mlsanityData to 14 Oct 2026

Practical Bayes-Optimal Membership Inference Attacks

arXiv 2505.24089 ↗First posted 30 May 2025cs.LG cs.CRcited by 5

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

We develop practical and theoretically grounded membership inference attacks (MIAs) against both independent and identically distributed (i.i.d.) data and graph-structured data. Building on the Bayesian decision-theoretic framework of Sablayrolles et al., we derive the Bayes-optimal membership inference rule for node-level MIAs against graph neural networks, addressing key open questions about optimal query strategies in the graph setting. We introduce BASE and G-BASE, tractable approximations of the Bayes-optimal membership inference. G-BASE achieves superior performance compared to previously proposed classifier-based node-level MIA attacks. BASE, which is also applicable to non-graph data, matches or exceeds the performance of prior state-of-the-art MIAs, such as LiRA and RMIA, at a significantly lower computational cost. Finally, we show that BASE and RMIA are equivalent under a specific hyperparameter setting, providing a principled, Bayes-optimal justification for the RMIA attack.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 31 of its 40 references that are in the map. First posted on arXiv 30 May 2025.

Builds on

31 of 40 references.

Closest ancestors · 8

Same direction, newest first

  1. 2024Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Data29 Sep
  2. 2024SeqMIA: Sequential-Metric Based Membership Inference Attack21 Jul
  3. 2023Low-Cost High-Power Membership Inference Attacks6 Dec
  4. 2023Scalable Membership Inference Attacks via Quantile Regression7 Jul
  5. 2022Membership Inference Attacks by Exploiting Loss Trajectory31 Aug
  6. 2021Membership Inference Attacks From First Principles7 Dec
  7. 2021Enhanced Membership Inference Attacks against Machine Learning Models18 Nov
  8. 2021On the Importance of Difficulty Calibration in Membership Inference Attacks15 Nov

Other references · 23

  1. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
  2. 2017Graph Attention Networkscited by 8,923
  3. 2017Inductive Representation Learning on Large Graphscited by 6,320
  4. 2018How Powerful are Graph Neural Networks?cited by 4,393
  5. 2016Wide Residual Networkscited by 3,070
  6. 2019Optuna: A Next-generation Hyperparameter Optimization Frameworkcited by 2,501
  7. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  8. 2020Extracting Training Data from Large Language Modelscited by 2,189
  9. 2016Convolutional Neural Networks on Graphs with Fast Localized Spectral Filteringcited by 2,089
  10. 2013Spectral Networks and Locally Connected Networks on Graphscited by 1,102
  11. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
  12. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 199
11 more
  1. 2020Stealing Links from Graph Neural Networkscited by 115
  2. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 84
  3. 2020Quantifying Privacy Leakage in Graph Embeddingcited by 82
  4. 2021Membership Inference Attack on Graph Neural Networkscited by 81
  5. 2021LinkTeller: Recovering Private Edges from Graph Neural Networks via Influence Analysiscited by 65
  6. 2021Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implicationscited by 52
  7. 2021Measuring Data Leakage in Machine-Learning Models with Fisher Informationcited by 33
  8. 2023Leave-one-out Distinguishability in Machine Learningcited by 20
  9. 2022Label-Only Membership Inference Attack against Node-Level Graph Neural Networkscited by 19
  10. 2023VertexSerum: Poisoning Graph Neural Networks for Link Inferencecited by 5
  11. 2024Publishing Neural Networks in Drug Discovery Might Compromise Training Data Privacycited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 3.

5 papers.

  1. 2025Practical Feasibility of Gradient Inversion Attacks in Federated Learningcited by 2
  2. 2025Privacy Risks in Time Series Forecasting: User- and Record-Level Membership Inferencecited by 0
  3. 2026Quantifying Membership Disclosure Risk for Tabular Synthetic Data Using Kernel Density Estimatorscited by 0
  4. 2026Exponential-Family Membership Inference: From LiRA and RMIA to BaVarIAcited by 0
  5. 2026FERMI: Exploiting Relations for Membership Inference Against Tabular Diffusion Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Bayesian Membership Privacy for Graph Neural Networks
  2. 2024Graph Transductive Defense: a Two-Stage Defense for Graph Membership Inference Attacks
  3. 2026SoK: Challenges in Tabular Membership Inference Attacks
  4. 2025Graph-Level Label-Only Membership Inference Attack against Graph Neural Networks
  5. 2025How does Bayesian Sampling help Membership Inference Attacks?
  6. 2022MIAShield: Defending Membership Inference Attacks via Preemptive Exclusion of Members
  7. 2026Impact of Graph Structure on Membership-Inference Risk for Graph Neural Networks
  8. 2025An Out-Of-Distribution Membership Inference Attack Approach for Cross-Domain Graph Attacks