mlsanityData to 14 Oct 2026

White-box vs Black-box: Bayes Optimal Strategies for Membership Inference

arXiv 1908.11229 ↗First posted 29 Aug 2019stat.ML cs.CR cs.LGcited by 271

Not on the map. Why?

Cited by 143 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Membership inference determines, given a sample and trained parameters of a machine learning model, whether the sample was part of the training set. In this paper, we derive the optimal strategy for membership inference with a few assumptions on the distribution of the parameters. We show that optimal attacks only depend on the loss function, and thus black-box attacks are as good as white-box attacks. As the optimal strategy is not tractable, we provide approximations of it leading to several inference methods, and show that existing membership inference methods are coarser approximations of this optimal strategy. Our membership attacks outperform the state of the art in various settings, ranging from a simple logistic regression to more complex architectures and datasets, such as ResNet-101 and Imagenet.

Key facts. Cited by 271 papers in the map (data through 14 Oct 2026). First posted on arXiv 29 Aug 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 31; 2022: 53; 2023: 41; 2024: 68; 2025: 49; 2026: 29.

271 papers.

Sort:

By area:

  1. 2021Membership Inference Attacks From First Principlescited by 878
  2. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 321
  3. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 258
  4. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 248
  5. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 195
  6. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 186
  7. 2021Counterfactual Memorization in Neural Language Modelscited by 156
  8. 2023How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacycited by 153
  9. 2021On the Importance of Difficulty Calibration in Membership Inference Attackscited by 147
  10. 2022The Privacy Onion Effect: Memorization is Relativecited by 136
  11. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?cited by 136
  12. 2022Privacy for Free: How does Dataset Condensation Help Privacy?cited by 120
38 more
  1. 2022Measuring Forgetting of Memorized Training Examplescited by 118
  2. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 116
  3. 2023Low-Cost High-Power Membership Inference Attackscited by 107
  4. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 101
  5. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 101
  6. 2021PPFL: Privacy-preserving Federated Learning with Trusted Execution Environmentscited by 93
  7. 2021Large Scale Private Learning via Low-rank Reparametrizationcited by 88
  8. 2021Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learningcited by 86
  9. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Modelscited by 85
  10. 2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 78
  11. 2021Self-Supervised Learning with Kernel Dependence Maximizationcited by 77
  12. 2021EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learningcited by 73
  13. 2023Bag of Tricks for Training Data Extraction from Language Modelscited by 70
  14. 2023Learning to Unlearn: Instance-wise Unlearning for Pre-trained Classifierscited by 67
  15. 2023Scalable Membership Inference Attacks via Quantile Regressioncited by 65
  16. 2025How much do language models memorize?cited by 61
  17. 2021Property Inference From Poisoningcited by 60
  18. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 59
  19. 2024Watermarking Makes Language Models Radioactivecited by 58
  20. 2021Membership Inference Attacks Against Recommender Systemscited by 57
  21. 2024Pretraining Data Detection for Large Language Models: A Divergence-based Calibration Methodcited by 55
  22. 2022Mixed Differential Privacy in Computer Visioncited by 54
  23. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 51
  24. 2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
  25. 2024Are we making progress in unlearning? Findings from the first NeurIPS unlearning competitioncited by 50
  26. 2023Exposing the Fake: Effective Diffusion-Generated Images Detectioncited by 48
  27. 2023Bounding Training Data Reconstruction in DP-SGDcited by 46
  28. 2021Survey: Leakage and Privacy at Inference Timecited by 44
  29. 2023GNNDelete: A General Strategy for Unlearning in Graph Neural Networkscited by 43
  30. 2023White-box Membership Inference Attacks against Diffusion Modelscited by 42
  31. 2022Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queriescited by 40
  32. 2025Exploring Criteria of Loss Reweighting to Enhance LLM Unlearningcited by 39
  33. 2024Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancycited by 38
  34. 2022RelaxLoss: Defending Membership Inference Attacks without Losing Utilitycited by 37
  35. 2023Learn to Unlearn for Deep Neural Networks: Minimizing Unlearning Interference with Gradient Projectioncited by 37
  36. 2024Copyright Traps for Large Language Modelscited by 37
  37. 2025Towards Label-Only Membership Inference Attack against Pre-trained Large Language Modelscited by 37
  38. 2023User Inference Attacks on Large Language Modelscited by 36

50 most cited of 271 All 271 (JSON)