mlsanityData to 14 Oct 2026

Membership Inference Attacks From First Principles

arXiv 2112.03570 ↗First posted 7 Dec 2021cs.CR cs.LGcited by 878

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

A membership inference attack allows an adversary to query a trained machine learning model to predict whether or not a particular example was contained in the model's training dataset. These attacks are currently evaluated using average-case "accuracy" metrics that fail to characterize whether the attack can confidently identify any members of the training set. We argue that attacks should instead be evaluated by computing their true-positive rate at low (e.g., <0.1%) false-positive rates, and find most prior attacks perform poorly when evaluated in this way. To address this we develop a Likelihood Ratio Attack (LiRA) that carefully combines multiple ideas from the literature. Our attack is 10x more powerful at low false-positive rates, and also strictly dominates prior attacks on existing metrics.

Key facts. Cited by 878 papers in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 40 of its 78 references that are in the map. First posted on arXiv 7 Dec 2021.

Builds on

40 of 78 references.

Closest ancestors · 3

Same direction, newest first

  1. 2021Enhanced Membership Inference Attacks against Machine Learning Models18 Nov
  2. 2021On the Importance of Difficulty Calibration in Membership Inference Attacks15 Nov
  3. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models4 Feb

Other references · 37

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 5,045
  3. 2016Pointer Sentinel Mixture Modelscited by 3,096
  4. 2016Wide Residual Networkscited by 3,070
  5. 2016Deep Learning with Differential Privacycited by 2,728
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  7. 2020Extracting Training Data from Large Language Modelscited by 2,189
  8. 2017Random Erasing Data Augmentationcited by 1,239
  9. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 864
  10. 2018AutoAugment: Learning Augmentation Policies from Datacited by 730
  11. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 520
  12. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
25 more
  1. 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 497
  2. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 460
  3. 2020Label-Only Membership Inference Attackscited by 388
  4. 2013The Composition Theorem for Differential Privacycited by 297
  5. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 292
  6. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
  7. 2018Scalable Private Learning with PATEcited by 269
  8. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 218
  9. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 199
  10. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 197
  11. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 186
  12. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 175
  13. 2020Membership Leakage in Label-Only Exposurescited by 168
  14. 2019Privacy Risks of Securing Machine Learning Models against Adversarial Examplescited by 141
  15. 2019Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learningcited by 122
  16. 2018Stealing Hyperparameters in Machine Learningcited by 118
  17. 2020Stealing Links from Graph Neural Networkscited by 115
  18. 2020Revisiting Membership Inference Under Realistic Assumptionscited by 112
  19. 2020When is Memorization of Irrelevant Training Data Necessary for High-Accuracy Learning?cited by 104
  20. 2019Gmail Smart Compose: Real-Time Assisted Writingcited by 98
  21. 2017Knock Knock, Who's There? Membership Inference on Aggregate Location Datacited by 70
  22. 2020ML Privacy Meter: Aiding Regulatory Compliance by Quantifying the Privacy Risks of Machine Learningcited by 70
  23. 2018Towards Demystifying Membership Inference Attackscited by 40
  24. 2017Towards Measuring Membership Privacycited by 29
  25. 2020Sampling Attacks: Amplification of Membership Inference Attacks by Repeated Queriescited by 16

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 2; 2022: 58; 2023: 127; 2024: 228; 2025: 233; 2026: 230.

878 papers.

Sort:

By area:

  1. 2023Extracting Training Data from Diffusion Modelscited by 732
  2. 2024TOFU: A Task of Fictitious Unlearning for LLMscited by 533
  3. 2022Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Modelscited by 424
  4. 2023Detecting Pretraining Data from Large Language Modelscited by 387
  5. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
  6. 2023SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generationcited by 386
  7. 2022Deduplicating Training Data Mitigates Privacy Risks in Language Modelscited by 314
  8. 2023Analyzing Leakage of Personally Identifiable Information in Language Modelscited by 285
  9. 2023Towards Unbounded Machine Unlearningcited by 268
  10. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 258
  11. 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 224
  12. 2023In-Context Unlearning: Language Models as Few Shot Unlearnerscited by 224
38 more
  1. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 195
  2. 2022Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attackscited by 175
  3. 2021Counterfactual Memorization in Neural Language Modelscited by 156
  4. 2022The Privacy Onion Effect: Memorization is Relativecited by 136
  5. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?cited by 136
  6. 2023Privacy Auditing with One (1) Training Runcited by 123
  7. 2022Privacy for Free: How does Dataset Condensation Help Privacy?cited by 120
  8. 2024Machine Unlearning of Pre-trained Large Language Modelscited by 119
  9. 2022Measuring Forgetting of Memorized Training Examplescited by 118
  10. 2024LLM Dataset Inference: Did you train on my dataset?cited by 110
  11. 2023Low-Cost High-Power Membership Inference Attackscited by 107
  12. 2024Min-K%++: Improved Baseline for Detecting Pre-Training Data from Large Language Modelscited by 103
  13. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 101
  14. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 101
  15. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 98
  16. 2024Guardrail Baselines for Unlearning in LLMscited by 96
  17. 2024Detecting, Explaining, and Mitigating Memorization in Diffusion Modelscited by 95
  18. 2024Rethinking LLM Memorization through the Lens of Adversarial Compressioncited by 94
  19. 2024Watermark Stealing in Large Language Modelscited by 92
  20. 2024What makes unlearning hard and what to do about itcited by 89
  21. 2024Fast Adversarial Attacks on Language Models In One GPU Minutecited by 88
  22. 2023Membership Inference Attacks against Diffusion Modelscited by 86
  23. 2024Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Modelscited by 86
  24. 2023Flocks of Stochastic Parrots: Differentially Private Prompt Learning for Large Language Modelscited by 83
  25. 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacycited by 82
  26. 2022Cramming: Training a Language Model on a Single GPU in One Daycited by 81
  27. 2024Differentially Private Synthetic Data via Foundation Model APIs 2: Textcited by 76
  28. 2024DE-COP: Detecting Copyrighted Content in Language Models Training Datacited by 74
  29. 2024Blind Baselines Beat Membership Inference Attacks for Foundation Modelscited by 69
  30. 2023Differentially Private Synthetic Data via Foundation Model APIs 1: Imagescited by 65
  31. 2023Scalable Membership Inference Attacks via Quantile Regressioncited by 65
  32. 2024ReCaLL: Membership Inference via Relative Conditional Log-Likelihoodscited by 64
  33. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 59
  34. 2024Watermarking Makes Language Models Radioactivecited by 58
  35. 2023DP-OPT: Make Large Language Model Your Privacy-Preserving Prompt Engineercited by 57
  36. 2023Did the Neurons Read your Book? Document-level Membership Inference for Large Language Modelscited by 56
  37. 2024Pretraining Data Detection for Large Language Models: A Divergence-based Calibration Methodcited by 55
  38. 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initializationcited by 54

50 most cited of 878 All 878 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2022Membership-Doctor: Comprehensive Assessment of Membership Inference Against Machine Learning Models
  2. 2023Confidence Is All You Need for MI Attacks
  3. 2022An Efficient Subpopulation-based Membership Inference Attack
  4. 2022Membership Inference Attacks via Adversarial Examples
  5. 2021Membership Inference Attacks on Machine Learning: A Survey
  6. 2025Exploring the limits of strong membership inference attacks on large language models
  7. 2021On the (In)Feasibility of Attribute Inference Attacks on Machine Learning Models
  8. 2025Evaluating Membership Inference Attacks in heterogeneous-data setups