# Performing Co-Membership Attacks Against Deep Generative Models

arXiv: https://arxiv.org/abs/1805.09898 · HTML: https://mlsanity.com/paper/1805.09898/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 May 2018.

## Built on by (most cited first, 26 of 26)

- [Membership Inference Attacks on Machine Learning: A Survey](https://mlsanity.com/paper/2103.07853/) (2021)
- [Membership Inference Attacks against Synthetic Data through Overfitting Detection](https://mlsanity.com/paper/2302.12580/) (2023)
- [Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancy](https://mlsanity.com/paper/2405.14800/) (2024)
- [M^4I: Multi-modal Models Membership Inference](https://mlsanity.com/paper/2209.06997/) (2022)
- [Membership Inference Attacks and Defenses in Federated Learning: A Survey](https://mlsanity.com/paper/2412.06157/) (2024)
- [Beyond Privacy: Navigating the Opportunities and Challenges of Synthetic Data](https://mlsanity.com/paper/2304.03722/) (2023)
- [This Person (Probably) Exists. Identity Membership Attacks Against GAN Generated Faces](https://mlsanity.com/paper/2107.06018/) (2021)
- [A Probabilistic Fluctuation based Membership Inference Attack for Diffusion Models](https://mlsanity.com/paper/2308.12143/) (2023)
- [Generative Adversarial Networks: A Survey Towards Private and Secure Applications](https://mlsanity.com/paper/2106.03785/) (2021)
- [Generative Adversarial Networks Unlearning](https://mlsanity.com/paper/2308.09881/) (2023)
- [Synthetic Data Privacy Metrics](https://mlsanity.com/paper/2501.03941/) (2025)
- [Knowledge Cross-Distillation for Membership Privacy](https://mlsanity.com/paper/2111.01363/) (2021)
- [Mitigating Privacy Risk in Membership Inference by Convex-Concave Loss](https://mlsanity.com/paper/2402.05453/) (2024)
- [l-Leaks: Membership Inference Attacks with Logits](https://mlsanity.com/paper/2205.06469/) (2022)
- [Model Will Tell: Training Membership Inference for Diffusion Models](https://mlsanity.com/paper/2403.08487/) (2024)
- [Privacy of Autonomous Vehicles: Risks, Protection Methods, and Future Directions](https://mlsanity.com/paper/2209.04022/) (2022)
- [Privacy-preserving Generative Framework Against Membership Inference Attacks](https://mlsanity.com/paper/2202.05469/) (2022)
- [NeuGuard: Lightweight Neuron-Guided Defense against Membership Inference Attacks](https://mlsanity.com/paper/2206.05565/) (2022)
- [Adversarial Robustness in Unsupervised Machine Learning: A Systematic Review](https://mlsanity.com/paper/2306.00687/) (2023)
- [SMA: Who Said That? Auditing Membership Leakage in Semi-Black-box RAG Controlling](https://mlsanity.com/paper/2508.09105/) (2025)
- [Preserving Privacy in GANs Against Membership Inference Attack](https://mlsanity.com/paper/2311.03172/) (2023)
- [Assessing Privacy Leakage in Synthetic 3-D PET Imaging using Transversal GAN](https://mlsanity.com/paper/2206.06448/) (2022)
- [SoK: Memorisation in machine learning](https://mlsanity.com/paper/2311.03075/) (2023)
- [Privacy Re-identification Attacks on Tabular GANs](https://mlsanity.com/paper/2404.00696/) (2024)
- [Bayes-Nash Generative Privacy Against Membership Inference Attacks](https://mlsanity.com/paper/2410.07414/) (2024)
- [Noise Aggregation Analysis Driven by Small-Noise Injection: Efficient Membership Inference for Diffusion Models](https://mlsanity.com/paper/2510.21783/) (2025)

## Abstract (arXiv)

In this paper we propose a new membership attack method called co-membership attacks against deep generative models including Variational Autoencoders (VAEs) and Generative Adversarial Networks (GANs). Specifically, membership attack aims to check whether a given instance x was used in the training data or not. A co-membership attack checks whether the given bundle of n instances were in the training, with the prior knowledge that the bundle was either entirely used in the training or none at all. Successful membership attacks can compromise the privacy of training data when the generative model is published. Our main idea is to cast membership inference of target data x as the optimization of another neural network (called the attacker network) to search for the latent encoding to reproduce x. The final reconstruction error is used directly to conclude whether x was in the training data or not. We conduct extensive experiments on a variety of datasets and generative models showing that: our attacker network outperforms prior membership attacks; co-membership attacks can be substantially more powerful than single attacks; and VAEs are more susceptible to membership attacks compared to GANs.