# Towards Measuring Membership Privacy

arXiv: https://arxiv.org/abs/1712.09136 · HTML: https://mlsanity.com/paper/1712.09136/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Dec 2017.

## Built on by (most cited first, 29 of 29)

- [Membership Inference Attacks From First Principles](https://mlsanity.com/paper/2112.03570/) (2021)
- [Membership Inference Attacks on Machine Learning: A Survey](https://mlsanity.com/paper/2103.07853/) (2021)
- [What Does it Mean for a Language Model to Preserve Privacy?](https://mlsanity.com/paper/2202.05520/) (2022)
- [Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attacks](https://mlsanity.com/paper/2203.03929/) (2022)
- [Practical Blind Membership Inference Attack via Differential Comparisons](https://mlsanity.com/paper/2101.01341/) (2021)
- [Survey: Leakage and Privacy at Inference Time](https://mlsanity.com/paper/2107.01614/) (2021)
- [Measuring Data Leakage in Machine-Learning Models with Fisher Information](https://mlsanity.com/paper/2102.11673/) (2021)
- [Membership Inference Attacks Against Vision-Language Models](https://mlsanity.com/paper/2501.18624/) (2025)
- [Deletion Inference, Reconstruction, and Compliance in Machine (Un)Learning](https://mlsanity.com/paper/2202.03460/) (2022)
- [Is Difficulty Calibration All We Need? Towards More Practical Membership Inference Attacks](https://mlsanity.com/paper/2409.00426/) (2024)
- [Individual Privacy Accounting for Differentially Private Stochastic Gradient Descent](https://mlsanity.com/paper/2206.02617/) (2022)
- [Leveraging Adversarial Examples to Quantify Membership Information Leakage](https://mlsanity.com/paper/2203.09566/) (2022)
- [Distribution inference risks: Identifying and mitigating sources of leakage](https://mlsanity.com/paper/2209.08541/) (2022)
- [Parameters or Privacy: A Provable Tradeoff Between Overparameterization and Membership Inference](https://mlsanity.com/paper/2202.01243/) (2022)
- [MIST: Defending Against Membership Inference Attacks Through Membership-Invariant Subspace Training](https://mlsanity.com/paper/2311.00919/) (2023)
- [Why Does Differential Privacy with Large Epsilon Defend Against Practical Membership Inference Attacks?](https://mlsanity.com/paper/2402.09540/) (2024)
- [Membership Inference Attacks on Knowledge Graphs](https://mlsanity.com/paper/2104.08273/) (2021)
- [Accuracy-Privacy Trade-off in Deep Ensemble: A Membership Inference Perspective](https://mlsanity.com/paper/2105.05381/) (2021)
- [SHAPr: An Efficient and Versatile Membership Privacy Risk Metric for Machine Learning](https://mlsanity.com/paper/2112.02230/) (2021)
- [Membership Inference Attacks Against Semantic Segmentation Models](https://mlsanity.com/paper/2212.01082/) (2022)
- [Rethinking Membership Inference Attacks Against Transfer Learning](https://mlsanity.com/paper/2501.11577/) (2025)
- [Provable Membership Inference Privacy](https://mlsanity.com/paper/2211.06582/) (2022)
- [Differentially-Private Data Synthetisation for Efficient Re-Identification Risk Control](https://mlsanity.com/paper/2212.00484/) (2022)
- [On the Discredibility of Membership Inference Attacks](https://mlsanity.com/paper/2212.02701/) (2022)
- [Membership Privacy Risks of Sharpness Aware Minimization](https://mlsanity.com/paper/2310.00488/) (2023)
- [Towards a Game-theoretic Understanding of Explanation-based Membership Inference Attacks](https://mlsanity.com/paper/2404.07139/) (2024)
- [On the Importance of Encrypting Deep Features](https://mlsanity.com/paper/2108.07147/) (2021)
- [LTU Attacker for Membership Inference](https://mlsanity.com/paper/2202.02278/) (2022)
- [Automated Privacy-Preserving Techniques via Meta-Learning](https://mlsanity.com/paper/2406.16456/) (2024)

## Abstract (arXiv)

Machine learning models are increasingly made available to the masses through public query interfaces. Recent academic work has demonstrated that malicious users who can query such models are able to infer sensitive information about records within the training data. Differential privacy can thwart such attacks, but not all models can be readily trained to achieve this guarantee or to achieve it with acceptable utility loss. As a result, if a model is trained without differential privacy guarantee, little is known or can be said about the privacy risk of releasing it. In this work, we investigate and analyze membership attacks to understand why and how they succeed. Based on this understanding, we propose Differential Training Privacy (DTP), an empirical metric to estimate the privacy risk of publishing a classier when methods such as differential privacy cannot be applied. DTP is a measure of a classier with respect to its training dataset, and we show that calculating DTP is efficient in many practical cases. We empirically validate DTP using state-of-the-art machine learning models such as neural networks trained on real-world datasets. Our results show that DTP is highly predictive of the success of membership attacks and therefore reducing DTP also reduces the privacy risk. We advocate for DTP to be used as part of the decision-making process when considering publishing a classifier. To this end, we also suggest adopting the DTP-1 hypothesis: if a classifier has a DTP value above 1, it should not be published.