Membership inference attacks determine whether specific data points were in a model's training set. Threat: Privacy violation - knowing someone's data was used for training reveals information about them. Attack intuition: Models behave differently on training data (more confident, lower loss) vs unseen data. Attacker exploits this gap. Attack methods: Threshold-based: If model confidence exceeds threshold, predict "member". Shadow models: Train similar models, learn to distinguish train/test behavior. Loss-based: Lower loss on input → likely member. LiRA (Likelihood Ratio Attack): Compare distributions of model outputs across many shadow models. Defenses: Differential privacy (formal guarantee), regularization (reduces memorization), early stopping, train-test gap minimization. Factors increasing vulnerability: Overfitting, small training sets, repeated examples, unique data points. Evaluation: Precision/recall of membership prediction, AUC-ROC. Implications: Reveals if sensitive data was used for training, enables auditing data usage, privacy regulations compliance testing. ML privacy auditing: Membership inference used to evaluate training privacy.