# Membership Inference Attacks and Defenses in Classification Models

arXiv: https://arxiv.org/abs/2002.12062 · HTML: https://mlsanity.com/paper/2002.12062/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Feb 2020.

## Built on by (most cited first, 16 of 16)

- [Membership Inference Attacks on Machine Learning: A Survey](https://mlsanity.com/paper/2103.07853/) (2021)
- [Practical Blind Membership Inference Attack via Differential Comparisons](https://mlsanity.com/paper/2101.01341/) (2021)
- [Privacy-Preserving Machine Learning: Methods, Challenges and Directions](https://mlsanity.com/paper/2108.04417/) (2021)
- [Membership Inference Attacks and Defenses in Federated Learning: A Survey](https://mlsanity.com/paper/2412.06157/) (2024)
- [Membership Inference Attacks Against Vision-Language Models](https://mlsanity.com/paper/2501.18624/) (2025)
- [Membership Inference Attack Using Self Influence Functions](https://mlsanity.com/paper/2205.13680/) (2022)
- [Membership Inference Attacks on Knowledge Graphs](https://mlsanity.com/paper/2104.08273/) (2021)
- [Defending Medical Image Diagnostics against Privacy Attacks using Generative Methods](https://mlsanity.com/paper/2103.03078/) (2021)
- [Similarity Distribution based Membership Inference Attack on Person Re-identification](https://mlsanity.com/paper/2211.15918/) (2022)
- [A Review of Confidentiality Threats Against Embedded Neural Network Models](https://mlsanity.com/paper/2105.01401/) (2021)
- [Differentially Private Clustered Federated Learning](https://mlsanity.com/paper/2405.19272/) (2024)
- [SoK: Comparing Different Membership Inference Attacks with a Comprehensive Benchmark](https://mlsanity.com/paper/2307.06123/) (2023)
- [PrivatEyes: Appearance-based Gaze Estimation Using Federated Secure Multi-Party Computation](https://mlsanity.com/paper/2402.18970/) (2024)
- [Are Neuro-Inspired Multi-Modal Vision-Language Models Resilient to Membership Inference Privacy Leakage?](https://mlsanity.com/paper/2511.20710/) (2025)
- [EdgeLeakage: Membership Information Leakage in Distributed Edge Intelligence Systems](https://mlsanity.com/paper/2404.16851/) (2024)
- [Unraveling Attacks in Machine Learning-based IoT Ecosystems: A Survey and the Open Libraries Behind Them](https://mlsanity.com/paper/2401.11723/) (2024)

## Abstract (arXiv)

We study the membership inference (MI) attack against classifiers, where the attacker's goal is to determine whether a data instance was used for training the classifier. Through systematic cataloging of existing MI attacks and extensive experimental evaluations of them, we find that a model's vulnerability to MI attacks is tightly related to the generalization gap -- the difference between training accuracy and test accuracy. We then propose a defense against MI attacks that aims to close the gap by intentionally reduces the training accuracy. More specifically, the training process attempts to match the training and validation accuracies, by means of a new em set regularizer using the Maximum Mean Discrepancy between the softmax output empirical distributions of the training and validation sets. Our experimental results show that combining this approach with another simple defense (mix-up training) significantly improves state-of-the-art defense against MI attacks, with minimal impact on testing accuracy.