mlsanityData to 7 Oct 2026

Membership Inference Attack Using Self Influence Functions

arXiv 2205.13680 ↗First posted 26 May 2022cs.LG cs.CVcited by 19

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Member inference (MI) attacks aim to determine if a specific data sample was used to train a machine learning model. Thus, MI is a major privacy threat to models trained on private sensitive data, such as medical records. In MI attacks one may consider the black-box settings, where the model's parameters and activations are hidden from the adversary, or the white-box case where they are available to the attacker. In this work, we focus on the latter and present a novel MI attack for it that employs influence functions, or more specifically the samples' self-influence scores, to perform the MI prediction. We evaluate our attack on CIFAR-10, CIFAR-100, and Tiny ImageNet datasets, using versatile architectures such as AlexNet, ResNet, and DenseNet. Our attack method achieves new state-of-the-art results for both training with and without data augmentations. Code is available at https://github.com/giladcohen/sif_mi_attack.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 30 of its 47 references that are in the map. First posted on arXiv 26 May 2022.

Builds on

30 of 47 references.

Closest ancestors · 2

Same direction, newest first

  1. 2021Membership Inference Attacks From First Principles7 Dec
  2. 2021On the Importance of Difficulty Calibration in Membership Inference Attacks15 Nov

Other references · 28

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  4. 2016Densely Connected Convolutional Networkscited by 6,691
  5. 2016Deep Learning with Differential Privacycited by 2,682
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  7. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  8. 2020Estimating Training Data Influence by Tracing Gradient Descentcited by 565
  9. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  10. 2020Label-Only Membership Inference Attackscited by 371
  11. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  12. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
16 more
  1. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  2. 2018Adversarial Robustness Toolbox v1.0.0cited by 214
  3. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  4. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
  5. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  6. 2018An overview of deep learning in medical imaging focusing on MRIcited by 140
  7. 2019Privacy Risks of Securing Machine Learning Models against Adversarial Examplescited by 136
  8. 2021Scaling Up Influence Functionscited by 130
  9. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 103
  10. 2021Deep Learning for Chest X-ray Analysis: A Surveycited by 84
  11. 2018Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learningcited by 75
  12. 2019Detecting Adversarial Samples Using Influence Functions and Nearest Neighborscited by 72
  13. 2018Towards Demystifying Membership Inference Attackscited by 39
  14. 2022Private Adaptive Optimization with Side Informationcited by 38
  15. 2016Second-Order Stochastic Optimization for Machine Learning in Linear Timecited by 14
  16. 2020Membership Inference Attacks and Defenses in Classification Modelscited by 14

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 3; 2024: 4; 2025: 5; 2026: 6.

19 papers.

Sort:

By area:

  1. 2022Training Data Influence Analysis and Estimation: A Surveycited by 134
  2. 2023MoPe: Model Perturbation-based Privacy Attacks on Language Modelscited by 25
  3. 2024An Information Theoretic Evaluation Metric For Strong Unlearningcited by 11
  4. 2024Do Parameters Reveal More than Loss for Membership Inference?cited by 9
  5. 2024TUNI: A Textual Unimodal Detector for Identity Inference in CLIP Modelscited by 8
  6. 2023Deeper Understanding of Black-box Predictions via Generalized Influence Functionscited by 7
  7. 2024WaKA: Data Attribution using K-Nearest Neighbors and Membership Privacy Principlescited by 2
  8. 2025Privacy Risks and Preservation Methods in Explainable Artificial Intelligence: A Scoping Reviewcited by 2
  9. 2025Influence Functions for Edge Edits in Non-Convex Graph Neural Networkscited by 2
  10. 2025Membership Inference Attacks with False Discovery Rate Controlcited by 2
  11. 2025Towards integration of Privacy Enhancing Technologies in Explainable Artificial Intelligencecited by 1
  12. 2025ImpMIA: Leveraging Implicit Bias for Membership Inference Attackcited by 1
7 more
  1. 2026SoK: Challenges in Tabular Membership Inference Attackscited by 1
  2. 2023Black-Box Training Data Identification in GANs via Detector Networkscited by 0
  3. 2026LeakBoost: Perceptual-Loss-Based Membership Inference Attackcited by 0
  4. 2026Assessing Per-Sample Membership Inference Vulnerability without Retrainingcited by 0
  5. 2026Membership Inference for Contrastive Pre-training Models with Text-only PII Queriescited by 0
  6. 2026idSCD: Identifying Training Datasets through Semantic Correlation Descriptorscited by 0
  7. 2026SoK: Privacy Attacks on Machine Learning via Explainable AIcited by 0