mlsanityData to 7 Oct 2026

Membership Inference Attacks against Machine Learning Models

arXiv 1610.05820 ↗First posted 18 Oct 2016cs.CR cs.LG stat.MLcited by 2,221

Not on the map. Why?

Cited by 660 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We quantitatively investigate how machine learning models leak information about the individual data records on which they were trained. We focus on the basic membership inference attack: given a data record and black-box access to a model, determine if the record was in the model's training dataset. To perform membership inference against a target model, we make adversarial use of machine learning and train our own inference model to recognize differences in the target model's predictions on the inputs that it trained on versus the inputs that it did not train on. We empirically evaluate our inference techniques on classification models trained by commercial "machine learning as a service" providers such as Google and Amazon. Using realistic datasets and classification tasks, including a hospital discharge dataset whose membership is sensitive from the privacy perspective, we show that these models can be vulnerable to membership inference attacks. We then investigate the factors that influence this leakage and evaluate mitigation strategies.

Key facts. Cited by 2,221 papers in the map (data through 7 Oct 2026). First posted on arXiv 18 Oct 2016.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 254; 2022: 349; 2023: 370; 2024: 451; 2025: 449; 2026: 348.

2,221 papers.

Sort:

By area:

  1. 2022Red Teaming Language Models with Language Modelscited by 983
  2. 2021Membership Inference Attacks From First Principlescited by 839
  3. 2022Quantifying Memorization Across Neural Language Modelscited by 755
  4. 2023Extracting Training Data from Diffusion Modelscited by 723
  5. 2021Deduplicating Training Data Makes Language Models Bettercited by 705
  6. 2021Federated Learning on Non-IID Data Silos: An Experimental Studycited by 566
  7. 2024TOFU: A Task of Fictitious Unlearning for LLMscited by 507
  8. 2023LaMP: When Large Language Models Meet Personalizationcited by 425
  9. 2022Knowledge Unlearning for Mitigating Privacy Risks in Language Modelscited by 424
  10. 2021Large Language Models Can Be Strong Differentially Private Learnerscited by 405
  11. 2023Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defensecited by 401
  12. 2021Differentially Private Fine-tuning of Language Modelscited by 392
38 more
  1. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  2. 2023Detecting Pretraining Data from Large Language Modelscited by 375
  3. 2021Remember What You Want to Forget: Algorithms for Machine Unlearningcited by 360
  4. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  5. 2023Ablating Concepts in Text-to-Image Diffusion Modelscited by 312
  6. 2022Deduplicating Training Data Mitigates Privacy Risks in Language Modelscited by 309
  7. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  8. 2022A Survey of Machine Unlearningcited by 298
  9. 2021Unsolved Problems in ML Safetycited by 291
  10. 2023Large Language Model Unlearningcited by 288
  11. 2023Analyzing Leakage of Personally Identifiable Information in Language Modelscited by 278
  12. 2021Unrolling SGD: Understanding Factors Influencing Machine Unlearningcited by 274
  13. 2023Towards Unbounded Machine Unlearningcited by 261
  14. 2024MUSE: Machine Unlearning Six-Way Evaluation for Language Modelscited by 251
  15. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 249
  16. 2024Rethinking Machine Unlearning for Large Language Modelscited by 247
  17. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 237
  18. 2023Proving Test Set Contamination in Black Box Language Modelscited by 227
  19. 2021Machine Unlearning of Features and Labelscited by 223
  20. 2023In-Context Unlearning: Language Models as Few Shot Unlearnerscited by 214
  21. 2022What Does it Mean for a Language Model to Preserve Privacy?cited by 194
  22. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
  23. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  24. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 188
  25. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
  26. 2022Dataset Distillation using Neural Feature Regressioncited by 177
  27. 2023Fast Machine Unlearning Without Retraining Through Selective Synaptic Dampeningcited by 177
  28. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 175
  29. 2022Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attackscited by 168
  30. 2021Adaptive Machine Unlearningcited by 164
  31. 2021On the Necessity of Auditable Algorithmic Definitions for Machine Unlearningcited by 164
  32. 2023Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attackscited by 156
  33. 2021Counterfactual Memorization in Neural Language Modelscited by 155
  34. 2021A Unified Survey on Anomaly, Novelty, Open-Set, and Out-of-Distribution Detection: Solutions and Future Challengescited by 154
  35. 2022Reconstructing Training Data with Informed Adversariescited by 143
  36. 2024Benchmark Data Contamination of Large Language Models: A Surveycited by 138
  37. 2021On the Importance of Difficulty Calibration in Membership Inference Attackscited by 137
  38. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?cited by 135

50 most cited of 2,221 All 2,221 (JSON)