Research map / Adversarial robustness and security / Attacks on text and graphs
Membership inference and inversion
Attack and defend models through membership inference, model inversion and reconstruction.
118 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2016–2026) · an approach in Attacks on text and graphs, keyword cluster “poisoning · membership · watermarking”
State History Benchmarks Tried Checklist Preprints Who Export
Where it stands
Few recent reports The tracked benchmarks have at most one report from 2025–26 that could beat the old record, too few to say whether they are still moving.
43 papers in 2023–24 and 42 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 15.4% to 8.6%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2016 · Optimizing Personalized Email Filtering Thresholds to Mitigate Sequential Spear Phishing Attacks (AAAI 2016 · 38 citations)
- 2018 · Contamination Attacks and Mitigation in Multi-Party Machine Learning (NeurIPS 2018 · 36 citations)
- 2020 · The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks (CVPR 2020 · 442 citations)
- 2021 · Amnesiac Machine Learning (AAAI 2021 · 202 citations)
- 2022 · Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations (CVPR 2022 · 78 citations)
- 2023 · Re-Thinking Model Inversion Attacks Against Deep Neural Networks (CVPR 2023 · 58 citations)
- 2024 · Learning to Unlearn: Instance-Wise Unlearning for Pre-trained Classifiers (AAAI 2024 · 40 citations)
- 2025 · Medical Multimodal Model Stealing Attacks via Adversarial Domain Alignment (AAAI 2025 · 7 citations)
- 2026 · Dual-View Inference Attack: Machine Unlearning Amplifies Privacy Exposure (AAAI 2026 · 2 citations)
Earliest papers here
- Optimizing Personalized Email Filtering Thresholds to Mitigate Sequential Spear Phishing Attacks (AAAI 2016 · 38 citations)
- Blind Attacks on Machine Learners (NeurIPS 2016 · 3 citations)
- Contamination Attacks and Mitigation in Multi-Party Machine Learning (NeurIPS 2018 · 36 citations)
Benchmark records
The best number each year that beat every earlier one, among papers of this approach reporting their own method. Numbers are extracted by AI from each paper's text; check the paper before citing.
CIFAR10 · accuracy (higher is better)
4 papers, 2022–2025 · one report since 2024, not better
| Year | Best so far | Set by |
|---|---|---|
| 2022 | 91.7 | Increasing the Cost of Model Extraction with Calibrated Proof of Work (ICLR 2022 · 7 citations) |
What has been tried
94 papers here report 1,029 measured changes (a component added, removed or swapped, compared with a baseline): helped 59%, no clear effect 9%, hurt 25%, mixed 7%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add adversarial-example regularization to NegGrad unlearning | CIFAR-10 test (k=16) · accuracy | 15.87 -> 65.14 | Helped | Learning to Unlearn: Instance-Wise Unlearning for Pre-trained Classifiers (AAAI 2024 · 40 citations) |
| Add the entropy objective to HEE construction | CIFAR-10 · Robust Acc | 18.26 -> 18.98 | Helped | Data-Free Hard-Label Robustness Stealing Attack (AAAI 2024 · 10 citations) |
| Remove oracle-generated diversified reports from ADA-Steal | MIMIC-CXR and IU X-Ray · model-stealing performance | Hurt | Medical Multimodal Model Stealing Attacks via Adversarial Domain Alignment (AAAI 2025 · 7 citations) | |
| Fine-tune only the last several layers instead of the whole model | PPA · AttAcc | 88.46 -> 22.36 | Helped | Model Inversion Robustness: Can Transfer Learning Help? (CVPR 2024 · 7 citations) |
| Add item-level penalty factor | ML-1M, Steam, and Beauty (NARM-to-NARM) · Agr@10 | 0.647 -> 0.710; 0.620 -> 0.642; 0.351 -> 0.398 | Helped | Sim4Rec: Data-Free Model Extraction Attack on Sequential Recommendation (AAAI 2025 · 6 citations) |
| Add wavelet regularization without SAM | horse2zebra · FID | 115.09 -> 100.69 | Helped | Towards Model Extraction Attacks in GAN-Based Image Translation via Domain Shift Mitigation (AAAI 2024 · 5 citations) |
| use the optimized transition matrix instead of a uniform matrix | CIFAR100 → CIFAR10 · attacker accuracy | 71.43±2.26 -> 32.41±7.54 | Helped | Efficient Model Stealing Defense with Noise Transition Matrix (CVPR 2024 · 5 citations) |
| Project the entropy-loss gradient using natural gradient descent | Generated-image quality · FID | 33.73 to 10.98 | Helped | A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · 4 citations) |
| Remove the Auxiliary Model deviation-loss term, retaining only reconstruction loss (SAME-X) | MNIST and CIFAR-10 detection · Detection performance | No clear effect | SAME: Sample Reconstruction against Model Extraction Attacks (AAAI 2024 · 4 citations) | |
| Use class-conditional weighted distances rather than equal class weights | benign queries with distribution shifts · detection performance | Helped | Defense Against Model Stealing Based on Account-Aware Distribution Discrepancy (AAAI 2025 · 3 citations) | |
| Increase α from 0 to 0.9 | CelebA · attribute inference accuracy | 0.81 (0.31) -> 0.57 (0.07) | Helped | Learning Robust and Privacy-Preserving Representations via Information Theory (AAAI 2025 · 3 citations) |
| Add undistill loss | CIFAR-10 · test accuracy under distillation attack | 87.10 -> 35.23 | Helped | Ungeneralizable Examples (CVPR 2024 · 3 citations) |
What reviewers will expect
Datasets and baselines named in the 27 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 13 of 27 papers
- CIFAR-100 · 11 of 27 papers
- MNIST · 6 of 27 papers
- SVHN · 3 of 27 papers
- Fashion-MNIST · 3 of 27 papers
- TinyImageNet · 3 of 27 papers
- CINIC-10 · 3 of 27 papers
- GTSRB · 2 of 27 papers
Baselines
- LiRA · 4 of 27 papers
- RMIA · 4 of 27 papers
- SCRUB · 3 of 27 papers
- Random · 2 of 27 papers
- Gradient Ascent · 2 of 27 papers
- NegGrad+ · 2 of 27 papers
- L1-Sparse · 2 of 27 papers
- Retrain · 2 of 27 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 85 papers; from OpenAlex and the papers' affiliations).
- Zhejiang University · 5 papers
- Nanyang Technological University · 5 papers
- Carnegie Mellon University · 4 papers
- Google · 4 papers
- University of Waterloo · 3 papers
- CISPA Helmholtz Center for Information Security · 3 papers
- New York University · 3 papers
- Hong Kong Baptist University · 3 papers
- University of Maryland, College Park · 3 papers
- Amazon · 3 papers
Use it
Download BibTeX of 39 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Neural network watermarking (53 papers)
- Clean-label data poisoning (41 papers)
Elsewhere in the topic
- LLM jailbreak and injection defense (113 papers)
- Adversarial prompts for language models (98 papers)
- Defenses against universal perturbations (97 papers)
- Vision-language model robustness (96 papers)
- Attacks and defenses in sequential settings (96 papers)
- Diffusion-based adversarial purification (78 papers)
- Biologically inspired robust vision (77 papers)
- Graph neural network robustness (71 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).