mlsanityData to 14 Oct 2026

Better Membership Inference Privacy Measurement through Discrepancy

arXiv 2405.15140 ↗First posted 24 May 2024cs.LGcited by 1

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Membership Inference Attacks have emerged as a dominant method for empirically measuring privacy leakage from machine learning models. Here, privacy is measured by the emadvantage or gap between a score or a function computed on the training and the test data. A major barrier to the practical deployment of these attacks is that they do not scale to large well-generalized models -- either the advantage is relatively low, or the attack involves training multiple models which is highly compute-intensive. In this work, inspired by discrepancy theory, we propose a new empirical privacy metric that is an upper bound on the advantage of a family of membership inference attacks. We show that this metric does not involve training multiple models, can be applied to large Imagenet classification models in-the-wild, and has higher advantage than existing metrics on models trained with more recent and sophisticated training recipes. Motivated by our empirical results, we also propose new membership inference attacks tailored to these training losses.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 39 of its 60 references that are in the map. First posted on arXiv 24 May 2024.

Builds on

39 of 60 references.

Closest ancestors · 14

Same direction, newest first

  1. 2024On the Impact of Uncertainty and Calibration on Likelihood-Ratio Membership Inference Attacks16 Feb
  2. 2024Do Membership Inference Attacks Work on Large Language Models?12 Feb
  3. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibration10 Nov
  4. 2023Practical Membership Inference Attacks Against Large-Scale Multi-Modal Models: A Pilot Study29 Sep
  5. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparison29 May
  6. 2023Membership Inference Attacks against Diffusion Models7 Feb
  7. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  8. 2022Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries19 Oct
  9. 2022Membership Inference Attacks Against Text-to-image Generation Models3 Oct
  10. 2022M^4I: Multi-modal Models Membership Inference15 Sep
  11. 2022RelaxLoss: Defending Membership Inference Attacks without Losing Utility12 Jul
  12. 2022Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attacks8 Mar
2 more
  1. 2021On the Importance of Difficulty Calibration in Membership Inference Attacks15 Nov
  2. 2021EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learning25 Aug

Other references · 25

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  4. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
  5. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,884
  6. 2016Deep Learning with Differential Privacycited by 2,728
  7. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  8. 2017Random Erasing Data Augmentationcited by 1,239
  9. 2019Deep Leakage from Gradientscited by 1,021
  10. 2019When Does Label Smoothing Help?cited by 988
  11. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 864
  12. 2021Differentially Private Fine-tuning of Language Modelscited by 400
13 more
  1. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 292
  2. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 246
  3. 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 224
  4. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 199
  5. 2020Revisiting Membership Inference Under Realistic Assumptionscited by 112
  6. 2016Towards the Science of Security and Privacy in Machine Learningcited by 89
  7. 2022Are Your Sensitive Attributes Private? Novel Model Inversion Attribute Inference Attacks on Classification Modelscited by 43
  8. 2021Quantifying and Mitigating Privacy Risks of Contrastive Learningcited by 36
  9. 2020Investigating Membership Inference Attacks under Data Dependenciescited by 32
  10. 2019GAMIN: An Adversarial Approach to Black-Box Model Inversioncited by 19
  11. 2022Does CLIP Know My Face?cited by 19
  12. 2023Do SSL Models Have D'ej`a Vu? A Case of Unintended Memorization in Self-supervised Learningcited by 19
  13. 2022Does Label Differential Privacy Prevent Label Inference Attacks?cited by 11

Built on by

Cited by year

Citing papers per year: 2024: 1.

1 paper.

  1. 2024Bayes-Nash Generative Privacy Against Membership Inference Attackscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Can Membership Inferencing be Refuted?
  2. 2023Epsilon*: Privacy Metric for Machine Learning Models
  3. 2026A Full-Pipeline Framework for Evaluating Membership Inference Attacks in Machine Learning
  4. 2021Generalization Techniques Empirically Outperform Differential Privacy against Membership Inference
  5. 2024Defending Membership Inference Attacks via Privacy-aware Sparsity Tuning
  6. 2021SHAPr: An Efficient and Versatile Membership Privacy Risk Metric for Machine Learning
  7. 2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture
  8. 2022Membership Inference Attacks via Adversarial Examples