mlsanityData to 14 Oct 2026

Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries

arXiv 2210.10750 ↗First posted 19 Oct 2022cs.LG cs.CRcited by 40

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

As industrial applications are increasingly automated by machine learning models, enforcing personal data ownership and intellectual property rights requires tracing training data back to their rightful owners. Membership inference algorithms approach this problem by using statistical techniques to discern whether a target sample was included in a model's training set. However, existing methods only utilize the unaltered target sample or simple augmentations of the target to compute statistics. Such a sparse sampling of the model's behavior carries little information, leading to poor inference capabilities. In this work, we use adversarial tools to directly optimize for queries that are discriminative and diverse. Our improvements achieve significantly more accurate membership inference than existing methods, especially in offline scenarios and in the low false-positive regime which is critical in legal settings. Code is available at https://github.com/YuxinWenRick/canary-in-a-coalmine.

Key facts. Cited by 40 papers in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 28 of its 35 references that are in the map. First posted on arXiv 19 Oct 2022.

Builds on

28 of 35 references.

Closest ancestors · 5

Same direction, newest first

  1. 2022Membership Inference Attacks by Exploiting Loss Trajectory31 Aug
  2. 2022How to Combine Membership-Inference Attacks on Multiple Updated Models12 May
  3. 2022Parameters or Privacy: A Provable Tradeoff Between Overparameterization and Membership Inference2 Feb
  4. 2021Membership Inference Attacks From First Principles7 Dec
  5. 2021Membership Inference Attacks on Machine Learning: A Survey14 Mar

Other references · 23

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  4. 2016Wide Residual Networkscited by 3,070
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  6. 2016Deep Learning with Differential Privacycited by 2,728
  7. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  8. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 864
  9. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
  10. 2020Label-Only Membership Inference Attackscited by 388
  11. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 292
  12. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
11 more
  1. 2022Patches Are All You Need?cited by 201
  2. 2022Datamodels: Predicting Predictions from Training Datacited by 189
  3. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 175
  4. 2022The Privacy Onion Effect: Memorization is Relativecited by 136
  5. 2022Measuring Forgetting of Memorized Training Examplescited by 118
  6. 2019Analyzing Information Leakage of Updates to Natural Language Modelscited by 90
  7. 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 67
  8. 2021Stochastic Training is Not Necessary for Generalizationcited by 63
  9. 2022Can Neural Nets Learn the Same Model Twice? Investigating Reproducibility and Double Descent from the Decision Boundary Perspectivecited by 57
  10. 2018Algorithms that Remember: Model Inversion Attacks and Data Protection Lawcited by 55
  11. 2020Quantifying Membership Inference Vulnerability via Generalization Gap and Other Model Metricscited by 13

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 1; 2023: 8; 2024: 13; 2025: 9; 2026: 9.

40 papers.

Sort:

By area:

  1. 2022Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Modelscited by 424
  2. 2023Privacy Auditing with One (1) Training Runcited by 123
  3. 2023Low-Cost High-Power Membership Inference Attackscited by 107
  4. 2024Detecting, Explaining, and Mitigating Memorization in Diffusion Modelscited by 95
  5. 2023Scalable Membership Inference Attacks via Quantile Regressioncited by 65
  6. 2023Practical Membership Inference Attacks Against Large-Scale Multi-Modal Models: A Pilot Studycited by 38
  7. 2024Evaluations of Machine Learning Privacy Defenses are Misleadingcited by 36
  8. 2023Students Parrot Their Teachers: Membership Inference on Model Distillationcited by 33
  9. 2024Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Modelscited by 30
  10. 2024Is Difficulty Calibration All We Need? Towards More Practical Membership Inference Attackscited by 21
  11. 2023Leave-one-out Distinguishability in Machine Learningcited by 20
  12. 2024Inf2Guard: An Information-Theoretic Framework for Learning Privacy-Preserving Representations against Inference Attackscited by 13
28 more
  1. 2024OSLO: One-Shot Label-Only Membership Inference Attackscited by 13
  2. 2023MIST: Defending Against Membership Inference Attacks Through Membership-Invariant Subspace Trainingcited by 12
  3. 2024The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGDcited by 11
  4. 2024GLiRA: Black-Box Membership Inference Attack via Knowledge Distillationcited by 7
  5. 2024U Can't Gen This? A Survey of Intellectual Property Protection Methods for Data in Generative AIcited by 7
  6. 2024A Method to Facilitate Membership Inference Attacks in Deep Learning Modelscited by 7
  7. 2025Cascading and Proxy Membership Inference Attackscited by 6
  8. 2023Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoningcited by 5
  9. 2025The Hitchhiker's Guide to Efficient, End-to-End, and Tight DP Auditingcited by 5
  10. 2025Toward Efficient Inference Attacks: Shadow Model Sharing via Mixture-of-Expertscited by 4
  11. 2025Has My System Prompt Been Used? Large Language Model Prompt Membership Inferencecited by 3
  12. 2025SolidMark: Evaluating Image Memorization in Generative Modelscited by 3
  13. 2025Imitative Membership Inference Attackcited by 3
  14. 2025Reasoning's Razor: Reasoning Improves Accuracy but Can Hurt Recall at Critical Operating Points in Safety and Hallucination Detectioncited by 3
  15. 2026Revisiting Privacy Leakage in Machine Unlearning: Membership Inference Beyond the Forgotten Setcited by 2
  16. 2024Better Membership Inference Privacy Measurement through Discrepancycited by 1
  17. 2024Universally Harmonizing Differential Privacy Mechanisms for Federated Learning: Boosting Accuracy and Convergencecited by 1
  18. 2025Apollo: A Posteriori Label-Only Membership Inference Attack Towards Machine Unlearningcited by 1
  19. 2024TDDBench: A Benchmark for Training data detectioncited by 0
  20. 2025Unveiling Client Privacy Leakage from Public Dataset Usage in Federated Distillationcited by 0
  21. 2026LeakBoost: Perceptual-Loss-Based Membership Inference Attackcited by 0
  22. 2026Boundary-targeted Membership Inference Attacks on Safety Classifierscited by 0
  23. 2026SoK: Colluding Adversaries in Machine Learning Pipelinescited by 0
  24. 2026Revealing Training Data Exposure in Vision Language Large Models via Parameter Gradientscited by 0
  25. 2026Discard the Dross and Select the Essential: Pre-query Sample Selection for Black-box Membership Inference Attackscited by 0
  26. 2026Membership Inference via Pairwise Likelihood Ratioscited by 0
  27. 2026Detecting Pretraining Data in Large Language Models from a Free-Energy Perspectivecited by 0
  28. 2026Calibrating One-Round Membership Inference with Neighborscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2022Membership Inference Attacks via Adversarial Examples
  2. 2022Evaluating Membership Inference Through Adversarial Robustness
  3. 2022Leveraging Adversarial Examples to Quantify Membership Information Leakage
  4. 2022On the Discredibility of Membership Inference Attacks
  5. 2022Membership-Doctor: Comprehensive Assessment of Membership Inference Against Machine Learning Models
  6. 2025Privacy Leaks by Adversaries: Adversarial Iterations for Membership Inference Attack
  7. 2022Membership Inference via Backdooring
  8. 2024Do Parameters Reveal More than Loss for Membership Inference?