Research map / Adversarial robustness and security / Attacks on text and graphs
OSLO: One-Shot Label-Only Membership Inference Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes OSLO, a one-query label-only membership inference attack that uses transfer-based adversarial examples with validation-model-controlled perturbation budgets to separate members from non-members with high precision.
Problem
Label-only membership inference attacks against deep models are query-expensive (thousands of queries per sample), have low precision, and perform poorly at low false positive rates.
Approach
Members resist adversarial perturbations more than non-members, so OSLO crafts per-sample transferable adversarial examples from surrogate source models, stopping early when validation models' confidence on the true class falls below a threshold tau, then queries the target once: a sample that is still correctly classified is inferred to be a member.
Key results
- On CIFAR-10 with ResNet18, OSLO reaches 96.2% precision at 5% recall using a single query, versus at most 71.4% for prior label-only attacks.
- On CIFAR-100 with ResNet18, OSLO achieves 6.7% TPR at 0.1% FPR versus 0.3% for the best prior label-only attack, and 18.9% TPR at 1% FPR versus at most 2.7%.
- OSLO maintains over 95% precision when target models use SGD while surrogates use Adam.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use OSLO instead of the best other label-only attack | Label-only MIA on CIFAR-100 with ResNet18 · CIFAR-100, ResNet18, 0.1% FPR | TPR: 0.3% to 6.7% | Helped |
| Use OSLO instead of the best other label-only attack | Label-only MIA on CIFAR-100 with ResNet18 · CIFAR-100, ResNet18, 1% FPR | TPR: 2.7% to 18.9% | Helped |
| Use OSLO instead of the strongest other label-only attack at similar recall | Label-only MIA on CIFAR-10, CIFAR-100, and SVHN with ResNet18 · CIFAR-10, CIFAR-100, and SVHN | precision: 96.2% vs 67.4%; 92.0% vs 82.5%; 90.9% vs 65.2% | Helped |
| Replace Boundary Attack (QEBA) with OSLO | Label-only MIA on CIFAR-10 with ResNet18 · CIFAR-10, ResNet18 | attack precision (recall > 1%): 71.4% -> 96.2% | Helped |
| Use Adam-trained surrogate models while the target uses SGD | OSLO on CIFAR-10 with ResNet18 · CIFAR-10, ResNet18 | attack precision: 95.9%; 95.3% | No clear effect |
| Replace the confidence-threshold stopping criterion with label-flip stopping (ablation) | OSLO on CIFAR-10 with ResNet18 · CIFAR-10, ResNet18 | FPR: 0.9% -> 30.8% | Hurt |
| Remove validation models and use a uniform perturbation budget (ablation) | OSLO on CIFAR-10 with ResNet18 · CIFAR-10, ResNet18 | attack effectiveness | Hurt |
| Use more than one query per sample (ablation) | OSLO · Precision-recall analysis | precision and recall | No clear effect |
| Swap the transfer-based adversarial attack technique (ablation) | OSLO on CIFAR-10 · CIFAR-10 | membership inference effectiveness | No clear effect |
| Change source and validation model architecture combinations (ablation) | OSLO with ResNet18 target · Precision-recall trade-off | precision and recall | No clear effect |
| Increase the number of validation models (ablation) | OSLO · Precision-recall trade-off | precision | Helped |
| Adversarially train the target model while leaving surrogates without adversarial training | OSLO on CIFAR-10 with ResNet18 · CIFAR-10, ResNet18, τ=0.001 | FPR: 0.2% -> 52.7% | Hurt |
Surprising findings
- Stopping adversarial perturbation at label flip yields 30.8% FPR, so a confidence threshold rather than the decision boundary is needed for low FPR.
- Adversarial training of the target model reduces OSLO's low-FPR performance only when surrogates are not adversarially trained; with adversarially trained surrogates TPR at 0.1 threshold drops to 15.7% at 0.7% FPR.
Limitations
- Requires an auxiliary dataset from the same distribution as the target training set to train surrogate models.
- Adversarial training of both target and surrogate models substantially reduces OSLO's effectiveness (TPR 15.7% at 0.7% FPR).
- Multi-shot extensions give no significant improvement over single-shot.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 SVHN
Benchmarks: CIFAR-10 CIFAR-100 SVHN
Metrics: TPR at low FPR attack precision recall log ROC curve
Baselines: Transfer attack (label-only) Data augmentation attack Boundary attack (Gaussian noise) Boundary attack (HopSkipJump) Boundary attack (QEBA) YOQO
Builds on: Geometry-Aware adversarial attack framework MI-FGSM DI-FGSM TI-FGSM Admix
Closest papers by meaning
- Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning (ICLR 2024 · similarity 0.87)
- Exploring the limits of strong membership inference attacks on large language models (NeurIPS 2025 · similarity 0.87)
- Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinement (CVPR 2024 · similarity 0.86)
- Assessing Per-Sample Membership Inference Vulnerability without Retraining (NeurIPS 2026 · similarity 0.85)
- Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibration (NeurIPS 2024 · similarity 0.85)
- Semantic-Aware Multi-Label Adversarial Attacks (CVPR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.