mlsanityData to 7 Oct 2026

Enhanced Membership Inference Attacks against Machine Learning Models

arXiv 2111.09679 ↗First posted 18 Nov 2021cs.LG cs.CR stat.MLcited by 237

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

How much does a machine learning algorithm leak about its training data, and why? Membership inference attacks are used as an auditing tool to quantify this leakage. In this paper, we present a comprehensive textithypothesis testing framework that enables us not only to formally express the prior work in a consistent way, but also to design new membership inference attacks that use reference models to achieve a significantly higher power (true positive rate) for any (false positive rate) error. More importantly, we explain textitwhy different attacks perform differently. We present a template for indistinguishability games, and provide an interpretation of attack success rate across different instances of the game. We discuss various uncertainties of attackers that arise from the formulation of the problem, and show how our approach tries to minimize the attack uncertainty to the one bit secret about the presence or absence of a data point in the training set. We perform a textitdifferential analysis between all types of attacks, explain the gap between them, and show what causes data points to be vulnerable to an attack (as the reasons vary due to different granularities of memorization, from overfitting to conditional memorization). Our auditing framework is openly accessible as part of the textitPrivacy Meter software tool.

Key facts. Cited by 237 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 29 of its 63 references that are in the map. First posted on arXiv 18 Nov 2021.

Builds on

29 of 63 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021On the Importance of Difficulty Calibration in Membership Inference Attacks15 Nov

Other references · 28

  1. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  2. 2020Extracting Training Data from Large Language Modelscited by 2,144
  3. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  4. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  5. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  6. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 452
  7. 2020Label-Only Membership Inference Attackscited by 371
  8. 2013The Composition Theorem for Differential Privacycited by 290
  9. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
  10. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  11. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 213
  12. 2020Information Leakage in Embedding Modelscited by 199
16 more
  1. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
  2. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  3. 2017Machine Learning Models that Remember Too Muchcited by 165
  4. 2020Membership Leakage in Label-Only Exposurescited by 156
  5. 2019Privacy Risks of Securing Machine Learning Models against Adversarial Examplescited by 136
  6. 2018Understanding Membership Inferences on Well-Generalized Learning Modelscited by 83
  7. 2020On the Privacy Risks of Algorithmic Fairnesscited by 82
  8. 2020ML Privacy Meter: Aiding Regulatory Compliance by Quantifying the Privacy Risks of Machine Learningcited by 66
  9. 2017Knock Knock, Who's There? Membership Inference on Aggregate Location Datacited by 63
  10. 2021On Memorization in Probabilistic Deep Generative Modelscited by 60
  11. 2018Algorithms that Remember: Model Inversion Attacks and Data Protection Lawcited by 52
  12. 2021Antipodes of Label Differential Privacy: PATE and ALIBIcited by 50
  13. 2020Privacy Analysis of Deep Learning in the Wild: Membership Inference Attacks against Transfer Learningcited by 19
  14. 2019That which we call privatecited by 14
  15. 2020Modelling and Quantifying Membership Information Leakage in Machine Learningcited by 11
  16. 2021Bounding Information Leakage in Machine Learningcited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 26; 2023: 51; 2024: 66; 2025: 66; 2026: 27.

237 papers.

Sort:

By area:

  1. 2021Membership Inference Attacks From First Principlescited by 839
  2. 2023Extracting Training Data from Diffusion Modelscited by 723
  3. 2024MUSE: Machine Unlearning Six-Way Evaluation for Language Modelscited by 251
  4. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 249
  5. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 188
  6. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
  7. 2022Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attackscited by 168
  8. 2022Measuring Forgetting of Memorized Training Examplescited by 118
  9. 2023Low-Cost High-Power Membership Inference Attackscited by 99
  10. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  11. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 93
  12. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 90
38 more
  1. 2023Membership Inference Attacks against Diffusion Modelscited by 84
  2. 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacycited by 78
  3. 2023Membership Inference Attacks against Synthetic Data through Overfitting Detectioncited by 66
  4. 2023Scalable Membership Inference Attacks via Quantile Regressioncited by 61
  5. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 54
  6. 2024Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Datacited by 49
  7. 2023Membership Inference of Diffusion Modelscited by 46
  8. 2022Differentially Private Learning Needs Hidden State (Or Much Faster Convergence)cited by 45
  9. 2023White-box Membership Inference Attacks against Diffusion Modelscited by 42
  10. 2023Towards More Realistic Membership Inference Attacks on Large Diffusion Modelscited by 41
  11. 2025Exploring Criteria of Loss Reweighting to Enhance LLM Unlearningcited by 39
  12. 2024LLM-PBE: Assessing Data Privacy in Large Language Modelscited by 38
  13. 2024Membership Inference Attacks Against In-Context Learningcited by 38
  14. 2023User Inference Attacks on Large Language Modelscited by 36
  15. 2023SoK: Memorization in General-Purpose Large Language Modelscited by 36
  16. 2024Evaluations of Machine Learning Privacy Defenses are Misleadingcited by 35
  17. 2025Towards Label-Only Membership Inference Attack against Pre-trained Large Language Modelscited by 34
  18. 2022On the Privacy Risks of Algorithmic Recoursecited by 32
  19. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  20. 2022Bayesian Estimation of Differential Privacycited by 31
  21. 2024Membership Inference Attacks against Large Vision-Language Modelscited by 31
  22. 2022Defending against Reconstruction Attacks with R'enyi Differential Privacycited by 30
  23. 2022SNAP: Efficient Extraction of Private Properties with Poisoningcited by 29
  24. 2024Auditing f-Differential Privacy in One Runcited by 28
  25. 2023Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Predictioncited by 26
  26. 2023MoPe: Model Perturbation-based Privacy Attacks on Language Modelscited by 25
  27. 2024Digger: Detecting Copyright Content Mis-usage in Large Language Model Trainingcited by 24
  28. 2022On the (In)security of Peer-to-Peer Decentralized Machine Learningcited by 23
  29. 2023A Linear Reconstruction Approach for Attribute Inference Attacks against Synthetic Datacited by 23
  30. 2022Individual Privacy Accounting for Differentially Private Stochastic Gradient Descentcited by 20
  31. 2023Gaussian Membership Inference Privacycited by 20
  32. 2023zkDL: Efficient Zero-Knowledge Proofs of Deep Learning Trainingcited by 20
  33. 2023Leave-one-out Distinguishability in Machine Learningcited by 20
  34. 2024Context-Aware Membership Inference Attacks against Pre-trained Large Language Modelscited by 20
  35. 2023Do SSL Models Have D'ej`a Vu? A Case of Unintended Memorization in Self-supervised Learningcited by 19
  36. 2023Unleashing the Power of Randomization in Auditing Differentially Private MLcited by 19
  37. 2024Nearly Tight Black-Box Auditing of Differentially Private Machine Learningcited by 19
  38. 2024SeqMIA: Sequential-Metric Based Membership Inference Attackcited by 19

50 most cited of 237 All 237 (JSON)