 864–879

    2021

  35. [43]

    Membership inference attacks against synthetic health data,

    Z. Zhang, C. Yan, and B. A. Malin, “Membership inference attacks against synthetic health data,” Journal of biomedical informatics , vol. 125, p. 103977, 2022. 11 APPENDIX A. Additional Results on Different Models TABLE IV . ATTACK PERFORMANCE OF DIFFERENT ATTACKS AGAINST SIMP...

    2022

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.