mlsanityData to 7 Oct 2026

Can Membership Inferencing be Refuted?

arXiv 2303.03648 ↗First posted 7 Mar 2023cs.LG cs.CRcited by 4

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Membership inference (MI) attack is currently the most popular test for measuring privacy leakage in machine learning models. Given a machine learning model, a data point and some auxiliary information, the goal of an MI attack is to determine whether the data point was used to train the model. In this work, we study the reliability of membership inference attacks in practice. Specifically, we show that a model owner can plausibly refute the result of a membership inference test on a data point x by constructing a proof of repudiation that proves that the model was trained without x. We design efficient algorithms to construct proofs of repudiation for all data points of the training dataset. Our empirical evaluation demonstrates the practical feasibility of our algorithm by constructing proofs of repudiation for popular machine learning models on MNIST and CIFAR-10. Consequently, our results call for a re-evaluation of the implications of membership inference attacks in practice.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 41 of its 63 references that are in the map. First posted on arXiv 7 Mar 2023.

Builds on

41 of 63 references.

Closest ancestors · 4

Same direction, newest first

  1. 2022On the Discredibility of Membership Inference Attacks6 Dec
  2. 2021Membership Inference Attacks From First Principles7 Dec
  3. 2021Enhanced Membership Inference Attacks against Machine Learning Models18 Nov
  4. 2021On the Importance of Difficulty Calibration in Membership Inference Attacks15 Nov

Other references · 37

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  4. 2019Advances and Open Problems in Federated Learningcited by 3,021
  5. 2016Deep Learning with Differential Privacycited by 2,682
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  7. 2020Extracting Training Data from Large Language Modelscited by 2,144
  8. 2019Machine Unlearningcited by 1,020
  9. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  10. 2019Certified Data Removal from Machine Learning Modelscited by 512
  11. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  12. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 452
25 more
  1. 2019Making AI Forget You: Data Deletion in Machine Learningcited by 447
  2. 2021Remember What You Want to Forget: Algorithms for Machine Unlearningcited by 360
  3. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 330
  4. 2020Descent-to-Delete: Gradient-Based Methods for Machine Unlearningcited by 303
  5. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
  6. 2020Approximate Data Deletion from Machine Learning Modelscited by 250
  7. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 213
  8. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
  9. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  10. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
  11. 2021On the Necessity of Auditable Algorithmic Definitions for Machine Unlearningcited by 164
  12. 2021Machine Unlearning via Algorithmic Stabilitycited by 128
  13. 2020Revisiting Membership Inference Under Realistic Assumptionscited by 108
  14. 2016Towards the Science of Security and Privacy in Machine Learningcited by 89
  15. 2021Proof-of-Learning: Definitions and Practicecited by 81
  16. 2020ML Privacy Meter: Aiding Regulatory Compliance by Quantifying the Privacy Risks of Machine Learningcited by 66
  17. 2019Zeno++: Robust Fully Asynchronous SGDcited by 53
  18. 2021Leveraging Public Data for Practical Private Query Releasecited by 39
  19. 2020Private Query Release Assisted by Public Datacited by 27
  20. 2021EIFFeL: Ensuring Integrity for Federated Learningcited by 26
  21. 2021"Adversarial Examples" for Proof-of-Learningcited by 19
  22. 2020Sliding Window Algorithms for k-Clustering Problemscited by 7
  23. 2019The power of synergy in differential privacy: Combining a small curator with local randomizerscited by 6
  24. 2019Capacity Bounded Differential Privacycited by 5
  25. 2022Approximate Data Deletion in Generative Modelscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 1; 2025: 1; 2026: 1.

4 papers.

  1. 2025Language Models May Verbatim Complete Text They Were Not Explicitly Trained Oncited by 20
  2. 2024Optimistic Verifiable Training by Controlling Hardware Nondeterminismcited by 7
  3. 2023Why Train More? Effective and Efficient Membership Inference via Memorizationcited by 2
  4. 2026Quantifying the Effect of Test Set Contamination on Generative Evaluationscited by 1