mlsanityData to 7 Oct 2026

Revisiting Membership Inference Under Realistic Assumptions

arXiv 2005.10881 ↗First posted 21 May 2020cs.CR cs.LG stat.MLcited by 108

Not on the map. Why?

Cited by 64 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We study membership inference in settings where some of the assumptions typically used in previous research are relaxed. First, we consider skewed priors, to cover cases such as when only a small fraction of the candidate pool targeted by the adversary are actually members and develop a PPV-based metric suitable for this setting. This setting is more realistic than the balanced prior setting typically considered by researchers. Second, we consider adversaries that select inference thresholds according to their attack goals and develop a threshold selection procedure that improves inference attacks. Since previous inference attacks fail in imbalanced prior setting, we develop a new inference attack based on the intuition that inputs corresponding to training set members will be near a local minimum in the loss function, and show that an attack that combines this with thresholds on the per-instance loss can achieve high PPV even in settings where other attacks appear to be ineffective. Code for our experiments can be found here: https://github.com/bargavj/EvaluatingDPML.

Key facts. Cited by 108 papers in the map (data through 7 Oct 2026). First posted on arXiv 21 May 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 17; 2022: 22; 2023: 26; 2024: 21; 2025: 13; 2026: 9.

108 papers.

Sort:

By area:

  1. 2021Membership Inference Attacks From First Principlescited by 839
  2. 2023Extracting Training Data from Diffusion Modelscited by 723
  3. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  4. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  5. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 249
  6. 2022Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attackscited by 168
  7. 2023How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacycited by 150
  8. 2021On the Importance of Difficulty Calibration in Membership Inference Attackscited by 137
  9. 2023Low-Cost High-Power Membership Inference Attackscited by 99
  10. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  11. 2023Flocks of Stochastic Parrots: Differentially Private Prompt Learning for Large Language Modelscited by 80
  12. 2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 73
38 more
  1. 2021LinkTeller: Recovering Private Edges from Graph Neural Networks via Influence Analysiscited by 65
  2. 2024Blind Baselines Beat Membership Inference Attacks for Foundation Modelscited by 65
  3. 2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecturecited by 63
  4. 2023Scalable Membership Inference Attacks via Quantile Regressioncited by 61
  5. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 54
  6. 2022Are Attribute Inference Attacks Just Imputation?cited by 48
  7. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 47
  8. 2022Memorization in NLP Fine-tuning Methodscited by 43
  9. 2023SoK: Memorization in General-Purpose Large Language Modelscited by 36
  10. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Modelscited by 35
  11. 2021DP-SGD vs PATE: Which Has Less Disparate Impact on Model Accuracy?cited by 32
  12. 2023Students Parrot Their Teachers: Membership Inference on Model Distillationcited by 31
  13. 2024On the Privacy Risk of In-context Learningcited by 31
  14. 2021On the (In)Feasibility of Attribute Inference Attacks on Machine Learning Modelscited by 30
  15. 2022SNAP: Efficient Extraction of Private Properties with Poisoningcited by 29
  16. 2023Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Predictioncited by 26
  17. 2024Probing Language Models for Pre-training Data Detectioncited by 24
  18. 2021Efficient Differentially Private Secure Aggregation for Federated Learning via Hardness of Learning with Errorscited by 23
  19. 2023zkDL: Efficient Zero-Knowledge Proofs of Deep Learning Trainingcited by 20
  20. 2021Membership Inference Attacks on Deep Regression Models for Neuroimagingcited by 19
  21. 2022Deletion Inference, Reconstruction, and Compliance in Machine (Un)Learningcited by 19
  22. 2022Subject Membership Inference Attacks in Federated Learningcited by 18
  23. 2023Membership Inference Attacks on Diffusion Models via Quantile Regressioncited by 17
  24. 2022Bounding Membership Inferencecited by 14
  25. 2022On the Privacy Effect of Data Enhancement via the Lens of Memorizationcited by 14
  26. 2024The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscapecited by 13
  27. 2023Netflix and Forget: Efficient and Exact Machine Unlearning from Bi-linear Recommendationscited by 12
  28. 2021Bounding Information Leakage in Machine Learningcited by 11
  29. 2023MIST: Defending Against Membership Inference Attacks Through Membership-Invariant Subspace Trainingcited by 11
  30. 2025Unifying Re-Identification, Attribute Inference, and Data Reconstruction Risks in Differential Privacycited by 11
  31. 2021SHAPr: An Efficient and Versatile Membership Privacy Risk Metric for Machine Learningcited by 10
  32. 2024Range Membership Inference Attackscited by 10
  33. 2021SoK: Machine Learning Governancecited by 9
  34. 2021DP-UTIL: Comprehensive Utility Analysis of Differential Privacy in Machine Learningcited by 8
  35. 2022How to Combine Membership-Inference Attacks on Multiple Updated Modelscited by 8
  36. 2022How Does a Deep Learning Model Architecture Impact Its Privacy? A Comprehensive Study of Privacy Attacks on CNNs and Transformerscited by 8
  37. 2024Beyond the Calibration Point: Mechanism Comparison in Differential Privacycited by 8
  38. 2022Combing for Credentials: Active Pattern Extraction from Smart Replycited by 7

50 most cited of 108 All 108 (JSON)