Research map / Adversarial robustness and security / Black-box and transfer attacks
White-box vs Black-box: Bayes Optimal Strategies for Membership Inference
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the Taylor score instead of the loss-only MALT score | Membership inference on logistic regression · CIFAR-10 truck vs boat, n=400 | attack accuracy: 54.4 -> 57.0 | Helped |
| Use the Taylor score instead of the loss-only MALT score | Membership inference on logistic regression · CIFAR-10 truck vs boat, n=1000 | attack accuracy: 52.6 -> 54.5 | Helped |
| Use the Taylor score instead of the loss-only MALT score | Membership inference on logistic regression · CIFAR-10 truck vs boat, n=2000 | attack accuracy: 51.7 -> 53.0 | Helped |
| Use the Taylor score instead of the loss-only MALT score | Membership inference on logistic regression · CIFAR-10 truck vs boat, n=4000 | attack accuracy: 51.4 -> 52.1 | Helped |
| Use the Taylor score instead of the loss-only MALT score | Membership inference on logistic regression · CIFAR-10 truck vs boat, n=6000 | attack accuracy: 51.0 -> 51.8 | Helped |
| Use the loss threshold rather than the 0-1 correctness heuristic | Membership inference with a small CNN · CIFAR-10 | attack accuracy: 69.4 -> 77.1 | Helped |
| Estimate a sample-specific threshold rather than a constant threshold | MALT membership inference on a small CNN · CIFAR-10 | attack accuracy: 77.1 -> 77.6 | Helped |
| Use the loss threshold rather than the 0-1 correctness heuristic | Membership inference with ResNet-101 · ImageNet, no augmentation | attack accuracy: 76.3 -> 90.4 | Helped |
| Use the loss threshold rather than the 0-1 correctness heuristic | Membership inference with VGG-16 · ImageNet, no augmentation | attack accuracy: 77.4 -> 90.8 | Helped |
| Increase data augmentation from none to Flip + Crop ±5, then Flip + Crop | ResNet-101 membership inference · ImageNet | attack accuracy: 90.4 -> 77.4 -> 68.0 | Hurt |
| Increase data augmentation from none to Flip + Crop ±5, then Flip + Crop | VGG-16 membership inference · ImageNet | attack accuracy: 90.8 -> 79.5 -> 64.3 | Hurt |
Closest papers by meaning
- Practical Bayes-Optimal Membership Inference Attacks (NeurIPS 2025 · similarity 0.90)
- Low-Cost High-Power Membership Inference Attacks (ICML 2024 · similarity 0.87)
- Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning (ICLR 2024 · similarity 0.86)
- Confidence Is All You Need for MI Attacks (Student Abstract) (AAAI 2024 · similarity 0.85)
- What Really is a Member? Discrediting Membership Inference via Poisoning (NeurIPS 2025 · similarity 0.85)
- Exploring the limits of strong membership inference attacks on large language models (NeurIPS 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.