mlsanityData to 7 Oct 2026

OSLO: One-Shot Label-Only Membership Inference Attacks

arXiv 2405.16978 ↗First posted 27 May 2024cs.LG cs.CRcited by 11

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

We introduce One-Shot Label-Only (OSLO) membership inference attacks (MIAs), which accurately infer a given sample's membership in a target model's training set with high precision using just a single query, where the target model only returns the predicted hard label. This is in contrast to state-of-the-art label-only attacks which require ~6000 queries, yet get attack precisions lower than OSLO's. OSLO leverages transfer-based black-box adversarial attacks. The core idea is that a member sample exhibits more resistance to adversarial perturbations than a non-member. We compare OSLO against state-of-the-art label-only attacks and demonstrate that, despite requiring only one query, our method significantly outperforms previous attacks in terms of precision and true positive rate (TPR) under the same false positive rates (FPR). For example, compared to previous label-only MIAs, OSLO achieves a TPR that is at least 7× higher under a 1% FPR and at least 22× higher under a 0.1% FPR on CIFAR100 for a ResNet18 model. We evaluated multiple defense mechanisms against OSLO.

Key facts. Cited by 11 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 42 of its 51 references that are in the map. First posted on arXiv 27 May 2024.

Builds on

42 of 51 references.

Closest ancestors · 9

Same direction, newest first

  1. 2023Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning5 Oct
  2. 2023Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Prediction4 Jul
  3. 2023Gaussian Membership Inference Privacy12 Jun
  4. 2022Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries19 Oct
  5. 2022Membership Inference Attacks by Exploiting Loss Trajectory31 Aug
  6. 2021Membership Inference Attacks From First Principles7 Dec
  7. 2021Enhanced Membership Inference Attacks against Machine Learning Models18 Nov
  8. 2021On the Importance of Difficulty Calibration in Membership Inference Attacks15 Nov
  9. 2021Practical Blind Membership Inference Attack via Differential Comparisons5 Jan

Other references · 33

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2016Densely Connected Convolutional Networkscited by 6,691
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  7. 2013Intriguing properties of neural networkscited by 5,114
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2016Deep Learning with Differential Privacycited by 2,682
  10. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,540
  11. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  12. 2016Identity Mappings in Deep Residual Networkscited by 1,960
21 more
  1. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  2. 2018ShuffleNet V2: Practical Guidelines for Efficient CNN Architecture Designcited by 1,132
  3. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  4. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  5. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  6. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  7. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  8. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  9. 2020Label-Only Membership Inference Attackscited by 371
  10. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  11. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  12. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  13. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
  14. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  15. 2020Membership Leakage in Label-Only Exposurescited by 156
  16. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  17. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 103
  18. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  19. 2017Feature-Guided Black-Box Safety Testing of Deep Neural Networkscited by 48
  20. 2020Blacklight: Scalable Defense for Neural Networks against Query-Based Black-Box Attackscited by 34
  21. 2022Towards Transferable Unrestricted Adversarial Examples with Minimum Changescited by 13

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 6; 2026: 5.

11 papers.

  1. 2025Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probingcited by 3
  2. 2025A hierarchical approach for assessing the vulnerability of tree-based classification models to membership inference attackcited by 2
  3. 2025Apollo: A Posteriori Label-Only Membership Inference Attack Towards Machine Unlearningcited by 1
  4. 2025ImpMIA: Leveraging Implicit Bias for Membership Inference Attackcited by 1
  5. 2026Private Prediction via PAC Privacycited by 1
  6. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  7. 2025Membership Inference Attack with Partial Featurescited by 0
  8. 2025Empirical Comparison of Membership Inference Attacks in Deep Transfer Learningcited by 0
  9. 2026LoMime: Query-Efficient Membership Inference using Model Extraction in Label-Only Settingscited by 0
  10. 2026idSCD: Identifying Training Datasets through Semantic Correlation Descriptorscited by 0
  11. 2026Predicting Privacy Leakage from Weight Spectral Densitycited by 0