mlsanityData to 7 Oct 2026

Towards Demystifying Membership Inference Attacks

arXiv 1807.09173 ↗First posted 28 Jun 2018cs.CRcited by 39

Not on the map. Why?

Abstract (arXiv)

Membership inference attacks seek to infer membership of individual training instances of a model to which an adversary has black-box access through a machine learning-as-a-service API. In providing an in-depth characterization of membership privacy risks against machine learning models, this paper presents a comprehensive study towards demystifying membership inference attacks from two complimentary perspectives. First, we provide a generalized formulation of the development of a black-box membership inference attack model. Second, we characterize the importance of model choice on model vulnerability through a systematic evaluation of a variety of machine learning models and model combinations using multiple datasets. Through formal analysis and empirical evidence from extensive experimentation, we characterize under what conditions a model may be vulnerable to such black-box membership inference attacks. We show that membership inference vulnerability is data-driven and corresponding attack models are largely transferable. Though different model types display different vulnerabilities to membership inference, so do different datasets. Our empirical results additionally show that (1) using the type of target model under attack within the attack model may not increase attack effectiveness and (2) collaborative learning exposes vulnerabilities to membership inference risks when the adversary is a participant. We also discuss countermeasure and mitigation strategies.

Key facts. Cited by 39 papers in the map (data through 7 Oct 2026). First posted on arXiv 28 Jun 2018.

Builds on

No reference list yet.

Built on by

Cited by year

Citing papers per year: 2021: 9; 2022: 13; 2023: 8; 2024: 5; 2025: 4.

39 papers.

Sort:

By area:

  1. 2021Membership Inference Attacks From First Principlescited by 839
  2. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  3. 2022Do Language Models Plagiarize?cited by 72
  4. 2023Practical Membership Inference Attacks Against Large-Scale Multi-Modal Models: A Pilot Studycited by 37
  5. 2021Membership Inference on Word Embedding and Beyondcited by 34
  6. 2021Source Inference Attacks in Federated Learningcited by 31
  7. 2022M^4I: Multi-modal Models Membership Inferencecited by 30
  8. 2021An Efficient DP-SGD Mechanism for Large Scale NLP Modelscited by 27
  9. 2025Membership Inference Attacks Against Vision-Language Modelscited by 26
  10. 2021CAPE: Context-Aware Private Embeddings for Private Language Learningcited by 22
  11. 2023FedLPA: One-shot Federated Learning with Layer-Wise Posterior Aggregationcited by 22
  12. 2021Property Inference Attacks on Convolutional Neural Networks: Influence and Implications of Target Model's Complexitycited by 19
27 more
  1. 2021Membership Inference Attacks on Deep Regression Models for Neuroimagingcited by 19
  2. 2022Membership Inference Attack Using Self Influence Functionscited by 19
  3. 2022Label-Only Membership Inference Attack against Node-Level Graph Neural Networkscited by 18
  4. 2024SoK: Reducing the Vulnerability of Fine-tuned Language Models to Membership Inference Attackscited by 10
  5. 2022Privacy Leakage in Text Classification: A Data Extraction Approachcited by 9
  6. 2021Training Data Leakage Analysis in Language Modelscited by 7
  7. 2022Combing for Credentials: Active Pattern Extraction from Smart Replycited by 7
  8. 2022MIAShield: Defending Membership Inference Attacks via Preemptive Exclusion of Memberscited by 6
  9. 2023Deconstructing Classifiers: Towards A Data Reconstruction Attack Against Text Classification Modelscited by 6
  10. 2022Collaborative Drug Discovery: Inference-level Data Protection Perspectivecited by 4
  11. 2023Gradient Leakage Defense with Key-Lock Module for Federated Learningcited by 4
  12. 2022NeuGuard: Lightweight Neuron-Guided Defense against Membership Inference Attackscited by 3
  13. 2022Towards Sparsified Federated Neuroimaging Models via Weight Pruningcited by 3
  14. 2023Security and Privacy Issues of Federated Learningcited by 2
  15. 2024Membership Inference Attack Against Masked Image Modelingcited by 2
  16. 2024Gradients Stand-in for Defending Deep Leakage in Federated Learningcited by 2
  17. 2025Are Neuro-Inspired Multi-Modal Vision-Language Models Resilient to Membership Inference Privacy Leakage?cited by 2
  18. 2022Data Provenance via Differential Auditingcited by 1
  19. 2023QMGeo: Differentially Private Federated Learning via Stochastic Quantization with Mixed Truncated Geometric Distributioncited by 1
  20. 2024Inference Attacks Against Face Recognition Model without Classification Layerscited by 1
  21. 2021PrivateMail: Supervised Manifold Learning of Deep Features With Differential Privacy for Image Retrievalcited by 0
  22. 2022Secure & Private Federated Neuroimagingcited by 0
  23. 2022Membership Inference Attacks Against Latent Factor Modelcited by 0
  24. 2023DP-SGD-Global-Adapt-V2-S: Triad Improvements of Privacy, Accuracy and Fairness via Step Decay Noise Multiplier and Step Decay Upper Clipping Thresholdcited by 0
  25. 2024Survey of Privacy Threats and Countermeasures in Federated Learningcited by 0
  26. 2025Find a Scapegoat: Poisoning Membership Inference Attack and Defense to Federated Learningcited by 0
  27. 2025The Hidden Cost of Modeling P(X): Vulnerability to Membership Inference Attacks in Generative Text Classifierscited by 0