mlsanityData to 7 Oct 2026

Membership Inference Attacks and Generalization: A Causal Perspective

arXiv 2209.08615 ↗First posted 18 Sep 2022cs.LG cs.AI cs.CRcited by 17

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Membership inference (MI) attacks highlight a privacy weakness in present stochastic training methods for neural networks. It is not well understood, however, why they arise. Are they a natural consequence of imperfect generalization only? Which underlying causes should we address during training to mitigate these attacks? Towards answering such questions, we propose the first approach to explain MI attacks and their connection to generalization based on principled causal reasoning. We offer causal graphs that quantitatively explain the observed MI attack performance achieved for 6 attack variants. We refute several prior non-quantitative hypotheses that over-simplify or over-estimate the influence of underlying causes, thereby failing to capture the complex interplay between several factors. Our causal models also show a new connection between generalization and MI attacks via their shared causal factors. Our causal models have high predictive power (0.90), i.e., their analytical predictions match with observations in unseen experiments often, which makes analysis via them a pragmatic alternative.

Key facts. Cited by 17 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 32 of its 82 references that are in the map. First posted on arXiv 18 Sep 2022.

Builds on

32 of 82 references.

Closest ancestors · 5

Same direction, newest first

  1. 2022Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attacks8 Mar
  2. 2021Membership Inference Attacks Against Recommender Systems16 Sep
  3. 2021EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learning25 Aug
  4. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models4 Feb
  5. 2021Practical Blind Membership Inference Attack via Differential Comparisons5 Jan

Other references · 27

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2020Extracting Training Data from Large Language Modelscited by 2,144
  4. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  5. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  6. 2020Label-Only Membership Inference Attackscited by 371
  7. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
  8. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  9. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  10. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
  11. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  12. 2020Membership Leakage in Label-Only Exposurescited by 156
15 more
  1. 2019Privacy Risks of Securing Machine Learning Models against Adversarial Examplescited by 136
  2. 2018Predicting the Generalization Gap in Deep Networks with Margin Distributionscited by 111
  3. 2020Rethinking Bias-Variance Trade-off for Generalization of Neural Networkscited by 107
  4. 2020DoWhy: An End-to-End Library for Causal Inferencecited by 92
  5. 2019Analyzing Information Leakage of Updates to Natural Language Modelscited by 89
  6. 2018Understanding Membership Inferences on Well-Generalized Learning Modelscited by 83
  7. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 80
  8. 2020In Search of Robust Measures of Generalizationcited by 79
  9. 2020ML Privacy Meter: Aiding Regulatory Compliance by Quantifying the Privacy Risks of Machine Learningcited by 66
  10. 2018A Modern Take on the Bias-Variance Tradeoff in Neural Networkscited by 64
  11. 2015Learning Causal Graphs with Small Interventionscited by 63
  12. 2020RealCause: Realistic Causal Inference Benchmarkingcited by 44
  13. 2013Data Analysis with Bayesian Networks: A Bootstrap Approachcited by 31
  14. 2019Alleviating Privacy Attacks via Causal Learningcited by 19
  15. 2018Causal Identification under Markov Equivalencecited by 15

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 5; 2024: 5; 2025: 2; 2026: 4.

17 papers.

Sort:

By area:

  1. 2023Benchmarking and Explaining Large Language Model-based Code Generation: A Causality-Centric Approachcited by 15
  2. 2023Causality-Aided Trade-off Analysis for Machine Learning Fairnesscited by 6
  3. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  4. 2025Differentiation-Based Extraction of Proprietary Data from Fine-Tuned LLMscited by 6
  5. 2022Provable Membership Inference Privacycited by 4
  6. 2023Fundamental Limits of Membership Inference Attacks on Machine Learning Modelscited by 4
  7. 2023Survey on AI Ethics: A Socio-technical Perspectivecited by 4
  8. 2024Unveiling the Unseen: Exploring Whitebox Membership Inference through the Lens of Explainabilitycited by 4
  9. 2025CompLeak: Deep Learning Model Compression Exacerbates Privacy Leakagecited by 3
  10. 2024Silver Linings in the Shadows: Harnessing Membership Inference for Machine Unlearningcited by 2
  11. 2024The Power of Bias: Optimizing Client Selection in Federated Learning with Heterogeneous Differential Privacycited by 2
  12. 2026Causal Evaluation of Membership Inference Attackscited by 2
5 more
  1. 2024Inference Attacks Against Face Recognition Model without Classification Layerscited by 1
  2. 2024Efficiently Achieving Secure Model Training and Secure Aggregation to Ensure Bidirectional Privacy-Preservation in Federated Learningcited by 0
  3. 2026Reconstruction of Personally Identifiable Information from Proprietary Data in Supervised Fine-Tuned Modelscited by 0
  4. 2026Certification of Machine Learning Models via Directional Sharpnesscited by 0
  5. 2026The Privacy Fallacy of Crowdsourced Fine-Tuning: Extracting Proprietary Data via Topic-Based Poisoningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Membership Inference Attacks on Large-Scale Models: A Survey
  2. 2025Score-based Membership Inference on Diffusion Models
  3. 2023A Probabilistic Fluctuation based Membership Inference Attack for Diffusion Models
  4. 2023Diffence: Fencing Membership Privacy With Diffusion Models
  5. 2023Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Models
  6. 2026Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noise
  7. 2026DIME: Query-Efficient Framework for Membership Inference on Diffusion Models
  8. 2025Defending Diffusion Models Against Membership Inference Attacks via Higher-Order Langevin Dynamics