# Sampling Attacks: Amplification of Membership Inference Attacks by Repeated Queries

arXiv: https://arxiv.org/abs/2009.00395 · HTML: https://mlsanity.com/paper/2009.00395/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Sep 2020.

## Built on by (most cited first, 16 of 16)

- [Membership Inference Attacks From First Principles](https://mlsanity.com/paper/2112.03570/) (2021)
- [Membership Inference Attacks on Machine Learning: A Survey](https://mlsanity.com/paper/2103.07853/) (2021)
- [Membership Inference Attacks by Exploiting Loss Trajectory](https://mlsanity.com/paper/2208.14933/) (2022)
- [Fusion of Federated Learning and Industrial Internet of Things: A Survey](https://mlsanity.com/paper/2101.00798/) (2021)
- [Netflix and Forget: Efficient and Exact Machine Unlearning from Bi-linear Recommendations](https://mlsanity.com/paper/2302.06676/) (2023)
- [Accuracy-Privacy Trade-off in Deep Ensemble: A Membership Inference Perspective](https://mlsanity.com/paper/2105.05381/) (2021)
- [Membership Inference Attack and Defense for Wireless Signal Classifiers with Deep Learning](https://mlsanity.com/paper/2107.12173/) (2021)
- [l-Leaks: Membership Inference Attacks with Logits](https://mlsanity.com/paper/2205.06469/) (2022)
- [On the Discredibility of Membership Inference Attacks](https://mlsanity.com/paper/2212.02701/) (2022)
- [Accuracy-Privacy Trade-off in the Mitigation of Membership Inference Attack in Federated Learning](https://mlsanity.com/paper/2407.19119/) (2024)
- [Membership Inference Attacks Beyond Overfitting](https://mlsanity.com/paper/2511.16792/) (2025)
- [On Active Privacy Auditing in Supervised Fine-tuning for White-Box Language Models](https://mlsanity.com/paper/2411.07070/) (2024)
- [Ensemble Privacy Defense for Knowledge-Intensive LLMs against Membership Inference Attacks](https://mlsanity.com/paper/2512.03100/) (2025)
- [Inside the Black Box: Detecting Data Leakage in Pre-trained Language Encoders](https://mlsanity.com/paper/2408.11046/) (2024)
- [TDDBench: A Benchmark for Training data detection](https://mlsanity.com/paper/2411.03363/) (2024)
- [Neighborhood Blending: A Lightweight Inference-Time Defense Against Membership Inference Attacks](https://mlsanity.com/paper/2602.12943/) (2026)

## Abstract (arXiv)

Machine learning models have been shown to leak information violating the privacy of their training set. We focus on membership inference attacks on machine learning models which aim to determine whether a data point was used to train the victim model. Our work consists of two sides: We introduce sampling attack, a novel membership inference technique that unlike other standard membership adversaries is able to work under severe restriction of no access to scores of the victim model. We show that a victim model that only publishes the labels is still susceptible to sampling attacks and the adversary can recover up to 100% of its performance compared to when posterior vectors are provided. The other sides of our work includes experimental results on two recent membership inference attack models and the defenses against them. For defense, we choose differential privacy in the form of gradient perturbation during the training of the victim model as well as output perturbation at prediction time. We carry out our experiments on a wide range of datasets which allows us to better analyze the interaction between adversaries, defense mechanism and datasets. We find out that our proposed fast and easy-to-implement output perturbation technique offers good privacy protection for membership inference attacks at little impact on utility.