membership inference attacks

**Membership Inference Attacks** are **privacy attacks that determine whether a specific data point was used in the model's training set** — exploiting differences in the model's behavior on training data vs. unseen data to infer membership, violating data privacy. **How Membership Inference Works** - **Confidence-Based**: Training examples typically get higher confidence predictions than non-members. - **Shadow Models**: Train shadow models on known datasets — use their membership behavior to train an attack classifier. - **Loss-Based**: Training examples have lower loss values — threshold the loss to determine membership. - **Label-Only**: Even with only hard labels, differences in prediction consistency reveal membership. **Why It Matters** - **Privacy Leakage**: Reveals that an individual's data was in the training set — violates privacy expectations. - **Overfitting Signal**: High membership inference accuracy indicates overfitting — model memorized training data. - **Defense**: Differential privacy, regularization, and knowledge distillation reduce membership information leakage. **Membership Inference** is **detecting training data fingerprints** — exploiting the model's differential behavior on members vs. non-members.