mlsanityData to 14 Oct 2026

Gaussian Membership Inference Privacy

arXiv 2306.07273 ↗First posted 12 Jun 2023cs.LG cs.CR stat.MLcited by 21

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

We propose a novel and practical privacy notion called f-Membership Inference Privacy (f-MIP), which explicitly considers the capabilities of realistic adversaries under the membership inference attack threat model. Consequently, f-MIP offers interpretable privacy guarantees and improved utility (e.g., better classification accuracy). In particular, we derive a parametric family of f-MIP guarantees that we refer to as μ-Gaussian Membership Inference Privacy (μ-GMIP) by theoretically analyzing likelihood ratio-based membership inference attacks on stochastic gradient descent (SGD). Our analysis highlights that models trained with standard SGD already offer an elementary level of MIP. Additionally, we show how f-MIP can be amplified by adding noise to gradient updates. Our analysis further yields an analytical membership inference attack that offers two distinct advantages over previous approaches. First, unlike existing state-of-the-art attacks that require training hundreds of shadow models, our attack does not require any shadow model. Second, our analytical attack enables straightforward auditing of our privacy notion f-MIP. Finally, we quantify how various hyperparameters (e.g., batch size, number of model parameters) and specific data characteristics determine an attacker's ability to accurately infer a point's membership in the training set. We demonstrate the effectiveness of our method on models trained on vision and tabular datasets.

Key facts. Cited by 21 papers in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 29 of its 48 references that are in the map. First posted on arXiv 12 Jun 2023.

Builds on

29 of 48 references.

Closest ancestors · 8

Same direction, newest first

  1. 2022Provable Membership Inference Privacy12 Nov
  2. 2022On the Privacy Risks of Algorithmic Recourse10 Nov
  3. 2022Bayesian Estimation of Differential Privacy10 Jun
  4. 2022A Blessing of Dimensionality in Membership Inference through Regularization27 May
  5. 2022Bounding Membership Inference24 Feb
  6. 2022Parameters or Privacy: A Provable Tradeoff Between Overparameterization and Membership Inference2 Feb
  7. 2021Membership Inference Attacks From First Principles7 Dec
  8. 2021Enhanced Membership Inference Attacks against Machine Learning Models18 Nov

Other references · 21

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2019Advances and Open Problems in Federated Learningcited by 3,046
  3. 2016Deep Learning with Differential Privacycited by 2,728
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  5. 2020Extracting Training Data from Large Language Modelscited by 2,189
  6. 2023Extracting Training Data from Diffusion Modelscited by 732
  7. 2020Label-Only Membership Inference Attackscited by 388
  8. 2021Opacus: User-Friendly Differential Privacy Library in PyTorchcited by 383
  9. 2013The Composition Theorem for Differential Privacycited by 297
  10. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
  11. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 218
  12. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 199
9 more
  1. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 186
  2. 2020A Survey of Privacy Attacks in Machine Learningcited by 146
  3. 2022Reconstructing Training Data from Trained Neural Networkscited by 133
  4. 2023Privacy Auditing with One (1) Training Runcited by 123
  5. 2018Understanding Membership Inferences on Well-Generalized Learning Modelscited by 90
  6. 2019Hypothesis Testing Interpretations and Renyi Differential Privacycited by 85
  7. 2018Privacy-preserving Predictioncited by 48
  8. 2023One-shot Empirical Privacy Estimation for Federated Learningcited by 36
  9. 2022CANIFE: Crafting Canaries for Empirical Privacy Measurement in Federated Learningcited by 24

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 3; 2024: 7; 2025: 7; 2026: 4.

21 papers.

Sort:

By area:

  1. 2023In-Context Unlearning: Language Models as Few Shot Unlearnerscited by 224
  2. 2023Low-Cost High-Power Membership Inference Attackscited by 107
  3. 2024Machine Unlearning Fails to Remove Data Poisoning Attackscited by 37
  4. 2025Unifying Re-Identification, Attribute Inference, and Data Reconstruction Risks in Differential Privacycited by 15
  5. 2024OSLO: One-Shot Label-Only Membership Inference Attackscited by 13
  6. 2024Attack-Aware Noise Calibration for Differential Privacycited by 8
  7. 2024Mitigating Privacy Risk in Membership Inference by Convex-Concave Losscited by 6
  8. 2024Generalizing Trust: Weak-to-Strong Trustworthiness in Language Modelscited by 6
  9. 2025Train Once, Answer All: Many Pretraining Experiments for the Cost of Onecited by 6
  10. 2024Defending Membership Inference Attacks via Privacy-aware Sparsity Tuningcited by 4
  11. 2024Some Targets Are Harder to Identify than Others: Quantifying the Target-dependent Membership Leakagecited by 3
  12. 2025A hierarchical approach for assessing the vulnerability of tree-based classification models to membership inference attackcited by 3
9 more
  1. 2025How does Bayesian Sampling help Membership Inference Attacks?cited by 2
  2. 2023DP-DCAN: Differentially Private Deep Contrastive Autoencoder Network for Single-cell Clusteringcited by 1
  3. 2025MCMC for Bayesian estimation of Differential Privacy from Membership Inference Attackscited by 1
  4. 2025WARP: Weight Teleportation for Attack-Resilient Unlearning Protocolscited by 1
  5. 2026Sequential Membership Inference Attackscited by 1
  6. 2025Exposing and Defending Membership Leakage in Vulnerability Prediction Modelscited by 0
  7. 2026Learnability and Privacy Vulnerability are Entangled in a Few Critical Weightscited by 0
  8. 2026Validity Threats for Foundation Model Researchcited by 0
  9. 2026Predicting Privacy Leakage from Weight Spectral Densitycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2022Optimal Membership Inference Bounds for Adaptive Composition of Sampled Gaussian Mechanisms
  2. 2025Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble
  3. 2026Closed-Form Noise Calibration Against Membership Inference for Random-Allocation DP-SGD
  4. 2021Generalization Techniques Empirically Outperform Differential Privacy against Membership Inference
  5. 2026A Critical Review on the Effectiveness and Privacy Threats of Membership Inference Attacks
  6. 2025The Sample Complexity of Membership Inference and Privacy Auditing
  7. 2024Better Membership Inference Privacy Measurement through Discrepancy
  8. 2024Closed-Form Bounds for DP-SGD against Record-level Inference