Data to 14 Oct 2026

Membership Inference Attacks by Exploiting Loss Trajectory

arXiv 2208.14933 ↗First posted 31 Aug 2022cs.CR cs.LGcited by 101

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Machine learning models are vulnerable to membership inference attacks in which an adversary aims to predict whether or not a particular sample was contained in the target model's training dataset. Existing attack methods have commonly exploited the output information (mostly, losses) solely from the given target model. As a result, in practical scenarios where both the member and non-member samples yield similarly small losses, these methods are naturally unable to differentiate between them. To address this limitation, in this paper, we propose a new attack method, called system, which can exploit the membership information from the whole training process of the target model for improving the attack performance. To mount the attack in the common black-box setting, we leverage knowledge distillation, and represent the membership information by the losses evaluated on a sequence of intermediate models at different distillation epochs, namely distilled loss trajectory, together with the loss from the given target model. Experimental results over different datasets and model architectures demonstrate the great advantage of our attack in terms of different metrics. For example, on CINIC-10, our attack achieves at least 6× higher true-positive rate at a low false-positive rate of 0.1% than existing methods. Further analysis demonstrates the general effectiveness of our attack in more strict scenarios.

Key facts. Cited by 101 papers in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 40 of its 54 references that are in the map. First posted on arXiv 31 Aug 2022.

Builds on

40 of 54 references.

Closest ancestors · 5

Same direction, newest first

Other references · 35

2015Deep Residual Learning for Image Recognitioncited by 52,096
2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
2015Distilling the Knowledge in a Neural Networkcited by 10,324
2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
2016Wide Residual Networkscited by 3,070
2016Deep Learning with Differential Privacycited by 2,728
2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
2020Extracting Training Data from Large Language Modelscited by 2,189
2014FitNets: Hints for Thin Deep Netscited by 1,653
2016Paying More Attention to Attention: Improving the Performance of Convolutional Neural Networks via Attention Transfercited by 1,077
2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 864
2016Sequence-Level Knowledge Distillationcited by 801

23 more

2018An Empirical Study of Example Forgetting during Deep Neural Network Learningcited by 678
2016Stealing Machine Learning Models via Prediction APIscited by 619
2018Born Again Neural Networkscited by 546
2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 520
2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
2017Mean teachers are better role models: Weight-averaged consistency targets improve semi-supervised deep learning resultscited by 472
2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
2017Regularizing Neural Networks by Penalizing Confident Output Distributionscited by 464
2020Label-Only Membership Inference Attackscited by 388
2016Semi-supervised Knowledge Transfer for Deep Learning from Private Training Datacited by 348
2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 292
2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 197
2015Cross Modal Distillation for Supervision Transfercited by 175
2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 175
2020Membership Leakage in Label-Only Exposurescited by 168
2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 139
2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 84
2019Let's Agree to Agree: Neural Networks Share Classification Order on Real Datasetscited by 56
2017LOGAN: Membership Inference Attacks Against Generative Modelscited by 28
2022Auditing Membership Leakages of Multi-Exit Networkscited by 27
2020Sampling Attacks: Amplification of Membership Inference Attacks by Repeated Queriescited by 16

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 4; 2023: 18; 2024: 28; 2025: 28; 2026: 23.

101 papers.

Sort:

By area:

2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 258
2023Low-Cost High-Power Membership Inference Attackscited by 107
2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 98
2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 69
2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 59
2023Membership Inference of Diffusion Modelscited by 46
2024Membership Inference Attacks Against In-Context Learningcited by 43
2023White-box Membership Inference Attacks against Diffusion Modelscited by 42
2022Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queriescited by 40
2025Towards Label-Only Membership Inference Attack against Pre-trained Large Language Modelscited by 37
2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Modelscited by 35
2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32

38 more

2024Membership Inference Attacks and Defenses in Federated Learning: A Surveycited by 31
2024SeqMIA: Sequential-Metric Based Membership Inference Attackcited by 23
2024Is Difficulty Calibration All We Need? Towards More Practical Membership Inference Attackscited by 21
2024Learning to Unlearn for Robust Machine Unlearningcited by 19
2023ERASER: Machine Unlearning in MLaaS via an Inference Serving-Aware Approachcited by 15
2023SLMIA-SR: Speaker-Level Membership Inference Attacks against Speaker Recognition Systemscited by 14
2024OSLO: One-Shot Label-Only Membership Inference Attackscited by 13
2024Model Inversion Attacks: A Survey of Approaches and Countermeasurescited by 11
2025Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemblecited by 11
2025Is My Text in Your AI Model? Gradient-based Membership Inference Test applied to LLMscited by 10
2025SOFT: Selective Data Obfuscation for Protecting LLM Fine-tuning against Membership Inference Attackscited by 10
2024QUEEN: Query Unlearning against Model Extractioncited by 9
2023Quantifying Privacy Risks of Prompts in Visual Prompt Learningcited by 8
2025IP Leakage Attacks Targeting LLM-Based Multi-Agent Systemscited by 8
2024GLiRA: Black-Box Membership Inference Attack via Knowledge Distillationcited by 7
2024A Method to Facilitate Membership Inference Attacks in Deep Learning Modelscited by 7
2024Free Record-Level Privacy Risk Evaluation Through Artifact-Based Methodscited by 7
2026Window-based Membership Inference Attacks Against Fine-tuned Large Language Modelscited by 7
2026Is My Vision-Language Data in Your AI? Membership Inference Test (MINT) Demo 2cited by 7
2024A Survey of Privacy-Preserving Model Explanations: Privacy Risks, Attacks, and Countermeasurescited by 6
2025Rethinking Membership Inference Attacks Against Transfer Learningcited by 6
2025Cascading and Proxy Membership Inference Attackscited by 6
2023Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoningcited by 5
2024Rethinking the impact of noisy labels in graph classification: A utility and privacy perspectivecited by 5
2024Understanding Data Importance in Machine Learning Attacks: Does Valuable Data Pose Greater Harm?cited by 5
2025Practical Bayes-Optimal Membership Inference Attackscited by 5
2025SoK: Data Reconstruction Attacks Against Machine Learning Models: Definition, Metrics, and Benchmarkcited by 5
2026Membership Inference Attacks Against Fine-tuned Diffusion Language Modelscited by 5
2022Provable Membership Inference Privacycited by 4
2024Safety and Performance, Why Not Both? Bi-Objective Optimized Model Compression against Heterogeneous Attacks Toward AI Software Deploymentcited by 4
2024On the Impact of Uncertainty and Calibration on Likelihood-Ratio Membership Inference Attackscited by 4
2024MAP: MAsk-Pruning for Source-Free Model Intellectual Property Protectioncited by 4
2024Exploiting the Vulnerability of Large Language Models via Defense-Aware Architectural Backdoorcited by 3
2024Subject Data Auditing via Source Inference Attack in Cross-Silo Federated Learningcited by 3
2025CompLeak: Deep Learning Model Compression Exacerbates Privacy Leakagecited by 3
2025Imitative Membership Inference Attackcited by 3
2025Membership Inference Attacks on Recommender System: A Surveycited by 3
2025From Risk to Resilience: Towards Assessing and Mitigating the Risk of Data Reconstruction Attacks in Federated Learningcited by 3

50 most cited of 101 All 101 (JSON)

Similar, not cited

Close in wording, no citation either way