mlsanityData to 14 Oct 2026

On the Importance of Difficulty Calibration in Membership Inference Attacks

arXiv 2111.08440 ↗First posted 15 Nov 2021cs.CR cs.LGcited by 147

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

The vulnerability of machine learning models to membership inference attacks has received much attention in recent years. However, existing attacks mostly remain impractical due to having high false positive rates, where non-member samples are often erroneously predicted as members. This type of error makes the predicted membership signal unreliable, especially since most samples are non-members in real world applications. In this work, we argue that membership inference attacks can benefit drastically from difficulty calibration, where an attack's predicted membership score is adjusted to the difficulty of correctly classifying the target sample. We show that difficulty calibration can significantly reduce the false positive rate of a variety of existing attacks without a loss in accuracy.

Key facts. Cited by 147 papers in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 22 of its 37 references that are in the map. First posted on arXiv 15 Nov 2021.

Builds on

22 of 37 references.

References · 22

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2016Overcoming catastrophic forgetting in neural networkscited by 4,787
  4. 2016Deep Learning with Differential Privacycited by 2,728
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  6. 2020Extracting Training Data from Large Language Modelscited by 2,189
  7. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 864
  8. 2013An Empirical Investigation of Catastrophic Forgetting in Gradient-Based Neural Networkscited by 722
  9. 2018An Empirical Study of Example Forgetting during Deep Neural Network Learningcited by 678
  10. 2017Renyi Differential Privacycited by 650
  11. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
  12. 2020Label-Only Membership Inference Attackscited by 388
10 more
  1. 2021Opacus: User-Friendly Differential Privacy Library in PyTorchcited by 383
  2. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 292
  3. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
  4. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 218
  5. 2019R'enyi Differential Privacy of the Sampled Gaussian Mechanismcited by 204
  6. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 199
  7. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 197
  8. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 175
  9. 2020Revisiting Membership Inference Under Realistic Assumptionscited by 112
  10. 2018Understanding Membership Inferences on Well-Generalized Learning Modelscited by 90

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 2; 2022: 16; 2023: 22; 2024: 38; 2025: 42; 2026: 27.

147 papers.

Sort:

By area:

  1. 2021Membership Inference Attacks From First Principlescited by 878
  2. 2023Detecting Pretraining Data from Large Language Modelscited by 387
  3. 2022Deduplicating Training Data Mitigates Privacy Risks in Language Modelscited by 314
  4. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 258
  5. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 248
  6. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 195
  7. 2022Measuring Forgetting of Memorized Training Examplescited by 118
  8. 2023Low-Cost High-Power Membership Inference Attackscited by 107
  9. 2024Min-K%++: Improved Baseline for Detecting Pre-Training Data from Large Language Modelscited by 103
  10. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 101
  11. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 101
  12. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 98
38 more
  1. 2024DE-COP: Detecting Copyrighted Content in Language Models Training Datacited by 74
  2. 2023Scalable Membership Inference Attacks via Quantile Regressioncited by 65
  3. 2024ReCaLL: Membership Inference via Relative Conditional Log-Likelihoodscited by 64
  4. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 59
  5. 2024Watermarking Makes Language Models Radioactivecited by 58
  6. 2024Pretraining Data Detection for Large Language Models: A Divergence-based Calibration Methodcited by 55
  7. 2023White-box Membership Inference Attacks against Diffusion Modelscited by 42
  8. 2024LLM-PBE: Assessing Data Privacy in Large Language Modelscited by 41
  9. 2025Towards Label-Only Membership Inference Attack against Pre-trained Large Language Modelscited by 37
  10. 2023User Inference Attacks on Large Language Modelscited by 36
  11. 2024Evaluations of Machine Learning Privacy Defenses are Misleadingcited by 36
  12. 2023Students Parrot Their Teachers: Membership Inference on Model Distillationcited by 33
  13. 2022Defending against Reconstruction Attacks with R'enyi Differential Privacycited by 32
  14. 2024Membership Inference Attacks and Defenses in Federated Learning: A Surveycited by 31
  15. 2023Identifying and Mitigating Privacy Risks Stemming from Language Models: A Surveycited by 30
  16. 2024Evading Data Contamination Detection for Language Models is (too) Easycited by 30
  17. 2024Auditing f-Differential Privacy in One Runcited by 30
  18. 2025Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generationcited by 26
  19. 2024Probing Language Models for Pre-training Data Detectioncited by 25
  20. 2024Data Contamination Calibration for Black-box LLMscited by 24
  21. 2024PreCurious: How Innocent Pre-Trained Language Models Turn into Privacy Trapscited by 23
  22. 2024SeqMIA: Sequential-Metric Based Membership Inference Attackcited by 23
  23. 2024Noisy Neighbors: Efficient membership inference attacks against LLMscited by 21
  24. 2024Is Difficulty Calibration All We Need? Towards More Practical Membership Inference Attackscited by 21
  25. 2022Membership Inference Attack Using Self Influence Functionscited by 20
  26. 2023zkDL: Efficient Zero-Knowledge Proofs of Deep Learning Trainingcited by 20
  27. 2024Con-ReCall: Detecting Pre-training Data in LLMs via Contrastive Decodingcited by 20
  28. 2022Optimal Membership Inference Bounds for Adaptive Composition of Sampled Gaussian Mechanismscited by 19
  29. 2023Do SSL Models Have D'ej`a Vu? A Case of Unintended Memorization in Self-supervised Learningcited by 19
  30. 2025The Canary's Echo: Auditing Privacy Risks of LLM-Generated Synthetic Textcited by 18
  31. 2022Analyzing Privacy Leakage in Machine Learning via Multiple Hypothesis Testing: A Lesson From Fanocited by 17
  32. 2022On the Privacy Effect of Data Enhancement via the Lens of Memorizationcited by 15
  33. 2023ERASER: Machine Unlearning in MLaaS via an Inference Serving-Aware Approachcited by 15
  34. 2024Is My Data in Your AI? Membership Inference Test (MINT) applied to Face Biometricscited by 13
  35. 2024OSLO: One-Shot Label-Only Membership Inference Attackscited by 13
  36. 2023MIST: Defending Against Membership Inference Attacks Through Membership-Invariant Subspace Trainingcited by 12
  37. 2024Adaptive Pre-training Data Detection for Large Language Models via Surprising Tokenscited by 11
  38. 2025Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemblecited by 11

50 most cited of 147 All 147 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2022Membership-Doctor: Comprehensive Assessment of Membership Inference Against Machine Learning Models
  2. 2024On the Impact of Uncertainty and Calibration on Likelihood-Ratio Membership Inference Attacks
  3. 2023Fundamental Limits of Membership Inference Attacks on Machine Learning Models
  4. 2023Confidence Is All You Need for MI Attacks
  5. 2026A Full-Pipeline Framework for Evaluating Membership Inference Attacks in Machine Learning
  6. 2025The Sample Complexity of Membership Inference and Privacy Auditing
  7. 2021On the (In)Feasibility of Attribute Inference Attacks on Machine Learning Models
  8. 2024A Method to Facilitate Membership Inference Attacks in Deep Learning Models