cs.LGFeb 18, 2026

Sequential Membership Inference Attacks

Authors: Thomas Michel, Debabrota Basu, Emilie Kaufmann

Organizations: Univ. Lille, Inria, CNRS, Centrale Lille UMR 9189-CRIStAL, France

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Modern AI models are not static. They go through multiple updates in their lifecycles. We propose to design Sequential Membership Inference (SeMI) attacks leading to tighter privacy audits by exploiting the sequence of models and injecting a target canary at a controlled insertion time. First, for empirical mean computation, we develop SeMI*, an {optimal SeMI attack to identify the presence of a target inserted at a specific insertion step}. We derive the power of SeMI* to show that accessing the model sequence yields more powerful MI attacks than scrutinising only the final model. SeMI* exhibits an isolation property -- its power depends on the statistics obtained right before and after insertion of the target. Leveraging this insight, we develop practical white-box (accessing model gradients) and black-box (accessing loss) SeMI attacks against models trained with (DP-)SGD. Across datasets and models trained with (DP-)SGD, our experiments show that SeMI attacks achieve higher powers than snapshot-independent baselines, and yield tighter privacy audits thanks to (a) control over the insertion time and (b) observations across the model sequence.

Figures & tables

Figure 1: Sequential MI game: Crafter controls a mechanism that releases TT outputs (o1,…,oT)(o_{1},\ldots,o_{T}) . With probability 1/21/2 , the target z∗z^{*} is inserted into batch DτD_{\tau} at step τ\tau . Otherwise, the mechanism runs unmodified. The adversary observes all outputs and decides whether z∗z^{*} is inserted ( H1H_{1} ) or not ( H0H_{0} ).
Figure 2
VariantKnowledge of τ\tauTest statisticOptimality
SeMI∗\mathrm{SeMI}^{\ast}known τ\taulog⁡LRτ\log\mathrm{LR}_{\tau}NP-optimal against H1τ\mathbf{H_{1}^{\tau}}
SeMIUnif\mathrm{SeMI}^{\mathrm{Unif}}τ∼U([T])\tau\sim\mathcal{U}([T])log⁡1T∑t=1TLRt\log\frac{1}{T}\sum_{t=1}^{T}\mathrm{LR}_{t}NP-optimal against H1~\widetilde{\mathbf{H_{1}}}
SeMImax⁡\mathrm{SeMI}^{\max}unknownmax⁡tlog⁡LRt\max_{t}\log\mathrm{LR}_{t}GLR against ⋃tH1t\bigcup_{t}\mathbf{H_{1}^{t}}
SeMISGD\mathrm{SeMI}^{\mathrm{SGD}}known τ\tau , (DP-)SGDThm. 4.1NP-optimal for Gaussian-gradient approx.
Table 1: SeMI variants. All attacks threshold a log-LR statistic on the observed snapshot sequence and rely on the isolation property of Lemma 3.2 . LRt\mathrm{LR}_{t} is the single-time likelihood ratio of Theorem 3.1 . The SGD variant is introduced in Section 4 . (NP=Neyman Pearson)
Figure 4
Figure 4: ROC curves at T=5T=5 snapshots on Fashion-MNIST of SeMI variants and attack baselines.
Figure 5: Empirical privacy bound ε^\hat{\varepsilon} at ε=8\varepsilon=8 , δ=10−4\delta=10^{-4} with fixed training steps LL . Higher is tighter.
Figure 6: Distribution of empirical epsilon lower bounds at δ=10−4\delta=10^{-4} .
Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Log-likelihood ratio under the disjoint-batch protocol ( n=10n=10 , τ=5\tau=5 ).
Figure 8: Power comparison under the disjoint-batch protocol ( n=10n=10 , TPR at 1% FPR). The qualitative behavior matches the subsampled-with-replacement protocol used in the main text.
Figure 9: ROC curves comparing SeMI∗\mathrm{SeMI}^{\ast} , SeMIUnif\mathrm{SeMI}^{\mathrm{Unif}} , SeMImax⁡\mathrm{SeMI}^{\max} , and Final Observation for different TT .
Figure 10: SGD validation on linear regression. (a) ROC curves. (b) Power vs τ\tau . SeMISGD\mathrm{SeMI}^{\mathrm{SGD}} maintains power across τ\tau in this linear-regression setting; on the deep-model audit of Sec. 5 , audit tightness instead grows with τ\tau (Observation 4).
Figure 11: Multivariate setting. (a) Decision boundary in 2D. (b) Power vs dimension dd .
Figure 12: Private fine-tuning with T=10T=10 DP-SGD updates and known τ\tau . Estimated ε\varepsilon lower bound versus ground-truth ε\varepsilon , averaged over τ∈{1,…,T}\tau\in\{1,\ldots,T\} . Closer to the diagonal is tighter. SeMISGD\mathrm{SeMI}^{\mathrm{SGD}} yields tighter lower bounds than loss-based heuristics across the privacy range.
Figure 13: ROC curves for Fashion-MNIST pretrain-then-finetune with DP-SGD. (a) Without DP noise, SeMISGD\mathrm{SeMI}^{\mathrm{SGD}} achieves near-perfect discrimination. (b) With DP-SGD ( ε=1.0\varepsilon=1.0 ), SeMISGD\mathrm{SeMI}^{\mathrm{SGD}} maintains an advantage over heuristic baselines. Cut at FPR =0.01=0.01 .
Figure 14: Effect of insertion time selection on Fashion-MNIST. Solid lines: averaged over τ\tau . Dashed lines: best τ\tau (post hoc selection). Selecting the optimal insertion time yields tighter privacy lower bounds.
More in this topic

Membership Inference Attacks

Membership inference attacks test whether records or entities were used to train a machine-learning model, revealing potential privacy leakage.

See all 111 papers

Explore similar work

CardsList

  1. Mitigating Membership Inference in Intermediate Representations with Differentially Private Training

    Feb 26, 2026Jiayang Meng, Tao Huang, Chen Hou +2Differentially Private Stochastic Gradient DescentMembership Inference Attacks

    School of Information, Renmin University of China, Beijing, China · School of Computer Science and Big Data, Minjiang University, Fuzhou, Fujian, China

  2. CheckMIABench: Firm Foundations For Membership Inference Attacks on Language Models

    Jun 16, 2026Jeffrey G. Wang, Jason Wang, Marvin Li +1LLM EvaluationMembership Inference Attacks

    Harvard University · Harvard Business School

  3. ReproMIA: A Comprehensive Analysis of Model Reprogramming for Proactive Membership Inference Attacks

    Mar 30, 2026Chihan Huang, Huaijin Wang, Shuai WangMembership Inference AttacksPrivacy Leakage in Language Models

    HKUST, Hong Kong, China