# Quantifying Membership Inference Vulnerability via Generalization Gap and Other Model Metrics

arXiv: https://arxiv.org/abs/2009.05669 · HTML: https://mlsanity.com/paper/2009.05669/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Sep 2020.

## Built on by (most cited first, 13 of 13)

- [Membership Inference Attacks on Machine Learning: A Survey](https://mlsanity.com/paper/2103.07853/) (2021)
- [Training Data Extraction From Pre-trained Language Models: A Survey](https://mlsanity.com/paper/2305.16157/) (2023)
- [Survey: Leakage and Privacy at Inference Time](https://mlsanity.com/paper/2107.01614/) (2021)
- [Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries](https://mlsanity.com/paper/2210.10750/) (2022)
- [Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models](https://mlsanity.com/paper/2404.01231/) (2024)
- [Can Watermarking Large Language Models Prevent Copyrighted Text Generation and Hide Training Data?](https://mlsanity.com/paper/2407.17417/) (2024)
- [LoRA-Leak: Membership Inference Attacks Against LoRA Fine-tuned Language Models](https://mlsanity.com/paper/2507.18302/) (2025)
- [SoK: Comparing Different Membership Inference Attacks with a Comprehensive Benchmark](https://mlsanity.com/paper/2307.06123/) (2023)
- [On the Privacy Risks of Deploying Recurrent Neural Networks in Machine Learning Models](https://mlsanity.com/paper/2110.03054/) (2021)
- [SoK: Memorisation in machine learning](https://mlsanity.com/paper/2311.03075/) (2023)
- [Privacy-Utility Trade-off in Data Publication: A Bilevel Optimization Framework with Curvature-Guided Perturbation](https://mlsanity.com/paper/2509.02048/) (2025)
- [Tiny, Hardware-Independent, Compression-based Classification](https://mlsanity.com/paper/2603.06359/) (2026)
- [A Unified Perspective on Adversarial Membership Manipulation in Vision Models](https://mlsanity.com/paper/2604.02780/) (2026)

## Abstract (arXiv)

We demonstrate how a target model's generalization gap leads directly to an effective deterministic black box membership inference attack (MIA). This provides an upper bound on how secure a model can be to MIA based on a simple metric. Moreover, this attack is shown to be optimal in the expected sense given access to only certain likely obtainable metrics regarding the network's training and performance. Experimentally, this attack is shown to be comparable in accuracy to state-of-art MIAs in many cases.