mlsanityData to 7 Oct 2026

Understanding Membership Inferences on Well-Generalized Learning Models

arXiv 1802.04889 ↗First posted 13 Feb 2018cs.CR cs.LG stat.MLcited by 83

Not on the map. Why?

Cited by 46 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Membership Inference Attack (MIA) determines the presence of a record in a machine learning model's training data by querying the model. Prior work has shown that the attack is feasible when the model is overfitted to its training data or when the adversary controls the training algorithm. However, when the model is not overfitted and the adversary does not control the training algorithm, the threat is not well understood. In this paper, we report a study that discovers overfitting to be a sufficient but not a necessary condition for an MIA to succeed. More specifically, we demonstrate that even a well-generalized model contains vulnerable instances subject to a new generalized MIA (GMIA). In GMIA, we use novel techniques for selecting vulnerable instances and detecting their subtle influences ignored by overfitting metrics. Specifically, we successfully identify individual records with high precision in real-world datasets by querying black-box machine learning models. Further we show that a vulnerable record can even be indirectly attacked by querying other related records and existing generalization techniques are found to be less effective in protecting the vulnerable instances. Our findings sharpen the understanding of the fundamental cause of the problem: the unique influences the training instance may have on the model.

Key facts. Cited by 83 papers in the map (data through 7 Oct 2026). First posted on arXiv 13 Feb 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 14; 2022: 19; 2023: 14; 2024: 18; 2025: 12; 2026: 6.

83 papers.

Sort:

By area:

  1. 2023Detecting Pretraining Data from Large Language Modelscited by 375
  2. 2022Deduplicating Training Data Mitigates Privacy Risks in Language Modelscited by 309
  3. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  4. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 249
  5. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 237
  6. 2022Dataset Distillation using Neural Feature Regressioncited by 177
  7. 2021On the Importance of Difficulty Calibration in Membership Inference Attackscited by 137
  8. 2022Reconstructing Training Data from Trained Neural Networkscited by 129
  9. 2023A Comprehensive Survey of Dataset Distillationcited by 114
  10. 2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 73
  11. 2024DE-COP: Detecting Copyrighted Content in Language Models Training Datacited by 72
  12. 2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecturecited by 63
38 more
  1. 2023Scalable Membership Inference Attacks via Quantile Regressioncited by 61
  2. 2022Label-Only Model Inversion Attacks via Boundary Repulsioncited by 56
  3. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 54
  4. 2021Survey: Leakage and Privacy at Inference Timecited by 44
  5. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Modelscited by 35
  6. 2021Membership Inference on Word Embedding and Beyondcited by 34
  7. 2021Measuring Data Leakage in Machine-Learning Models with Fisher Informationcited by 31
  8. 2023Students Parrot Their Teachers: Membership Inference on Model Distillationcited by 31
  9. 2024Membership Inference Attacks against Large Vision-Language Modelscited by 31
  10. 2023Identifying and Mitigating Privacy Risks Stemming from Language Models: A Surveycited by 30
  11. 2025Membership Inference Attacks Against Vision-Language Modelscited by 26
  12. 2022On the (In)security of Peer-to-Peer Decentralized Machine Learningcited by 23
  13. 2023FedLPA: One-shot Federated Learning with Layer-Wise Posterior Aggregationcited by 22
  14. 2023Gaussian Membership Inference Privacycited by 20
  15. 2022Deletion Inference, Reconstruction, and Compliance in Machine (Un)Learningcited by 19
  16. 2022Membership Inference Attacks and Generalization: A Causal Perspectivecited by 17
  17. 2022Leveraging Adversarial Examples to Quantify Membership Information Leakagecited by 16
  18. 2022On the Privacy Properties of GAN-generated Samplescited by 16
  19. 2022Poisoning Attacks and Defenses on Artificial Intelligence: A Surveycited by 15
  20. 2022On the Privacy Effect of Data Enhancement via the Lens of Memorizationcited by 14
  21. 2024Contrastive Unlearning: A Contrastive Approach to Machine Unlearningcited by 14
  22. 2024Towards Black-Box Membership Inference Attack for Diffusion Modelscited by 14
  23. 2024Memorization in deep learning: A surveycited by 14
  24. 2021Bounding Information Leakage in Machine Learningcited by 11
  25. 2022Data Isotopes for Data Provenance in DNNscited by 11
  26. 2021DPlis: Boosting Utility of Differentially Private Deep Learning via Randomized Smoothingcited by 10
  27. 2021Accuracy-Privacy Trade-off in Deep Ensemble: A Membership Inference Perspectivecited by 10
  28. 2022Privacy Leakage in Text Classification: A Data Extraction Approachcited by 9
  29. 2022Similarity Distribution based Membership Inference Attack on Person Re-identificationcited by 8
  30. 2024Trained Without My Consent: Detecting Code Inclusion In Language Models Trained on Codecited by 8
  31. 2021Training Data Leakage Analysis in Language Modelscited by 7
  32. 2022Combing for Credentials: Active Pattern Extraction from Smart Replycited by 7
  33. 2021Knowledge Cross-Distillation for Membership Privacycited by 6
  34. 2023Deconstructing Classifiers: Towards A Data Reconstruction Attack Against Text Classification Modelscited by 6
  35. 2025Trustworthy Machine Learning via Memorization and the Granular Long-Tail: A Survey on Interactions, Tradeoffs, and Beyondcited by 6
  36. 2025Cascading and Proxy Membership Inference Attackscited by 6
  37. 2022l-Leaks: Membership Inference Attacks with Logitscited by 5
  38. 2024Order of Magnitude Speedups for LLM Membership Inferencecited by 5

50 most cited of 83 All 83 (JSON)