# User-Level Membership Inference Attack against Metric Embedding Learning

arXiv: https://arxiv.org/abs/2203.02077 · HTML: https://mlsanity.com/paper/2203.02077/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- Placed in Membership inference attacks, one of 12 directions in LLM safety and security.
- Builds on 5 of its 9 references that are in the map.
- First posted on arXiv 4 Mar 2022.

## Placed in

- LLM safety and security / [Membership inference attacks](https://mlsanity.com/safety/membership-inference-attacks/)

## Builds on (most cited first, 5 of 5)

- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [In Defense of the Triplet Loss for Person Re-Identification](https://mlsanity.com/paper/1703.07737/) (2017)
- [ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models](https://mlsanity.com/paper/1806.01246/) (2018)
- [EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learning](https://mlsanity.com/paper/2108.11023/) (2021)
- [The Audio Auditor: User-Level Membership Inference in Internet of Things Voice Services](https://mlsanity.com/paper/1905.07082/) (2019)

## Built on by (most cited first, 22 of 22)

- [User Inference Attacks on Large Language Models](https://mlsanity.com/paper/2310.09266/) (2023)
- [Fine-Tuning Large Language Models with User-Level Differential Privacy](https://mlsanity.com/paper/2407.07737/) (2024)
- [Does CLIP Know My Face?](https://mlsanity.com/paper/2209.07341/) (2022)
- [FACE-AUDITOR: Data Auditing in Facial Recognition Systems](https://mlsanity.com/paper/2304.02782/) (2023)
- [SoK: Dataset Copyright Auditing in Machine Learning Systems](https://mlsanity.com/paper/2410.16618/) (2024)
- [SLMIA-SR: Speaker-Level Membership Inference Attacks against Speaker Recognition Systems](https://mlsanity.com/paper/2309.07983/) (2023)
- [Is My Data in Your AI? Membership Inference Test (MINT) applied to Face Biometrics](https://mlsanity.com/paper/2402.09225/) (2024)
- [Data Isotopes for Data Provenance in DNNs](https://mlsanity.com/paper/2208.13893/) (2022)
- [Similarity Distribution based Membership Inference Attack on Person Re-identification](https://mlsanity.com/paper/2211.15918/) (2022)
- [Cascading and Proxy Membership Inference Attacks](https://mlsanity.com/paper/2507.21412/) (2025)
- [Balancing Transparency and Risk: The Security and Privacy Risks of Open-Source Machine Learning Models](https://mlsanity.com/paper/2308.09490/) (2023)
- [Defending Our Privacy With Backdoors](https://mlsanity.com/paper/2310.08320/) (2023)
- [Analyzing Inference Privacy Risks Through Gradients in Machine Learning](https://mlsanity.com/paper/2408.16913/) (2024)
- [On the Discredibility of Membership Inference Attacks](https://mlsanity.com/paper/2212.02701/) (2022)
- [SoK: Comparing Different Membership Inference Attacks with a Comprehensive Benchmark](https://mlsanity.com/paper/2307.06123/) (2023)
- [Privacy Threats in Stable Diffusion Models](https://mlsanity.com/paper/2311.09355/) (2023)
- [Inference Attacks: A Taxonomy, Survey, and Promising Directions](https://mlsanity.com/paper/2406.02027/) (2024)
- [Fingerprint Membership and Identity Inference Against Generative Adversarial Networks](https://mlsanity.com/paper/2406.15253/) (2024)
- [Inference Attacks Against Face Recognition Model without Classification Layers](https://mlsanity.com/paper/2401.13719/) (2024)
- [CLMIA: Membership Inference Attacks via Unsupervised Contrastive Learning](https://mlsanity.com/paper/2411.11144/) (2024)
- [VICTOR: Dataset Copyright Auditing in Video Recognition Systems](https://mlsanity.com/paper/2512.14439/) (2025)
- [Quantifying Training Membership Information in the Hyperspherical Embedding Geometry of Face Recognition Models](https://mlsanity.com/paper/2607.15084/) (2026)

## Abstract (arXiv)

Membership inference (MI) determines if a sample was part of a victim model training set. Recent development of MI attacks focus on record-level membership inference which limits their application in many real-world scenarios. For example, in the person re-identification task, the attacker (or investigator) is interested in determining if a user's images have been used during training or not. However, the exact training images might not be accessible to the attacker. In this paper, we develop a user-level MI attack where the goal is to find if any sample from the target user has been used during training even when no exact training sample is available to the attacker. We focus on metric embedding learning due to its dominance in person re-identification, where user-level MI attack is more sensible. We conduct an extensive evaluation on several datasets and show that our approach achieves high accuracy on user-level MI task.