mlsanityData to 7 Oct 2026

Students Parrot Their Teachers: Membership Inference on Model Distillation

arXiv 2303.03446 ↗First posted 6 Mar 2023cs.CR cs.LGcited by 31

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Model distillation is frequently proposed as a technique to reduce the privacy leakage of machine learning. These empirical privacy defenses rely on the intuition that distilled ``student'' models protect the privacy of training data, as they only interact with this data indirectly through a ``teacher'' model. In this work, we design membership inference attacks to systematically study the privacy provided by knowledge distillation to both the teacher and student training sets. Our new attacks show that distillation alone provides only limited privacy across a number of domains. We explain the success of our attacks on distillation by showing that membership inference attacks on a private dataset can succeed even if the target model is *never* queried on any actual training points, but only on inputs whose predictions are highly influenced by training data. Finally, we show that our attacks are strongest when student and teacher sets are similar, or when the attacker can poison the teacher set.

Key facts. Cited by 31 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 28 of its 38 references that are in the map. First posted on arXiv 6 Mar 2023.

Builds on

28 of 38 references.

Closest ancestors · 4

Same direction, newest first

  1. 2022Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries19 Oct
  2. 2021Membership Inference Attacks From First Principles7 Dec
  3. 2021On the Importance of Difficulty Calibration in Membership Inference Attacks15 Nov
  4. 2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture15 Oct

Other references · 24

  1. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2020Extracting Training Data from Large Language Modelscited by 2,144
  4. 2019Self-training with Noisy Student improves ImageNet classificationcited by 1,304
  5. 2016Paying More Attention to Attention: Improving the Performance of Convolutional Neural Networks via Attention Transfercited by 1,059
  6. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  7. 2018Born Again Neural Networkscited by 539
  8. 2019Patient Knowledge Distillation for BERT Model Compressioncited by 502
  9. 2013Do Deep Nets Really Need to be Deep?cited by 466
  10. 2020Label-Only Membership Inference Attackscited by 371
  11. 2016Semi-supervised Knowledge Transfer for Deep Learning from Private Training Datacited by 347
  12. 2018Model compression via distillation and quantizationcited by 287
12 more
  1. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  2. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  3. 2018Paraphrasing Complex Network: Network Compression via Factor Transfercited by 255
  4. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  5. 2020Membership Leakage in Label-Only Exposurescited by 156
  6. 2022The Privacy Onion Effect: Memorization is Relativecited by 128
  7. 2020Revisiting Membership Inference Under Realistic Assumptionscited by 108
  8. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  9. 2022Less is More: Task-aware Layer-wise Distillation for Language Model Compressioncited by 91
  10. 2018Understanding Membership Inferences on Well-Generalized Learning Modelscited by 83
  11. 2022Amplifying Membership Exposure via Data Poisoningcited by 29
  12. 2022Differentially Private Model Compressioncited by 13

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 8; 2025: 11; 2026: 8.

31 papers.

Sort:

By area:

  1. 2023Red Teaming Language Model Detectors with Language Modelscited by 55
  2. 2023User Inference Attacks on Large Language Modelscited by 36
  3. 2024Teach LLMs to Phish: Stealing Private Information from Language Modelscited by 29
  4. 2024Auditing f-Differential Privacy in One Runcited by 28
  5. 2025Privacy Auditing of Large Language Modelscited by 22
  6. 2025Language Models May Verbatim Complete Text They Were Not Explicitly Trained Oncited by 20
  7. 2023TMI! Finetuned Models Leak Private Information from their Pretraining Datacited by 13
  8. 2025Privacy Ripple Effects from Adding or Removing Personal Information in Language Model Trainingcited by 9
  9. 2024TUNI: A Textual Unimodal Detector for Identity Inference in CLIP Modelscited by 8
  10. 2024Dataset Size Recovery from LoRA Weightscited by 7
  11. 2024GLiRA: Black-Box Membership Inference Attack via Knowledge Distillationcited by 6
  12. 2024Generalizing Trust: Weak-to-Strong Trustworthiness in Language Modelscited by 6
19 more
  1. 2025Cascading and Proxy Membership Inference Attackscited by 6
  2. 2026Antidistillation Fingerprintingcited by 6
  3. 2024DPDR: Gradient Decomposition and Reconstruction for Differentially Private Deep Learningcited by 4
  4. 2025Membership and Memorization in LLM Knowledge Distillationcited by 3
  5. 2024Learning-Based Difficulty Calibration for Enhanced Membership Inference Attackscited by 2
  6. 2025Memorization Inheritance in Sequence-Level Knowledge Distillation for Neural Machine Translationcited by 2
  7. 2025A hierarchical approach for assessing the vulnerability of tree-based classification models to membership inference attackcited by 2
  8. 2025Imitative Membership Inference Attackcited by 2
  9. 2026Memorization Dynamics in Knowledge Distillation for Language Modelscited by 2
  10. 2023Membership Inference Attacks on DNNs using Adversarial Perturbationscited by 1
  11. 2025On Membership Inference Attacks in Knowledge Distillationcited by 1
  12. 2026Quantifying the Effect of Test Set Contamination on Generative Evaluationscited by 1
  13. 2026SoK: Challenges in Tabular Membership Inference Attackscited by 1
  14. 2026Knowledge Distillation Must Account for What It Losescited by 1
  15. 2026Scaling Model-Generated Distillation Data Can Make Latent Teacher Traits More Recoverablecited by 1
  16. 2025FictionalQA: A Dataset for Studying Memorization and Knowledge Acquisitioncited by 0
  17. 2025Synthetic Adaptive Guided Embeddings (SAGE): A Novel Knowledge Distillation Methodcited by 0
  18. 2026Curation Leaks: Membership Inference Attacks against Data Curation for Machine Learningcited by 0
  19. 2026Membership Inference for Contrastive Pre-training Models with Text-only PII Queriescited by 0