# Investigating Membership Inference Attacks under Data Dependencies

arXiv: https://arxiv.org/abs/2010.12112 · HTML: https://mlsanity.com/paper/2010.12112/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Oct 2020.

## Built on by (most cited first, 30 of 32)

- [Analyzing Leakage of Personally Identifiable Information in Language Models](https://mlsanity.com/paper/2302.00539/) (2023)
- [SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learning](https://mlsanity.com/paper/2212.10986/) (2022)
- [Bayesian Estimation of Differential Privacy](https://mlsanity.com/paper/2206.05199/) (2022)
- [Membership Inference Attacks and Defenses in Federated Learning: A Survey](https://mlsanity.com/paper/2412.06157/) (2024)
- [PreCurious: How Innocent Pre-Trained Language Models Turn into Privacy Traps](https://mlsanity.com/paper/2403.09562/) (2024)
- [Unifying Re-Identification, Attribute Inference, and Data Reconstruction Risks in Differential Privacy](https://mlsanity.com/paper/2507.06969/) (2025)
- [Conflicting Interactions Among Protection Mechanisms for Machine Learning Models](https://mlsanity.com/paper/2207.01991/) (2022)
- [On the Efficacy of Differentially Private Few-shot Image Classification](https://mlsanity.com/paper/2302.01190/) (2023)
- [Why Does Differential Privacy with Large Epsilon Defend Against Practical Membership Inference Attacks?](https://mlsanity.com/paper/2402.09540/) (2024)
- [Synthetic Data Privacy Metrics](https://mlsanity.com/paper/2501.03941/) (2025)
- [SoK: Unintended Interactions among Machine Learning Defenses and Risks](https://mlsanity.com/paper/2312.04542/) (2023)
- [Provable Membership Inference Privacy](https://mlsanity.com/paper/2211.06582/) (2022)
- [A Zero Auxiliary Knowledge Membership Inference Attack on Aggregate Location Data](https://mlsanity.com/paper/2406.18671/) (2024)
- [Some Targets Are Harder to Identify than Others: Quantifying the Target-dependent Membership Leakage](https://mlsanity.com/paper/2402.10065/) (2024)
- [R'enyi Pufferfish Privacy: General Additive Noise Mechanisms and Privacy Amplification by Iteration](https://mlsanity.com/paper/2312.13985/) (2023)
- [Closed-Form Bounds for DP-SGD against Record-level Inference](https://mlsanity.com/paper/2402.14397/) (2024)
- [Provable Privacy with Non-Private Pre-Processing](https://mlsanity.com/paper/2403.13041/) (2024)
- [Differentially Private Integrated Decision Gradients (IDG-DP) for Radar-based Human Activity Recognition](https://mlsanity.com/paper/2411.02099/) (2024)
- [A Unified Framework for Adversary-Aware Differential Privacy Bounds](https://mlsanity.com/paper/2507.08158/) (2025)
- [Understanding Disclosure Risk in Differential Privacy with Applications to Noise Calibration and Auditing (Extended Version)](https://mlsanity.com/paper/2603.12142/) (2026)
- [AnoFel: Supporting Anonymity for Privacy-Preserving Federated Learning](https://mlsanity.com/paper/2306.06825/) (2023)
- [Better Membership Inference Privacy Measurement through Discrepancy](https://mlsanity.com/paper/2405.15140/) (2024)
- [Evaluating Membership Inference Attacks in heterogeneous-data setups](https://mlsanity.com/paper/2502.18986/) (2025)
- [Impact of Graph Structure on Membership-Inference Risk for Graph Neural Networks](https://mlsanity.com/paper/2601.17130/) (2026)
- [Beyond Indistinguishability: Measuring Extraction Risk in LLM APIs](https://mlsanity.com/paper/2604.18697/) (2026)
- [Bayes-Nash Generative Privacy Against Membership Inference Attacks](https://mlsanity.com/paper/2410.07414/) (2024)
- [Private Linear Regression with Differential Privacy and PAC Privacy](https://mlsanity.com/paper/2412.02578/) (2024)
- [Black-Box Privacy Attacks on Shared Representations in Multitask Learning](https://mlsanity.com/paper/2506.16460/) (2025)
- [A Critical Review on the Effectiveness and Privacy Threats of Membership Inference Attacks](https://mlsanity.com/paper/2603.22987/) (2026)
- [On Privacy in Data-Space Tabular Diffusion Models: Influential Factors, Attacker Knowledge, and Metrics](https://mlsanity.com/paper/2605.06835/) (2026)

## Abstract (arXiv)

Training machine learning models on privacy-sensitive data has become a popular practice, driving innovation in ever-expanding fields. This has opened the door to new attacks that can have serious privacy implications. One such attack, the Membership Inference Attack (MIA), exposes whether or not a particular data point was used to train a model. A growing body of literature uses Differentially Private (DP) training algorithms as a defence against such attacks. However, these works evaluate the defence under the restrictive assumption that all members of the training set, as well as non-members, are independent and identically distributed. This assumption does not hold for many real-world use cases in the literature. Motivated by this, we evaluate membership inference with statistical dependencies among samples and explain why DP does not provide meaningful protection (the privacy parameter ε scales with the training set size n) in this more general case. We conduct a series of empirical evaluations with off-the-shelf MIAs using training sets built from real-world data showing different types of dependencies among samples. Our results reveal that training set dependencies can severely increase the performance of MIAs, and therefore assuming that data samples are statistically independent can significantly underestimate the performance of MIAs.