Data to 7 Oct 2026

ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models

arXiv 1806.01246 ↗First posted 4 Jun 2018cs.CR cs.AI cs.LGcited by 475

Not on the map. Why?

Cited by 225 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Machine learning (ML) has become a core component of many real-world applications and training data is a key factor that drives current progress. This huge success has led Internet companies to deploy machine learning as a service (MLaaS). Recently, the first membership inference attack has shown that extraction of information on the training set is possible in such MLaaS settings, which has severe security and privacy implications. However, the early demonstrations of the feasibility of such attacks have many assumptions on the adversary, such as using multiple so-called shadow models, knowledge of the target model structure, and having a dataset from the same distribution as the target model's training data. We relax all these key assumptions, thereby showing that such attacks are very broadly applicable at low cost and thereby pose a more severe risk than previously thought. We present the most comprehensive study so far on this emerging and developing threat using eight diverse datasets which show the viability of the proposed attacks across domains. In addition, we propose the first effective defense mechanisms against such broader class of membership inference attacks that maintain a high level of utility of the ML model.

Key facts. Cited by 475 papers in the map (data through 7 Oct 2026). First posted on arXiv 4 Jun 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 66; 2022: 95; 2023: 78; 2024: 87; 2025: 87; 2026: 62.

475 papers.

Sort:

By area:

2021Membership Inference Attacks From First Principlescited by 839
2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
2022A Survey of Machine Unlearningcited by 298
2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 237
2021Machine Unlearning of Features and Labelscited by 223
2022What Does it Mean for a Language Model to Preserve Privacy?cited by 194
2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
2022Dataset Distillation using Neural Feature Regressioncited by 177
2022Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attackscited by 168
2022Reconstructing Training Data with Informed Adversariescited by 143
2021On the Importance of Difficulty Calibration in Membership Inference Attackscited by 137
2023Are Diffusion Models Vulnerable to Membership Inference Attacks?cited by 135

38 more

2021Graph Unlearningcited by 129
2022Reconstructing Training Data from Trained Neural Networkscited by 129
2022Zero-Shot Machine Unlearningcited by 125
2021Decentralized Federated Averagingcited by 114
2023A Comprehensive Survey of Dataset Distillationcited by 114
2023Low-Cost High-Power Membership Inference Attackscited by 99
2023KGA: A General Machine Unlearning Framework Based on Knowledge Gap Alignmentcited by 94
2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 93
2021Does BERT Pretrained on Clinical Notes Reveal Sensitive Data?cited by 91
2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 90
2023Membership Inference Attacks against Diffusion Modelscited by 84
2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
2021Membership Inference Attack on Graph Neural Networkscited by 81
2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 80
2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Modelscited by 79
2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 73
2022Federated Unlearning with Knowledge Distillationcited by 70
2021EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learningcited by 68
2023Bag of Tricks for Training Data Extraction from Language Modelscited by 67
2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 66
2023Learning to Unlearn: Instance-wise Unlearning for Pre-trained Classifierscited by 66
2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecturecited by 63
2023Scalable Membership Inference Attacks via Quantile Regressioncited by 61
2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55
2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 54
2021Membership Inference Attacks Against Recommender Systemscited by 52
2021Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implicationscited by 50
2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
2023Prompt Stealing Attacks Against Text-to-Image Generation Modelscited by 48
2023Exposing the Fake: Effective Diffusion-Generated Images Detectioncited by 48
2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 47
2023Membership Inference of Diffusion Modelscited by 46
2021Survey: Leakage and Privacy at Inference Timecited by 44
2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 43
2022Bounding Training Data Reconstruction in Private (Deep) Learningcited by 43
2022Membership Inference Attacks and Defenses in Neural Network Pruningcited by 42
2023White-box Membership Inference Attacks against Diffusion Modelscited by 42
2021Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Aheadcited by 40

50 most cited of 475 All 475 (JSON)