Research map / Adversarial robustness and security / Attacks on text and graphs
On the Difficulty of Membership Inference Attacks
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Report false alarm rate and balanced accuracy alongside positive-class metrics | MI attack evaluation on CIFAR-100 with ResNet · CIFAR-100 | false alarm rate: 64.45% | Hurt |
| Vary evaluation-set member:non-member ratio from 5:1 to 1:5 | the same MI attack model · evaluation-set balancedness | positive-class precision: 87.30% to 21.41% | Hurt |
| Use ZeroR, which always predicts member, as a baseline | MI attack evaluation · 5:1 member:non-member evaluation set | positive-class recall: MI Attack 87.85%; ZeroR 100.0% | No clear effect |
| Use confidence values to infer membership of correctly classified samples rather than all samples | confidence-based MI attacks · CIFAR-100, DenseNet | attack accuracy: 66.65% to 60.58% | Hurt |
| Use confidence values to infer membership of misclassified samples | confidence-based MI attacks · CIFAR-100, DenseNet | attack accuracy: 66.65% to 98.25% ± 9.2 | Helped |
| Use intermediate-layer outputs instead of confidence values | MI attacks on ImageNet with InceptionV3 · ImageNet, all data | attack accuracy: 50.03% ± 0.28 to 58.37% ± 7.8 | Helped |
| Use decision-boundary distance as the membership feature | MI attack on correctly classified CIFAR-100 DenseNet samples · CIFAR-100, correctly classified | attack accuracy: 49.74% ± 6.41 | No clear effect |
| Use gradient norms instead of confidence values | MI attack on correctly classified CIFAR-100 DenseNet samples · CIFAR-100, correctly classified | false alarm rate: 77.17% ± 15.28 to 6.12% ± 3.6 | Helped |
| Use gradient information on misclassified samples rather than confidence values | MI attacks · misclassified samples | membership information leakage | Hurt |
| Train target models without early stopping, allowing overfitting | CIFAR-10 and CIFAR-100 target models · correctly classified samples | MI attack accuracy | No clear effect |
| Train target models until overfitting begins | CIFAR-10 and CIFAR-100 target models · misclassified samples | MI attack accuracy | Helped |
| Apply early stopping to target-model training | CIFAR-10 and CIFAR-100 target models · membership inference on misclassified samples | MI attack success | Hurt |
Closest papers by meaning
- Membership Inference Attacks against Large Vision-Language Models (NeurIPS 2024 · similarity 0.90)
- Confidence Is All You Need for MI Attacks (Student Abstract) (AAAI 2024 · similarity 0.89)
- OSLO: One-Shot Label-Only Membership Inference Attacks (NeurIPS 2024 · similarity 0.89)
- Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibration (NeurIPS 2024 · similarity 0.89)
- Estimating Model-Level Membership Inference Vulnerability Without Reference Models (NeurIPS 2026 · similarity 0.88)
- Low-Cost High-Power Membership Inference Attacks (ICML 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.