mlsanityData to 14 Oct 2026

Membership Leakage in Label-Only Exposures

arXiv 2007.15528 ↗First posted 30 Jul 2020cs.LG cs.CR stat.MLcited by 168

Not on the map. Why?

Cited by 105 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Machine learning (ML) has been widely adopted in various privacy-critical applications, e.g., face recognition and medical image analysis. However, recent research has shown that ML models are vulnerable to attacks against their training data. Membership inference is one major attack in this domain: Given a data sample and model, an adversary aims to determine whether the sample is part of the model's training set. Existing membership inference attacks leverage the confidence scores returned by the model as their inputs (score-based attacks). However, these attacks can be easily mitigated if the model only exposes the predicted label, i.e., the final model decision. In this paper, we propose decision-based membership inference attacks and demonstrate that label-only exposures are also vulnerable to membership leakage. In particular, we develop two types of decision-based attacks, namely transfer attack, and boundary attack. Empirical evaluation shows that our decision-based attacks can achieve remarkable performance, and even outperform the previous score-based attacks in some cases. We further present new insights on the success of membership inference based on quantitative and qualitative analysis, i.e., member samples of a model are more distant to the model's decision boundary than non-member samples. Finally, we evaluate multiple defense mechanisms against our decision-based attacks and show that our two types of attacks can bypass most of these defenses.

Key facts. Cited by 168 papers in the map (data through 14 Oct 2026). First posted on arXiv 30 Jul 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 15; 2022: 42; 2023: 28; 2024: 36; 2025: 31; 2026: 16.

168 papers.

Sort:

By area:

  1. 2021Membership Inference Attacks From First Principlescited by 878
  2. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 321
  3. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 258
  4. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 248
  5. 2022Privacy for Free: How does Dataset Condensation Help Privacy?cited by 120
  6. 2023Low-Cost High-Power Membership Inference Attackscited by 107
  7. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 101
  8. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Modelscited by 85
  9. 2021EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learningcited by 73
  10. 2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 69
  11. 2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecturecited by 67
  12. 2023Learning to Unlearn: Instance-wise Unlearning for Pre-trained Classifierscited by 67
38 more
  1. 2023Scalable Membership Inference Attacks via Quantile Regressioncited by 65
  2. 2022Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attackscited by 60
  3. 2021Membership Inference Attacks Against Recommender Systemscited by 57
  4. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 56
  5. 2024A Survey of Graph Neural Networks in Real world: Imbalance, Noise, Privacy and OOD Challengescited by 54
  6. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 51
  7. 2023Prompt Stealing Attacks Against Text-to-Image Generation Modelscited by 51
  8. 2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
  9. 2024Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearningcited by 48
  10. 2023Membership Inference of Diffusion Modelscited by 46
  11. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 45
  12. 2022Membership Inference Attacks and Defenses in Neural Network Pruningcited by 45
  13. 2024Unified Gradient-Based Machine Unlearning with Remain Geometry Enhancementcited by 45
  14. 2024Membership Inference Attacks Against In-Context Learningcited by 43
  15. 2022Data Poisoning Attacks Against Multimodal Encoderscited by 41
  16. 2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 38
  17. 2025Towards Label-Only Membership Inference Attack against Pre-trained Large Language Modelscited by 37
  18. 2021Quantifying and Mitigating Privacy Risks of Contrastive Learningcited by 36
  19. 2021Membership Inference on Word Embedding and Beyondcited by 35
  20. 2022Robust and Resource-Efficient Data-Free Knowledge Distillation by Generative Pseudo Replaycited by 35
  21. 2022M^4I: Multi-modal Models Membership Inferencecited by 34
  22. 2022Amplifying Membership Exposure via Data Poisoningcited by 34
  23. 2021Property Inference Attacks Against GANscited by 33
  24. 2023Students Parrot Their Teachers: Membership Inference on Model Distillationcited by 33
  25. 2023Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Predictioncited by 29
  26. 2022One Parameter Defense -- Defending against Data Inference Attacks via Differential Privacycited by 27
  27. 2022Auditing Membership Leakages of Multi-Exit Networkscited by 27
  28. 2024PreCurious: How Innocent Pre-Trained Language Models Turn into Privacy Trapscited by 23
  29. 2024SeqMIA: Sequential-Metric Based Membership Inference Attackcited by 23
  30. 2023A Survey on Privacy in Graph Neural Networks: Attacks, Preservation, and Applicationscited by 22
  31. 2023Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Modelscited by 22
  32. 2023No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device MLcited by 21
  33. 2024Is Difficulty Calibration All We Need? Towards More Practical Membership Inference Attackscited by 21
  34. 2022Leveraging Adversarial Examples to Quantify Membership Information Leakagecited by 19
  35. 2022Label-Only Membership Inference Attack against Node-Level Graph Neural Networkscited by 19
  36. 2022Does CLIP Know My Face?cited by 19
  37. 2022Membership Inference Attacks and Generalization: A Causal Perspectivecited by 17
  38. 2024CDI: Copyrighted Data Identification in Diffusion Modelscited by 17

50 most cited of 168 All 168 (JSON)