# An Extension of Fano's Inequality for Characterizing Model Susceptibility to Membership Inference Attacks

arXiv: https://arxiv.org/abs/2009.08097 · HTML: https://mlsanity.com/paper/2009.08097/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Sep 2020.

## Built on by (most cited first, 5 of 5)

- [Membership Inference Attacks on Machine Learning: A Survey](https://mlsanity.com/paper/2103.07853/) (2021)
- [Membership Inference Attacks on Deep Regression Models for Neuroimaging](https://mlsanity.com/paper/2105.02866/) (2021)
- [Towards Sparsified Federated Neuroimaging Models via Weight Pruning](https://mlsanity.com/paper/2208.11669/) (2022)
- [Provable Privacy Attacks on Trained Shallow Neural Networks](https://mlsanity.com/paper/2410.07632/) (2024)
- [Secure & Private Federated Neuroimaging](https://mlsanity.com/paper/2205.05249/) (2022)

## Abstract (arXiv)

Deep neural networks have been shown to be vulnerable to membership inference attacks wherein the attacker aims to detect whether specific input data were used to train the model. These attacks can potentially leak private or proprietary data. We present a new extension of Fano's inequality and employ it to theoretically establish that the probability of success for a membership inference attack on a deep neural network can be bounded using the mutual information between its inputs and its activations. This enables the use of mutual information to measure the susceptibility of a DNN model to membership inference attacks. In our empirical evaluation, we show that the correlation between the mutual information and the susceptibility of the DNN model to membership inference attacks is 0.966, 0.996, and 0.955 for CIFAR-10, SVHN and GTSRB models, respectively.