mlsanityData to 14 Oct 2026

Discard the Dross and Select the Essential: Pre-query Sample Selection for Black-box Membership Inference Attacks

arXiv 2606.30081 ↗First posted 29 Jun 2026cs.CRcited by 0

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Black-box membership inference attacks (MIAs) rely on target-model queries to infer whether candidate samples were used for training. However, membership signals are highly non-uniform across samples: some candidate samples support strong member/non-member separability, whereas many others provide little useful signal. Consequently, indiscriminate querying can incur substantial query cost and increase query-induced exposure, with limited marginal benefit for inference. This raises a key question: which candidate samples are worth querying for black-box MIAs? To address this question, we propose PSS-MIA, a pre-query sample selection framework which can be embedded with any existing MIA methods. PSS-MIA proceeds in two stages: it first ranks candidate samples and selects a subset expected to support stronger membership inference, then queries the selected samples and uses the returned outputs for an existing black-box MIA, thereby reducing query cost and query-induced exposure. In the first stage, we propose Loss-Gap Ranking (LGR), which ranks candidate samples by estimating the strength of their membership signal using loss gaps computed from reference models. Experiments on CIFAR-10, CIFAR-100, and CINIC-10 with five representative black-box MIA methods demonstrate that PSS-MIA with LGR consistently outperforms all other compared methods. Moreover, under a 0.1% FPR constraint, PSS-MIA can save at least 83.1%, 60.6%, and 80.4% of the query budget for the three datasets, respectively.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 30 of its 39 references that are in the map. First posted on arXiv 29 Jun 2026.

Builds on

30 of 39 references.

Closest ancestors · 13

Same direction, newest first

  1. 2024Free Record-Level Privacy Risk Evaluation Through Artifact-Based Methods8 Nov
  2. 2024Is Difficulty Calibration All We Need? Towards More Practical Membership Inference Attacks31 Aug
  3. 2024SeqMIA: Sequential-Metric Based Membership Inference Attack21 Jul
  4. 2023Low-Cost High-Power Membership Inference Attacks6 Dec
  5. 2023Fundamental Limits of Membership Inference Attacks on Machine Learning Models20 Oct
  6. 2023Scalable Membership Inference Attacks via Quantile Regression7 Jul
  7. 2022Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries19 Oct
  8. 2022Membership Inference Attacks by Exploiting Loss Trajectory31 Aug
  9. 2022A Blessing of Dimensionality in Membership Inference through Regularization27 May
  10. 2021Membership Inference Attacks From First Principles7 Dec
  11. 2021Enhanced Membership Inference Attacks against Machine Learning Models18 Nov
  12. 2021On the Importance of Difficulty Calibration in Membership Inference Attacks15 Nov
1 more
  1. 2021Practical Blind Membership Inference Attack via Differential Comparisons5 Jan

Other references · 17

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2016Wide Residual Networkscited by 3,070
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  5. 2018An Empirical Study of Example Forgetting during Deep Neural Network Learningcited by 678
  6. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
  7. 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 497
  8. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 460
  9. 2020Label-Only Membership Inference Attackscited by 388
  10. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 292
  11. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
  12. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 175
5 more
  1. 2020Membership Leakage in Label-Only Exposurescited by 168
  2. 2019Privacy Risks of Securing Machine Learning Models against Adversarial Examplescited by 141
  3. 2022The Privacy Onion Effect: Memorization is Relativecited by 136
  4. 2023Can Neural Network Memorization Be Localized?cited by 69
  5. 2019Disparate Vulnerability to Membership Inference Attackscited by 35

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2022MIAShield: Defending Membership Inference Attacks via Preemptive Exclusion of Members
  2. 2023Why Train More? Effective and Efficient Membership Inference via Memorization
  3. 2026LoMime: Query-Efficient Membership Inference using Model Extraction in Label-Only Settings
  4. 2025How does Bayesian Sampling help Membership Inference Attacks?
  5. 2025ImpMIA: Leveraging Implicit Bias for Membership Inference Attack
  6. 2025Cascading and Proxy Membership Inference Attacks
  7. 2024Scaling Up Membership Inference: When and How Attacks Succeed on Large Language Models
  8. 2026Membership Inference via Pairwise Likelihood Ratios