mlsanityData to 7 Oct 2026

Membership Inference Attacks on Machine Learning: A Survey

arXiv 2103.07853 ↗First posted 14 Mar 2021cs.LG cs.CRcited by 306

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Machine learning (ML) models have been widely applied to various applications, including image classification, text generation, audio recognition, and graph data analysis. However, recent studies have shown that ML models are vulnerable to membership inference attacks (MIAs), which aim to infer whether a data record was used to train a target model or not. MIAs on ML models can directly lead to a privacy breach. For example, via identifying the fact that a clinical record that has been used to train a model associated with a certain disease, an attacker can infer that the owner of the clinical record has the disease with a high chance. In recent years, MIAs have been shown to be effective on various ML models, e.g., classification models and generative models. Meanwhile, many defense methods have been proposed to mitigate MIAs. Although MIAs on ML models form a newly emerging and rapidly growing research area, there has been no systematic survey on this topic yet. In this paper, we conduct the first comprehensive survey on membership inference attacks and defenses. We provide the taxonomies for both attacks and defenses, based on their characterizations, and discuss their pros and cons. Based on the limitations and gaps identified in this survey, we point out several promising future research directions to inspire the researchers who wish to follow this area. This survey not only serves as a reference for the research community but also provides a clear description for researchers outside this research domain. To further help the researchers, we have created an online resource repository, which we will keep updated with future relevant work. Interested readers can find the repository at https://github.com/HongshengHu/membership-inference-machine-learning-literature.

Key facts. Cited by 306 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 132 of its 267 references that are in the map. First posted on arXiv 14 Mar 2021.

Builds on

132 of 267 references.

Closest ancestors · 5

Same direction, newest first

  1. 2021On the (In)Feasibility of Attribute Inference Attacks on Machine Learning Models12 Mar
  2. 2021Defending Medical Image Diagnostics against Privacy Attacks using Generative Methods4 Mar
  3. 2021On the privacy-utility trade-off in differentially private hierarchical text classification4 Mar
  4. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models4 Feb
  5. 2021Practical Blind Membership Inference Attack via Differential Comparisons5 Jan

Other references · 127

  1. 2017Attention Is All You Needcited by 59,932
  2. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  3. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  4. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  5. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,282
  6. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  7. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  8. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,482
  9. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  10. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  11. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  12. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
38 more
  1. 2013Intriguing properties of neural networkscited by 5,114
  2. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  3. 2016The Cityscapes Dataset for Semantic Urban Scene Understandingcited by 4,427
  4. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  5. 2013Auto-Encoding Variational Bayescited by 3,980
  6. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  7. 2013Distributed Representations of Words and Phrases and their Compositionalitycited by 3,462
  8. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  9. 2016Deep Learning with Differential Privacycited by 2,682
  10. 2020Improved Baselines with Momentum Contrastive Learningcited by 2,282
  11. 2017Improved Training of Wasserstein GANscited by 2,223
  12. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  13. 2020Extracting Training Data from Large Language Modelscited by 2,144
  14. 2015Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networkscited by 2,048
  15. 2016node2vec: Scalable Feature Learning for Networkscited by 1,913
  16. 2019Invariant Risk Minimizationcited by 1,832
  17. 2016Understanding deep learning requires rethinking generalizationcited by 1,657
  18. 2016Enriching Word Vectors with Subword Informationcited by 1,578
  19. 2019Federated Learning: Challenges, Methods, and Future Directionscited by 1,531
  20. 2017A Survey on Deep Learning in Medical Image Analysiscited by 1,182
  21. 2017Neural Collaborative Filteringcited by 1,108
  22. 2015Aligning Books and Movies: Towards Story-like Visual Explanations by Watching Movies and Reading Bookscited by 1,041
  23. 2019Machine Unlearningcited by 1,020
  24. 2017ChestX-ray8: Hospital-scale Chest X-ray Database and Benchmarks on Weakly-Supervised Classification and Localization of Common Thorax Diseasescited by 969
  25. 2020Meta-Learning in Neural Networks: A Surveycited by 944
  26. 2016Adversarial Machine Learning at Scalecited by 934
  27. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  28. 2017Renyi Differential Privacycited by 643
  29. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  30. 2015Train faster, generalize better: Stability of stochastic gradient descentcited by 547
  31. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  32. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  33. 2013Do Deep Nets Really Need to be Deep?cited by 466
  34. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  35. 2019FedMD: Heterogenous Federated Learning via Model Distillationcited by 454
  36. 2017Differentially Private Federated Learning: A Client Level Perspectivecited by 451
  37. 2017Age Progression/Regression by Conditional Adversarial Autoencodercited by 426
  38. 2015Autoencoding beyond pixels using a learned similarity metriccited by 407

50 most cited of 127 All 127 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 10; 2022: 33; 2023: 67; 2024: 68; 2025: 76; 2026: 52.

306 papers.

Sort:

By area:

  1. 2023Pythia: A Suite for Analyzing Large Language Models Across Training and Scalingcited by 1,734
  2. 2023A Comprehensive Survey of AI-Generated Content (AIGC): A History of Generative AI from GAN to ChatGPTcited by 221
  3. 2023Fast Machine Unlearning Without Retraining Through Selective Synaptic Dampeningcited by 177
  4. 2023Emergent and Predictable Memorization in Large Language Modelscited by 147
  5. 2023Boundary Unlearningcited by 132
  6. 2023A Comprehensive Survey of Dataset Distillationcited by 114
  7. 2021Trustworthy AI: A Computational Perspectivecited by 93
  8. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 90
  9. 2023Machine Unlearning: Solutions and Challengescited by 85
  10. 2022Towards Adversarial Evaluations for Inexact Machine Unlearningcited by 82
  11. 2022Source-Free Unsupervised Domain Adaptation: A Surveycited by 79
  12. 2023Unleashing the potential of prompt engineering for large language modelscited by 72
38 more
  1. 2023Bag of Tricks for Training Data Extraction from Language Modelscited by 67
  2. 2022Synthetic Data -- what, why and how?cited by 66
  3. 2023Membership Inference Attacks against Synthetic Data through Overfitting Detectioncited by 66
  4. 2023Did the Neurons Read your Book? Document-level Membership Inference for Large Language Modelscited by 51
  5. 2023Evaluating Data Attribution for Text-to-Image Modelscited by 45
  6. 2021Survey: Leakage and Privacy at Inference Timecited by 44
  7. 2023Exploring the Landscape of Machine Unlearning: A Comprehensive Survey and Taxonomycited by 44
  8. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generationcited by 44
  9. 2023Training Data Extraction From Pre-trained Language Models: A Surveycited by 43
  10. 2024Unified Gradient-Based Machine Unlearning with Remain Geometry Enhancementcited by 43
  11. 2024Membership Inference Attacks Against In-Context Learningcited by 38
  12. 2023Practical Membership Inference Attacks Against Large-Scale Multi-Modal Models: A Pilot Studycited by 37
  13. 2022BlindFL: Vertical Federated Machine Learning without Peeking into Your Datacited by 36
  14. 2022Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queriescited by 36
  15. 2023Beyond the Safeguards: Exploring the Security Risks of ChatGPTcited by 36
  16. 2021Membership Inference on Word Embedding and Beyondcited by 34
  17. 2022A Comprehensive Survey on Trustworthy Recommender Systemscited by 32
  18. 2021Source Inference Attacks in Federated Learningcited by 31
  19. 2022On Learning Fairness and Accuracy on Multiple Subgroupscited by 31
  20. 2024Membership Inference Attacks against Large Vision-Language Modelscited by 31
  21. 2022M^4I: Multi-modal Models Membership Inferencecited by 30
  22. 2024Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defensescited by 30
  23. 2024Mask-based Membership Inference Attacks for Retrieval-Augmented Generationcited by 29
  24. 2024Auditing f-Differential Privacy in One Runcited by 28
  25. 2023A Survey on Decentralized Federated Learningcited by 27
  26. 2023Traces of Memorisation in Large Language Models for Codecited by 26
  27. 2025The Evolution of Dataset Distillation: Toward Scalable and Generalizable Solutionscited by 24
  28. 2023A Survey on Privacy in Graph Neural Networks: Attacks, Preservation, and Applicationscited by 22
  29. 2023A Survey of What to Share in Federated Learning: Perspectives on Model Utility, Privacy Leakage, and Communication Efficiencycited by 21
  30. 2023No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device MLcited by 21
  31. 2024Ethos: Rectifying Language Models in Orthogonal Parameter Spacecited by 20
  32. 2022Industry-Scale Orchestrated Federated Learning for Drug Discoverycited by 19
  33. 2024Learning to Unlearn for Robust Machine Unlearningcited by 19
  34. 2022A Blessing of Dimensionality in Membership Inference through Regularizationcited by 17
  35. 2023A Probabilistic Fluctuation based Membership Inference Attack for Diffusion Modelscited by 17
  36. 2024A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attackscited by 17
  37. 2025Membership Inference Attacks on Large-Scale Models: A Surveycited by 17
  38. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15

50 most cited of 306 All 306 (JSON)