# Segmentations-Leak: Membership Inference Attacks and Defenses in Semantic Image Segmentation

arXiv: https://arxiv.org/abs/1912.09685 · HTML: https://mlsanity.com/paper/1912.09685/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Dec 2019.

## Built on by (most cited first, 30 of 32)

- [Membership Inference Attacks on Machine Learning: A Survey](https://mlsanity.com/paper/2103.07853/) (2021)
- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Bag of Tricks for Training Data Extraction from Language Models](https://mlsanity.com/paper/2302.04460/) (2023)
- [SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learning](https://mlsanity.com/paper/2212.10986/) (2022)
- [Survey: Leakage and Privacy at Inference Time](https://mlsanity.com/paper/2107.01614/) (2021)
- [Membership Inference on Word Embedding and Beyond](https://mlsanity.com/paper/2106.11384/) (2021)
- [Watermarking Text Data on Large Language Models for Dataset Copyright](https://mlsanity.com/paper/2305.13257/) (2023)
- [WEDGE: Web-Image Assisted Domain Generalization for Semantic Segmentation](https://mlsanity.com/paper/2109.14196/) (2021)
- [Membership Inference Attacks are Easier on Difficult Problems](https://mlsanity.com/paper/2102.07762/) (2021)
- [Semi-Leak: Membership Inference Attacks Against Semi-supervised Learning](https://mlsanity.com/paper/2207.12535/) (2022)
- [How Does a Deep Learning Model Architecture Impact Its Privacy? A Comprehensive Study of Privacy Attacks on CNNs and Transformers](https://mlsanity.com/paper/2210.11049/) (2022)
- [Real World Federated Learning with a Knowledge Distilled Transformer for Cardiac CT Imaging](https://mlsanity.com/paper/2407.07557/) (2024)
- [Synthetic Data Privacy Metrics](https://mlsanity.com/paper/2501.03941/) (2025)
- [VBLC: Visibility Boosting and Logit-Constraint Learning for Domain Adaptive Semantic Segmentation under Adverse Conditions](https://mlsanity.com/paper/2211.12256/) (2022)
- [Membership Inference Attacks Against Semantic Segmentation Models](https://mlsanity.com/paper/2212.01082/) (2022)
- [Knowledge Cross-Distillation for Membership Privacy](https://mlsanity.com/paper/2111.01363/) (2021)
- [Unsupervised Contrastive Domain Adaptation for Semantic Segmentation](https://mlsanity.com/paper/2204.08399/) (2022)
- [Shadow-Free Membership Inference Attacks: Recommender Systems Are More Vulnerable Than You Thought](https://mlsanity.com/paper/2405.07018/) (2024)
- [l-Leaks: Membership Inference Attacks with Logits](https://mlsanity.com/paper/2205.06469/) (2022)
- [Safety and Performance, Why Not Both? Bi-Objective Optimized Model Compression against Heterogeneous Attacks Toward AI Software Deployment](https://mlsanity.com/paper/2401.00996/) (2024)
- [What Sketch Explainability Really Means for Downstream Tasks](https://mlsanity.com/paper/2403.09480/) (2024)
- [Membership Inference Attacks on Lottery Ticket Networks](https://mlsanity.com/paper/2108.03506/) (2021)
- [On the Importance of Architecture and Feature Selection in Differentially Private Machine Learning](https://mlsanity.com/paper/2205.06720/) (2022)
- [SoK: Comparing Different Membership Inference Attacks with a Comprehensive Benchmark](https://mlsanity.com/paper/2307.06123/) (2023)
- [An Out-Of-Distribution Membership Inference Attack Approach for Cross-Domain Graph Attacks](https://mlsanity.com/paper/2505.20074/) (2025)
- [Auditing Data Provenance in Real-world Text-to-Image Diffusion Models for Privacy and Copyright Protection](https://mlsanity.com/paper/2506.11434/) (2025)
- [Membership Inference Attacks with False Discovery Rate Control](https://mlsanity.com/paper/2508.07066/) (2025)
- [The SAM2-to-SAM3 Gap in the Segment Anything Model Family: Why Prompt-Based Expertise Fails in Concept-Driven Image Segmentation](https://mlsanity.com/paper/2512.06032/) (2025)
- [Advancing Autonomous Driving System Testing: Demands, Challenges, and Future Directions](https://mlsanity.com/paper/2512.11887/) (2025)
- [Membership Privacy Protection for Image Translation Models via Adversarial Knowledge Distillation](https://mlsanity.com/paper/2203.05212/) (2022)

## Abstract (arXiv)

Today's success of state of the art methods for semantic segmentation is driven by large datasets. Data is considered an important asset that needs to be protected, as the collection and annotation of such datasets comes at significant efforts and associated costs. In addition, visual data might contain private or sensitive information, that makes it equally unsuited for public release. Unfortunately, recent work on membership inference in the broader area of adversarial machine learning and inference attacks on machine learning models has shown that even black box classifiers leak information on the dataset that they were trained on. We show that such membership inference attacks can be successfully carried out on complex, state of the art models for semantic segmentation. In order to mitigate the associated risks, we also study a series of defenses against such membership inference attacks and find effective counter measures against the existing risks with little effect on the utility of the segmentation method. Finally, we extensively evaluate our attacks and defenses on a range of relevant real-world datasets: Cityscapes, BDD100K, and Mapillary Vistas.