mlsanityData to 7 Oct 2026

Do Parameters Reveal More than Loss for Membership Inference?

arXiv 2406.11544 ↗First posted 17 Jun 2024cs.LG cs.AI cs.CRcited by 9

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Membership inference attacks are used as a key tool for disclosure auditing. They aim to infer whether an individual record was used to train a model. While such evaluations are useful to demonstrate risk, they are computationally expensive and often make strong assumptions about potential adversaries' access to models and training environments, and thus do not provide tight bounds on leakage from potential attacks. We show how prior claims around black-box access being sufficient for optimal membership inference do not hold for stochastic gradient descent, and that optimal membership inference indeed requires white-box access. Our theoretical results lead to a new white-box inference attack, IHA (Inverse Hessian Attack), that explicitly uses model parameters by taking advantage of computing inverse-Hessian vector products. Our results show that both auditors and adversaries may be able to benefit from access to model parameters, and we advocate for further research into white-box methods for membership inference.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 31 of its 43 references that are in the map. First posted on arXiv 17 Jun 2024.

Builds on

31 of 43 references.

Closest ancestors · 10

Same direction, newest first

  1. 2024Some Targets Are Harder to Identify than Others: Quantifying the Target-dependent Membership Leakage15 Feb
  2. 2024Is My Data in Your AI? Membership Inference Test (MINT) applied to Face Biometrics14 Feb
  3. 2024PANORAMIA: Privacy Auditing of Machine Learning Models without Retraining12 Feb
  4. 2023Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning5 Oct
  5. 2023Scalable Membership Inference Attacks via Quantile Regression7 Jul
  6. 2022Membership Inference Attack Using Self Influence Functions26 May
  7. 2022Membership Inference Attacks and Defenses in Neural Network Pruning7 Feb
  8. 2022Parameters or Privacy: A Provable Tradeoff Between Overparameterization and Membership Inference2 Feb
  9. 2021Membership Inference Attacks From First Principles7 Dec
  10. 2021Enhanced Membership Inference Attacks against Machine Learning Models18 Nov

Other references · 21

  1. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  4. 2018Rethinking the Value of Network Pruningcited by 595
  5. 2017Stochastic Gradient Descent as Approximate Bayesian Inferencecited by 298
  6. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  7. 2023Emergent and Predictable Memorization in Large Language Modelscited by 147
  8. 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 123
  9. 2018Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learningcited by 75
  10. 2020ML Privacy Meter: Aiding Regulatory Compliance by Quantifying the Privacy Risks of Machine Learningcited by 66
  11. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 47
  12. 2021Strength of Minibatch Noise in SGDcited by 39
9 more
  1. 2020Noise and Fluctuation of Finite Learning Rate Stochastic Gradient Descentcited by 36
  2. 2021Power-law escape rate of SGDcited by 29
  3. 2023Advancing Differential Privacy: Where We Are Now and Future Directions for Real-World Deploymentcited by 26
  4. 2023MoPe: Model Perturbation-based Privacy Attacks on Language Modelscited by 25
  5. 2023Leave-one-out Distinguishability in Machine Learningcited by 20
  6. 2023Investigating the Effect of Misalignment on Membership Privacy in the White-box Settingcited by 9
  7. 2023Noise Balance and Stationary Distribution of Stochastic Gradient Descentcited by 6
  8. 2019Bayesian interpretation of SGD as Ito processcited by 3
  9. 2023Series of Hessian-Vector Products for Tractable Saddle-Free Newton Optimisation of Neural Networkscited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 3; 2026: 5.

9 papers.

  1. 2025(Token-Level) InfoRMIA: Stronger Membership Inference and Memorization Assessment for LLMscited by 1
  2. 2025ImpMIA: Leveraging Implicit Bias for Membership Inference Attackcited by 1
  3. 2026SoK: Challenges in Tabular Membership Inference Attackscited by 1
  4. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  5. 2024How Learning Dynamics Drive Adversarially Robust Generalization?cited by 0
  6. 2025Empirical Comparison of Membership Inference Attacks in Deep Transfer Learningcited by 0
  7. 2026Assessing Per-Sample Membership Inference Vulnerability without Retrainingcited by 0
  8. 2026A Critical Review on the Effectiveness and Privacy Threats of Membership Inference Attackscited by 0
  9. 2026Predicting Privacy Leakage from Weight Spectral Densitycited by 0