Research map / Adversarial robustness and security / Attacks on text and graphs

Sequential Membership Inference Attacks

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: Membership inference and inversion · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Sequential Membership Inference (SeMI) attacks that exploit a sequence of released model snapshots and a controlled canary insertion time, deriving an optimal likelihood-ratio attack (SeMI*) with an isolation property and extending it to white-box and black-box attacks on (DP-)SGD for tighter privacy audits.

Problem

Privacy auditing of ML models that are released as a sequence of snapshots across training phases; existing audits look at a single final model and produce loose epsilon lower bounds.

Approach

Derive the likelihood-ratio test for membership of a canary inserted at a known step; show by an isolation property that the LR depends only on the batch statistic at insertion, so power does not dilute with later training as in final-model attacks, and extend to DP-SGD via a batch-gradient Gaussianity assumption.

Key results

• SeMI* power stays roughly constant in T while Final Observation power decays as the number of training steps grows, per the empirical-mean analysis.
• On DP-SGD softmax regression on Fashion-MNIST at epsilon=8, SeMI-SGD yields tighter empirical epsilon lower bounds than Delta, Back-Front, and LiRA baselines across T in {2,5,10}.
• Knowing the insertion time gives tighter audits than the max-over-tau variant in all three attack pairs.

Surprising findings

• Audit tightness for SeMI-SGD improves with later insertion times, since the per-transition signal is largest once the model has moved away from initialization.

Limitations

• SeMI-SGD relies on a batch-gradient Gaussianity approximation justified by CLT.
• Optimal insertion time is not known a priori and remains open.
• Experiments are on a softmax classifier on Fashion-MNIST in the main text; the sequential extension is limited to idealized settings.

Experimental setup

Datasets: Fashion-MNIST CIFAR-10 Purchase-100

Benchmarks: Fashion-MNIST

Metrics: empirical epsilon lower bound power (TPR at 1% FPR) ROC curves Type-I/II errors

Baselines: LiRA Delta attack Back-Front attack Final Observation test Loss Diff Loss Ratio

Builds on: Neyman-Pearson lemma DP-SGD LiRA Clopper-Pearson confidence intervals Back-Front and Delta attacks

Closest papers by meaning

• Low-Cost High-Power Membership Inference Attacks (ICML 2024 · similarity 0.86)
• Estimating Model-Level Membership Inference Vulnerability Without Reference Models (NeurIPS 2026 · similarity 0.86)
• Causal Evaluation of Membership Inference Attacks (NeurIPS 2026 · similarity 0.86)
• Exploring the limits of strong membership inference attacks on large language models (NeurIPS 2025 · similarity 0.86)
• Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models (NeurIPS 2024 · similarity 0.85)
• The Canary’s Echo: Auditing Privacy Risks of LLM-Generated Synthetic Text (ICML 2025 · similarity 0.85)