Submission declined on 30 May 2026 by ChrysGalley (talk). This draft appears to contain text generated by a large language model (such as ChatGPT). You cannot use LLMs to generate article content. LLM-generated pages with certain obvious signs of being machine generated may be deleted without notice. These tools are prone to specific issues that violate our policies: hallucinations: they often invent false information and cite non-existent references. unencyclopedic tone: they tend to be vague, promotional, or essay-like, rather than neutral and factual. copyright issues: they may closely paraphrase existing text, leading to copyright violations. Instead, only summarize in your own words a range of independent, reliable, published sources that discuss the subject. See the advice page on large language models for more information. If you would like to continue working on the submission, click on the "Edit" tab at the top of the window. If you have not resolved the issues listed above, your draft will be declined again and potentially deleted. If you need extra help, please ask us a question at the AfC Help Desk or get live help from experienced editors. Please do not remove reviewer comments or this notice until the submission is accepted. Where to get help If you need help editing or submitting your draft, please ask us a question at the AfC Help Desk or get live help from experienced editors. These venues are only for help with editing and the submission process, not to get reviews. If you need feedback on your draft, or if the review is taking a lot of time, you can try asking for help on the talk page of a relevant WikiProject. Some WikiProjects are more active than others so a speedy reply is not guaranteed. How to improve a draft Wikipedia:Contributing to Wikipedia – a basic overview on how to edit Wikipedia. Help:Wikitext – how to use the markup Help:Referencing for beginners – how to include references Wikipedia:Article development – how to develop your article Wikipedia:Writing better articles – how to improve your article Wikipedia:Verifiability – make sure your article includes reliable third-party sources You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Add tags to your draft Editor resources Easy tools: Citation bot (help) | Advanced: Fix bare URLs Declined by ChrysGalley 6 days ago. Last edited by ChrysGalley 6 days ago. Reviewer: Inform author. Resubmit Please note that if the issues are not fixed, the draft will be declined again.

• Comment: Sources do not match the draft text. ChrysGalley (talk) 16:36, 30 May 2026 (UTC)

A membership inference attack (MIA) is a privacy attack in which an adversary, given the output of some function f(X) computed over a dataset X — for example, an aggregate statistic or a trained machine-learning model — and given a candidate record y, decides whether y ∈ X.^[1] MIAs are among the most basic and widely studied privacy attacks because successful membership inference can directly violate the privacy of data subjects — for instance, by revealing that an individual participated in a clinical study — and because they serve as the canonical empirical benchmark for evaluating privacy-preserving mechanisms.^[2]

The standard threat model formalizes the attack as a decision problem: given a target record y and access (black-box or white-box) to f(X), the adversary must output a single bit indicating its guess for whether y ∈ X. Attack quality is typically reported by ROC curves — specifically the true-positive rate at low false-positive rates — rather than by average accuracy.^[2]

Membership inference is closely tied to the original motivation for differential privacy, which was designed to bound the success of any adversary attempting to detect the presence or absence of a single record in a dataset.^[3] When a mechanism satisfies (ε, δ)-differential privacy, the advantage of any membership inference adversary over random guessing is provably bounded as a function of the privacy parameters, regardless of auxiliary knowledge.

The term "membership inference" was popularized by Shokri et al. (2017) in the context of machine learning as a service, but the underlying phenomenon — that releases derived from a dataset can leak information about individual contributors — was demonstrated earlier in the genomics and statistical-database literature.^[4]

Membership inference is distinct from, though sometimes related to, other privacy attacks.

• In an attribute inference attack, the adversary already knows that y ∈ X (or assumes it), and tries to infer a sensitive attribute of y from f(X) together with partial knowledge of y.
• In a reconstruction attack, the adversary tries to recover entire records of X from f(X) without being given any candidate y.
• In a training-data extraction attack (against generative models), the adversary tries to recover verbatim training records by querying the model — for example, prompting a large language model to regurgitate text it has memorized.

Membership inference is a strictly weaker decision problem than reconstruction or extraction: it produces only a single bit per query. However, MIA primitives are commonly used as building blocks for these stronger attacks, and a model that resists strong MIAs is generally considered to resist downstream reconstruction as well.^[2]

The earliest widely cited membership inference attack was demonstrated by Nils Homer and colleagues in 2008. Given access to minor allele frequencies released as part of a genome-wide association study (GWAS), the genotype of a target individual, and reference population statistics, the authors showed that an attacker could determine with high confidence whether the target individual's DNA had been included in the study's case group, even when the individual contributed less than 0.1% of the pooled sample.^[4] The result led the U.S. National Institutes of Health and the Wellcome Trust to remove aggregate GWAS allele-frequency data from public repositories.^[5]

Dwork, Smith, Steinke, Ullman, and Vadhan (FOCS 2015) generalized and strengthened these results in their analysis of "robust traceability from trace amounts," giving theoretical bounds showing that an attacker who knows a target's data can detect membership from sufficiently accurate summary statistics even when those statistics are heavily perturbed by measurement error or by noise added for privacy.^[6]

Membership inference has also been demonstrated against aggregated location and mobility data. Pyrgelis, Troncoso, and De Cristofaro (NDSS 2018) showed that an attacker with limited prior knowledge can determine whether a target user contributed to time-series aggregates produced by mobile-network operators or smart-city platforms, and that protections based on differential privacy reduce but do not eliminate the threat at realistic noise levels.^[7] Related attacks have been described against released census tabulations, online-advertising audience estimates, and recommender-system statistics.

Shokri, Stronati, Song, and Shmatikov (IEEE S&P 2017) introduced the canonical formulation of membership inference against supervised machine-learning classifiers. In their black-box setting, the adversary observes only the prediction vector returned by a target model on a query record. They train "shadow models" that mimic the target on similar data, use them to build a labelled dataset of (prediction, member/non-member) pairs, and finally train an "attack model" that decides membership for new records. The attack was shown to be effective against models trained through commercial machine-learning-as-a-service platforms.^[1]

Subsequent work has refined this template along several axes.

Black-box attacks assume only query access to the model's outputs (confidence scores or labels) and are the most common deployment-relevant setting. White-box attacks additionally assume access to model parameters, intermediate activations, or gradients; Nasr, Shokri, and Houmansadr (IEEE S&P 2019) showed that white-box access enables stronger attacks, particularly in federated learning where participants observe parameter updates each round.^[8] Label-only attacks, introduced by Choquette-Choo, Tramèr, Carlini, and Papernot (ICML 2021), remove the assumption that the adversary sees confidence scores at all and infer membership purely from how the model's hard label changes under input perturbations, defeating defenses that obfuscate confidence vectors.^[9]

Yeom, Giacomelli, Fredrikson, and Jha (CSF 2018) gave a formal analysis connecting MIAs to overfitting, showing that a gap between training and test loss is sufficient — though not strictly necessary — for an effective membership inference attack, and proposing a simple loss-thresholding attack as a baseline.^[10] This loss-based attack remains a standard baseline.

Salem et al. (NDSS 2019) demonstrated "ML-Leaks," showing that membership inference is feasible without knowing the target model's architecture or training distribution, and that attacks remain effective with a single shadow model.^[11]

Carlini, Chien, Nasr, Song, Terzis, and Tramèr (IEEE S&P 2022) argued that the field had been mismeasuring MIA success by reporting average accuracy, which is dominated by easy non-members; they proposed evaluating attacks by their true-positive rate at low false-positive rates (e.g., 0.1% or 0.001%) and introduced the Likelihood Ratio Attack (LiRA), which trains many reference shadow models to estimate per-example score distributions and is roughly an order of magnitude more powerful than prior attacks in this stringent regime.^[2]

Membership inference against large language models typically uses the target model's perplexity or per-token log-likelihood on the candidate sequence as the membership signal. Mattern et al. (ACL 2023) introduced a "neighbourhood comparison" attack that calibrates this signal against the model's loss on perturbed neighbours of the candidate, reducing the false-positive rate of plain loss thresholding.^[12] Shi et al. (ICLR 2024) proposed Min-K% Prob, a reference-free attack based on the observation that an unseen text is more likely than a seen one to contain a few tokens with very low probability under the model.^[13] A subsequent large-scale study by Duan et al. (COLM 2024) argued that, on LLMs trained for a single epoch on web-scale corpora, existing membership inference attacks barely outperform random guessing, attributing the difficulty to the size of the training set, the small number of passes over each example, and the fuzzy boundary between members and non-members in natural-language data.^[14]

Defenses against membership inference fall into three broad categories.

Provable defenses via differential privacy. Training with differential privacy — typically through differentially private stochastic gradient descent (DP-SGD), introduced by Abadi et al. (CCS 2016) — provides a quantitative upper bound on the success of any membership inference adversary as a function of the privacy budget ε.^[15] Empirically, DP-SGD substantially reduces MIA accuracy at meaningful ε, though at a measurable cost in model utility.

Regularization and generalization-improving methods. Because MIAs exploit the gap between a model's behavior on training and non-training data, techniques that reduce overfitting — including L2 regularization, dropout, early stopping, data augmentation, and knowledge distillation — empirically reduce MIA success, although they generally do not provide formal guarantees.^[10][16]

Output perturbation. MemGuard (Jia, Salem, Backes, Zhang, and Gong, CCS 2019) and related defenses inject crafted noise into the model's confidence vector — analogous to adversarial examples but aimed at the attacker — so that the published scores carry less information about training-set membership while preserving the top-1 prediction.^[17] Subsequent work has shown that output-perturbation defenses are bypassed by label-only attacks and by adaptive attackers, motivating renewed focus on differential privacy as the only defense with formal guarantees.^[9][2]

Beyond their direct privacy implications, membership inference attacks have become a standard auditing tool: regulators, model providers, and researchers use MIA success rates as an empirical measure of how much a deployed model or aggregate release leaks about its inputs, and MIAs are commonly used as a lower-bound benchmark for differentially private training. They have also been used to test whether a specific document was included in the pre-training corpus of a language model, with potential implications for copyright and personal-data compliance.^[13]

• Differential privacy
• Privacy in machine learning
• Reconstruction attack
• Model inversion attack
• Adversarial machine learning
• Re-identification

• Shokri et al., "Membership Inference Attacks Against Machine Learning Models" (arXiv)
• Carlini et al., "Membership Inference Attacks From First Principles" (arXiv)
• Pyrgelis et al., "Knock Knock, Who's There? Membership Inference on Aggregate Location Data" (NDSS 2018)
• Homer et al., "Resolving Individuals Contributing Trace Amounts of DNA…" (PLOS Genetics)

Category:Computer security Category:Cryptographic attacks Category:Privacy Category:Machine learning