Membership Inference Attacks

Membership Inference Attacks are privacy attacks that determine whether a specific data point was used in the model's training set — exploiting differences in the model's behavior on training data vs. unseen data to infer membership, violating data privacy.

How Membership Inference Works

• Confidence-Based: Training examples typically get higher confidence predictions than non-members.
• Shadow Models: Train shadow models on known datasets — use their membership behavior to train an attack classifier.
• Loss-Based: Training examples have lower loss values — threshold the loss to determine membership.
• Label-Only: Even with only hard labels, differences in prediction consistency reveal membership.

Why It Matters

• Privacy Leakage: Reveals that an individual's data was in the training set — violates privacy expectations.
• Overfitting Signal: High membership inference accuracy indicates overfitting — model memorized training data.
• Defense: Differential privacy, regularization, and knowledge distillation reduce membership information leakage.

Membership Inference is detecting training data fingerprints — exploiting the model's differential behavior on members vs. non-members.