mlsanityData to 7 Oct 2026

Reconstruction and Membership Inference Attacks against Generative Models

arXiv 1906.03006 ↗First posted 7 Jun 2019cs.CR cs.LGcited by 122

Not on the map. Why?

Cited by 59 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We present two information leakage attacks that outperform previous work on membership inference against generative models. The first attack allows membership inference without assumptions on the type of the generative model. Contrary to previous evaluation metrics for generative models, like Kernel Density Estimation, it only considers samples of the model which are close to training data records. The second attack specifically targets Variational Autoencoders, achieving high membership inference accuracy. Furthermore, previous work mostly considers membership inference adversaries who perform single record membership inference. We argue for considering regulatory actors who perform set membership inference to identify the use of specific datasets for training. The attacks are evaluated on two generative model architectures, Generative Adversarial Networks (GANs) and Variational Autoencoders (VAEs), trained on standard image datasets. Our results show that the two attacks yield success rates superior to previous work on most data sets while at the same time having only very mild assumptions. We envision the two attacks in combination with the membership inference attack type formalization as especially useful. For example, to enforce data privacy standards and automatically assessing model quality in machine learning as a service setups. In practice, our work motivates the use of GANs since they prove less vulnerable against information leakage attacks while producing detailed samples.

Key facts. Cited by 122 papers in the map (data through 7 Oct 2026). First posted on arXiv 7 Jun 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 10; 2022: 14; 2023: 34; 2024: 22; 2025: 24; 2026: 18.

122 papers.

Sort:

By area:

  1. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  2. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?cited by 135
  3. 2023Machine Learning for Synthetic Data Generation: A Reviewcited by 118
  4. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 93
  5. 2023Differentially Private Diffusion Models Generate Useful Synthetic Imagescited by 85
  6. 2023Membership Inference Attacks against Diffusion Modelscited by 84
  7. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Modelscited by 79
  8. 2023Bag of Tricks for Training Data Extraction from Language Modelscited by 67
  9. 2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 66
  10. 2023Membership Inference Attacks against Synthetic Data through Overfitting Detectioncited by 66
  11. 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initializationcited by 53
  12. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 47
38 more
  1. 2023Membership Inference of Diffusion Modelscited by 46
  2. 2023Evaluating Data Attribution for Text-to-Image Modelscited by 45
  3. 2021Survey: Leakage and Privacy at Inference Timecited by 44
  4. 2023White-box Membership Inference Attacks against Diffusion Modelscited by 42
  5. 2023SoK: Privacy-Preserving Data Synthesiscited by 37
  6. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Modelscited by 35
  7. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  8. 2024Membership Inference Attacks against Large Vision-Language Modelscited by 31
  9. 2023Beyond Privacy: Navigating the Opportunities and Challenges of Synthetic Datacited by 29
  10. 2023Traces of Memorisation in Large Language Models for Codecited by 26
  11. 2023A Linear Reconstruction Approach for Attribute Inference Attacks against Synthetic Datacited by 23
  12. 2023Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Modelscited by 22
  13. 2023A Survey of What to Share in Federated Learning: Perspectives on Model Utility, Privacy Leakage, and Communication Efficiencycited by 21
  14. 2025The Canary's Echo: Auditing Privacy Risks of LLM-Generated Synthetic Textcited by 18
  15. 2023A Probabilistic Fluctuation based Membership Inference Attack for Diffusion Modelscited by 17
  16. 2021Membership Inference Attacks are Easier on Difficult Problemscited by 16
  17. 2022On the Privacy Properties of GAN-generated Samplescited by 16
  18. 2023SLMIA-SR: Speaker-Level Membership Inference Attacks against Speaker Recognition Systemscited by 14
  19. 2023The Inadequacy of Similarity-based Privacy Metrics: Privacy Attacks against "Truly Anonymous" Synthetic Datasetscited by 14
  20. 2024Towards Black-Box Membership Inference Attack for Diffusion Modelscited by 14
  21. 2023Graphical vs. Deep Generative Models: Measuring the Impact of Differentially Private Mechanisms and Budgets on Utilitycited by 13
  22. 2021The Devil is in the GAN: Backdoor Attacks and Defenses in Deep Generative Modelscited by 12
  23. 2024Data Plagiarism Index: Characterizing the Privacy Risk of Data-Copying in Tabular Generative Modelscited by 12
  24. 2024The Elusive Pursuit of Reproducing PATE-GAN: Benchmarking, Auditing, Debuggingcited by 12
  25. 2025The DCR Delusion: Measuring the Privacy Risk of Synthetic Datacited by 11
  26. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacycited by 10
  27. 2023Generative Adversarial Networks Unlearningcited by 10
  28. 2024Range Membership Inference Attackscited by 10
  29. 2024Privacy Vulnerabilities in Marginals-based Synthetic Datacited by 10
  30. 2023An Empirical Analysis of Fairness Notions under Differential Privacycited by 9
  31. 2024Unveiling Structural Memorization: Structural Membership Inference Attack for Text-to-Image Diffusion Modelscited by 9
  32. 2021Model Extraction and Defenses on Generative Adversarial Networkscited by 8
  33. 2021On Utility and Privacy in Synthetic Genomic Datacited by 8
  34. 2022PPA: Preference Profiling Attack Against Federated Learningcited by 8
  35. 2022Faking feature importance: A cautionary tale on the use of differentially-private synthetic datacited by 8
  36. 2025Synthetic Tabular Data: Methods, Attacks and Defensescited by 8
  37. 2024Dataset Size Recovery from LoRA Weightscited by 7
  38. 2025Synthetic Data Privacy Metricscited by 7

50 most cited of 122 All 122 (JSON)