Membership Inference Attacks From First Principles

Research question

How should membership inference be evaluated and how strong can it be?

Key findings

Attacks should be judged by true-positive rate at low false-positive rates - The likelihood ratio attack (LiRA) is far stronger than prior average-case methods

Sources

arxiv.orghttps://arxiv.org/abs/2112.03570

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit research Report a correction or request removal

Related in Research Paper Library

CIG-MIA: Context-Induced Information Gain Membership Inference Attacks against Retrieval-Augmented Generation

Retrieval-augmented generation (RAG) systems ground large language models on external knowledge bases, enabling access to private, domain-specific, and up-to-date knowledge without retraining. However, the same…

Membership inference2026

Membership Inference via Pairwise Likelihood Ratios

Membership inference attacks (MIAs) are the standard tool for auditing the privacy risks of machine learning models. Given a query point, an MIA aims to determine whether that point was used to train the target…

Membership inference2026

Empirical Evaluation of Membership Inference Attacks on NLP Text Classifiers: A Baseline Study on SST-2

Membership inference attacks (MIAs) try to determine whether a specific record was used to train a model, a privacy risk that matters in natural language processing (NLP), where training data can contain sensitive…

Membership inference2026