mlsanityData to 7 Oct 2026

Membership Inference Attacks are Easier on Difficult Problems

arXiv 2102.07762 ↗First posted 15 Feb 2021cs.LG cs.CRcited by 16

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Membership inference attacks (MIA) try to detect if data samples were used to train a neural network model, e.g. to detect copyright abuses. We show that models with higher dimensional input and output are more vulnerable to MIA, and address in more detail models for image translation and semantic segmentation, including medical image segmentation. We show that reconstruction-errors can lead to very effective MIA attacks as they are indicative of memorization. Unfortunately, reconstruction error alone is less effective at discriminating between non-predictable images used in training and easy to predict images that were never seen before. To overcome this, we propose using a novel predictability error that can be computed for each sample, and its computation does not require a training set. Our membership error, obtained by subtracting the predictability error from the reconstruction error, is shown to achieve high MIA accuracy on an extensive number of benchmarks.

Key facts. Cited by 16 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 36 of its 53 references that are in the map. First posted on arXiv 15 Feb 2021.

Builds on

36 of 53 references.

References · 36

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2016Image-to-Image Translation with Conditional Adversarial Networkscited by 4,510
  3. 2016The Cityscapes Dataset for Semantic Urban Scene Understandingcited by 4,427
  4. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  5. 2016Wide Residual Networkscited by 3,057
  6. 2016Deep Learning with Differential Privacycited by 2,682
  7. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  8. 2019Semantic Image Synthesis with Spatially-Adaptive Normalizationcited by 1,295
  9. 2018Unified Perceptual Parsing for Scene Understandingcited by 1,265
  10. 2017High-Resolution Image Synthesis and Semantic Manipulation with Conditional GANscited by 1,176
  11. 2017StarGAN: Unified Generative Adversarial Networks for Multi-Domain Image-to-Image Translationcited by 1,036
  12. 2020Image Segmentation Using Deep Learning: A Surveycited by 659
24 more
  1. 2020NVAE: A Deep Hierarchical Variational Autoencodercited by 635
  2. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  3. 2017Unsupervised Image-to-Image Translation Networkscited by 602
  4. 2019Kvasir-SEG: A Segmented Polyp Datasetcited by 588
  5. 2017How far are we from solving the 2D & 3D Face Alignment problem? (and a dataset of 230,000 3D facial landmarks)cited by 524
  6. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  7. 2020PraNet: Parallel Reverse Attention Network for Polyp Segmentationcited by 460
  8. 2020Label-Only Membership Inference Attackscited by 371
  9. 2017Toward Multimodal Image-to-Image Translationcited by 295
  10. 2019On The Power of Curriculum Learning in Training Deep Networkscited by 285
  11. 2017Learning to Discover Cross-Domain Relations with Generative Adversarial Networkscited by 278
  12. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  13. 2016A Benchmark for Endoluminal Scene Segmentation of Colonoscopy Imagescited by 220
  14. 2019High-Resolution Representations for Labeling Pixels and Regionscited by 211
  15. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  16. 2020Inf-Net: Automatic COVID-19 Lung Infection Segmentation from CT Imagescited by 184
  17. 2014Return of the Devil in the Details: Delving Deep into Convolutional Netscited by 122
  18. 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
  19. 2018Stealing Hyperparameters in Machine Learningcited by 115
  20. 2019Adversarial Examples Are a Natural Consequence of Test Error in Noisecited by 114
  21. 2017How hard can it be? Estimating the difficulty of visual search in an imagecited by 52
  22. 2018Recent progress in semantic image segmentationcited by 39
  23. 2019Segmentations-Leak: Membership Inference Attacks and Defenses in Semantic Image Segmentationcited by 29
  24. 2019GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Modelscited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 3; 2023: 1; 2024: 6; 2025: 5; 2026: 1.

16 papers.

Sort:

By area:

  1. 2024LLM Dataset Inference: Did you train on my dataset?cited by 107
  2. 2024Verification of Machine Unlearning is Fragilecited by 20
  3. 2022Leveraging Adversarial Examples to Quantify Membership Information Leakagecited by 16
  4. 2024Recovering the Pre-Fine-Tuning Weights of Generative Modelscited by 15
  5. 2024Is My Data in Your AI? Membership Inference Test (MINT) applied to Face Biometricscited by 12
  6. 2024Model Inversion Robustness: Can Transfer Learning Help?cited by 11
  7. 2024Dataset Size Recovery from LoRA Weightscited by 7
  8. 2025MIA-EPT: Membership Inference Attack via Error Prediction for Tabular Datacited by 4
  9. 2026Benchmarking Empirical Privacy Protection for Adaptations of Large Language Modelscited by 4
  10. 2022FedComm: Federated Learning as a Medium for Covert Communicationcited by 3
  11. 2025Membership Inference Attacks with False Discovery Rate Controlcited by 2
  12. 2025Active Membership Inference Test (aMINT): Enhancing Model Auditability with Multi-Task Learningcited by 2
4 more
  1. 2023The Adversarial Implications of Variable-Time Inferencecited by 1
  2. 2025Spurious Privacy Leakage in Neural Networkscited by 1
  3. 2022Membership Privacy Protection for Image Translation Models via Adversarial Knowledge Distillationcited by 0
  4. 2025A Perplexity and Menger Curvature-Based Approach for Similarity Evaluation of Large Language Modelscited by 0