Data to 14 Oct 2026

Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference

arXiv 1906.11798 ↗First posted 27 Jun 2019cs.LG cs.CR stat.MLcited by 175

Not on the map. Why?

Cited by 96 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Membership inference (MI) attacks exploit the fact that machine learning algorithms sometimes leak information about their training data through the learned model. In this work, we study membership inference in the white-box setting in order to exploit the internals of a model, which have not been effectively utilized by previous work. Leveraging new insights about how overfitting occurs in deep neural networks, we show how a model's idiosyncratic use of features can provide evidence for membership to white-box attackers---even when the model's black-box behavior appears to generalize well---and demonstrate that this attack outperforms prior black-box methods. Taking the position that an effective attack should have the ability to provide confident positive inferences, we find that previous attacks do not often provide a meaningful basis for confidently inferring membership, whereas our attack can be effectively calibrated for high precision. Finally, we examine popular defenses against MI attacks, finding that (1) smaller generalization error is not sufficient to prevent attacks on real models, and (2) while small-ε-differential privacy reduces the attack's effectiveness, this often comes at a significant cost to the model's accuracy; and for larger ε that are sometimes used in practice (e.g., ε=16), the attack can achieve nearly the same accuracy as on the unprotected model.

Key facts. Cited by 175 papers in the map (data through 14 Oct 2026). First posted on arXiv 27 Jun 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 31; 2022: 39; 2023: 26; 2024: 39; 2025: 27; 2026: 13.

175 papers.

Sort:

By area:

2021Membership Inference Attacks From First Principlescited by 878
2023Detecting Pretraining Data from Large Language Modelscited by 387
2021Membership Inference Attacks on Machine Learning: A Surveycited by 321
2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 258
2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 248
2021Machine Unlearning of Features and Labelscited by 229
2021On the Importance of Difficulty Calibration in Membership Inference Attackscited by 147
2022The Privacy Onion Effect: Memorization is Relativecited by 136
2021Dataset Inference: Ownership Resolution in Machine Learningcited by 116
2023Low-Cost High-Power Membership Inference Attackscited by 107
2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 101
2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Modelscited by 85

38 more

2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 84
2024A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systemscited by 77
2022Do Language Models Plagiarize?cited by 73
2023Bag of Tricks for Training Data Extraction from Language Modelscited by 70
2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecturecited by 67
2024ReCaLL: Membership Inference via Relative Conditional Log-Likelihoodscited by 64
2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 59
2021Membership Inference Attacks Against Recommender Systemscited by 57
2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 56
2021Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implicationscited by 52
2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 51
2021Defending against Model Stealing via Verifying Embedded External Featurescited by 46
2022Membership Inference Attacks and Defenses in Neural Network Pruningcited by 45
2021Survey: Leakage and Privacy at Inference Timecited by 44
2024Membership Inference Attacks Against In-Context Learningcited by 43
2022Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queriescited by 40
2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 38
2023Practical Membership Inference Attacks Against Large-Scale Multi-Modal Models: A Pilot Studycited by 38
2025Towards Label-Only Membership Inference Attack against Pre-trained Large Language Modelscited by 37
2021Quantifying and Mitigating Privacy Risks of Contrastive Learningcited by 36
2021Leave-one-out Unfairnesscited by 36
2021Membership Inference on Word Embedding and Beyondcited by 35
2022Amplifying Membership Exposure via Data Poisoningcited by 34
2021Property Inference Attacks Against GANscited by 33
2024Membership Inference Attacks against Large Vision-Language Modelscited by 33
2024Membership Inference Attacks and Defenses in Federated Learning: A Surveycited by 31
2024Auditing f-Differential Privacy in One Runcited by 30
2023Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Predictioncited by 29
2023Achilles' Heels: Vulnerable Record Identification in Synthetic Data Publishingcited by 28
2022Understanding Rare Spurious Correlations in Neural Networkscited by 27
2022Auditing Membership Leakages of Multi-Exit Networkscited by 27
2023Privacy and Fairness in Federated Learning: on the Perspective of Trade-offcited by 26
2022Verifiable and Provably Secure Machine Unlearningcited by 25
2024Probing Language Models for Pre-training Data Detectioncited by 25
2021Selective Ensembles for Consistent Predictionscited by 23
2024SeqMIA: Sequential-Metric Based Membership Inference Attackcited by 23
2021Membership Inference Attacks on Deep Regression Models for Neuroimagingcited by 22
2021CAPE: Context-Aware Private Embeddings for Private Language Learningcited by 22

50 most cited of 175 All 175 (JSON)