membership inference attack

Membership inference attacks determine whether specific data points were in a model's training set. **Threat**: Privacy violation - knowing someone's data was used for training reveals information about them. **Attack intuition**: Models behave differently on training data (more confident, lower loss) vs unseen data. Attacker exploits this gap. **Attack methods**: **Threshold-based**: If model confidence exceeds threshold, predict "member". **Shadow models**: Train similar models, learn to distinguish train/test behavior. **Loss-based**: Lower loss on input → likely member. **LiRA (Likelihood Ratio Attack)**: Compare distributions of model outputs across many shadow models. **Defenses**: Differential privacy (formal guarantee), regularization (reduces memorization), early stopping, train-test gap minimization. **Factors increasing vulnerability**: Overfitting, small training sets, repeated examples, unique data points. **Evaluation**: Precision/recall of membership prediction, AUC-ROC. **Implications**: Reveals if sensitive data was used for training, enables auditing data usage, privacy regulations compliance testing. **ML privacy auditing**: Membership inference used to evaluate training privacy.