A Unified Perspective on Adversarial Membership Manipulation in Vision Models

Ruize Gao; Kaiwen Zhou; Yongqiang Chen; Feng Liu

cs.CVApr 3, 2026

A Unified Perspective on Adversarial Membership Manipulation in Vision Models

Authors: Ruize Gao, Kaiwen Zhou, Yongqiang Chen, Feng Liu

Organizations: Knowin AI · The Chinese University of Hong Kong · The University of Melbourne

Abstract

Membership inference attacks (MIAs) aim to determine whether a specific data point was part of a model's training set, serving as effective tools for evaluating privacy leakage of vision models. However, existing MIAs implicitly assume honest query inputs, and their adversarial robustness remains unexplored. We show that MIAs for vision models expose a previously overlooked adversarial surface: adversarial membership manipulation, where imperceptible perturbations can reliably push non-member images into the "member" region of state-of-the-art MIAs. In this paper, we provide the first unified perspective on this phenomenon by analyzing its mechanism and implications. We begin by demonstrating that adversarial membership fabrication is consistently effective across diverse architectures and datasets. We then reveal a distinctive geometric signature - a characteristic gradient-norm collapse trajectory - that reliably separates fabricated from true members despite their nearly identical semantic representations. Building on this insight, we introduce a principled detection strategy grounded in gradient-geometry signals and develop a robust inference framework that substantially mitigates adversarial manipulation. Extensive experiments show that fabrication is broadly effective, while our detection and robust inference strategies significantly enhance resilience. This work establishes the first comprehensive framework for adversarial membership manipulation in vision models.

Figures & tables

Figure 1: Overview of the Background and Our Proposed Research Problems.

Panel of Figure 2 — Figure 2: Imperceptible Adversarial Perturbations on ImageNet-100 . The first row are the original non-members, and the second row are the corresponding perturbed fabricated members. We used $\epsilon=2/255$ for $\mathcal{B}_{\epsilon}[x]$ here. The perturbations are extremely imperceptible to the human eye, which demonstrates that the Member Fabrication Attack ( MFA ) can be successful with only the addition of very small perturbations.

Figure 3: Objective of adversarial attacks (left) vs. MFA (right). The black and red dots denote the original input and the perturbed sample within the

\epsilon

-ball (gray region). Adversarial attacks push inputs into the misclassification region (orange), where

\max_{i\neq y}p_{i}>p_{y}

. In contrast, MFA drives inputs into high-confidence regions.

Figure 4: Visualization of the Distribution of Fabricated and True Members in Different Semantic Feature Spaces Using t-SNE [ 38 ] . The two subfigures represent the semantic features at the penultimate and antepenultimate layers, with perturbation constrained to

|\delta|_{\infty}\leq 4/255

. Red and blue dots denote true and fabricated members, respectively. The high degree of overlap of the red dots and blue dots suggests that semantic features alone are insufficient to distinguish between them.

Figure 5: Decay of Gradient Norm with Respect to Input Across Steps. As the steps increases, the gradient norm with respect to the input progressively diminishes. For clarity, a large epsilon ball (

\|\delta\|_{\infty}\leq 8/255

) is selected, alongside a small initial step size of

1/24\times(8/255)

, across 20 steps.

Figure 6: Distribution of fabricated and true members across different detection strategies. The first plot (left) shows the Mahalanobis distance, the second plot (middle) shows the Local Intrinsic Dimensionality (LID) values, and the third plot (right) presents the gradient norm with respect to the input. We use the relative frequency within each membership class as the vertical axis. The gradient norm in the third plot demonstrates superior distinguishability between fabricated and true members, where the other two show limited differentiation. The perturbation is constrained to

\|\delta\|_{\infty}\leq 4/255

here.

Panel of Figure 7 — Figure 7: Representative Experimental Results. Subfigures (a-c) demonstrate the superior performance of ( MFA ) compared to baselines, highlighting its effectiveness across different MIAs and datasets. Subfigures (d-f) show the effectiveness of ( MFD ) across varying perturbation levels $\epsilon$ and datasets. Subfigures (g-i) illustrate the effectiveness of our Adversarially Robust Strategies in combination with different strong MIAs across multiple datasets.

Error Area $(\\|\delta\\|_{\infty}\leq 4.0/255)$
Dataset	I [ 39 ]	II [ 13 ]	III	IV [OURS]
CIFAR-10	0.9399	0.9369	0.9444	0.9451
CIFAR-100	0.5917	0.5880	0.6120	0.6136
SVHN	0.9548	0.9560	0.9612	0.9618
CINIC-10	0.9198	0.9162	0.9318	0.9324
Equal Error Rate (EER) $(\\|\delta\\|_{\infty}\leq 4.0/255)$

Table 1: Ablation study of MFA with four step size strategies.

Appendix figures & tables27 assets

Supplementary material from the paper’s appendix.

Appendix

$p_{y}(x)$ bin	member	fabricated
$[0.90,0.95]$	$1.09\pm 0.21$	$\mathbf{0.73\pm 0.18}$
$[0.95,0.98]$	$0.93\pm 0.17$	$\mathbf{0.58\pm 0.15}$
$[0.98,0.99]$	$0.82\pm 0.15$	$\mathbf{0.49\pm 0.14}$

Appendix

Table 2: Confidence-matched comparison of input-gradient norms. Fabricated samples consistently exhibit smaller gradient norms than true members within the same target-class confidence range.

Panel of Figure 8 — Figure 8: Visualization of the Distribution of Fabricated and True Members in Different Semantic Feature Spaces Using t-SNE [ 38 ] . The first row displays the semantic features at the penultimate layer, with perturbation constrained to $(\|\delta\|_{\infty}\leq 2.0/255)$ to $(\|\delta\|_{\infty}\leq 6.0/255)$ from left to right. The second row shows the semantic features at the antepenultimate layer, with the same range of perturbations. Red dots represent true members’ semantic features, and blue dots represent fabricated members. We observe a high degree of overlap between the distributions of fabricated and true members, indicating that semantic features alone are insufficient to distinguish between them.

Panel of Figure 9 — Figure 9: Imperceptible Adversarial Perturbations on ImageNet-100 . For each pair, the top image is the original non-member, and the bottom image is the corresponding perturbed fabricated member, demonstrating that the perturbations are imperceptible to the human eyes. We used $\epsilon=2/255$ for $\mathcal{B}_{\epsilon}[x]$ here.

Panel of Figure 10 — Figure 10: Imperceptible Adversarial Perturbations on ImageNet-100 . For each pair, the top image is the original non-member, and the bottom image is the corresponding perturbed fabricated member, demonstrating that the perturbations are imperceptible to the human eyes. We used $\epsilon=2/255$ for $\mathcal{B}_{\epsilon}[x]$ here.

Panel of Figure 11 — Figure 11: Imperceptible Adversarial Perturbations on ImageNet-100 . For each pair, the top image is the original non-member, and the bottom image is the corresponding perturbed fabricated member, demonstrating that the perturbations are imperceptible to the human eyes. We used $\epsilon=2/255$ for $\mathcal{B}_{\epsilon}[x]$ here.

Panel of Figure 12 — Figure 12: Comparison of the Error Area Between Our Member Fabrication Attack and Baselines Across Diverse MIAs $(\|\delta\|_{\infty}\leq 4.0/255)$ .

Panel of Figure 13 — Figure 13: Comparison of the Error Area Between Our Member Fabrication Attack and Baselines Across Diverse Perturbation Bounds on CIFAR-10 .

Panel of Figure 14 — Figure 14: Comparison of the Error Area Between Our Member Fabrication Attack and Baselines Across Diverse Perturbation Bounds on CIFAR-100 .

Panel of Figure 15 — Figure 15: Comparison of the Error Area Between Our Member Fabrication Attack and Baselines Across Diverse Perturbation Bounds on CINIC-10 .

Panel of Figure 16 — Figure 16: Comparison of the Error Area Between Our Member Fabrication Attack and Baselines Across Diverse Perturbation Bounds on SVHN .

Panel of Figure 17 — Figure 17: Comparison of the Error Area Between Our Member Fabrication Attack and Baselines Across Diverse Perturbation Bounds on ImageNet-100 .

Panel of Figure 18 — Figure 18: Comparison of the ROC Curve for Our Member Fabrication Detection Across Diverse Perturbation Bounds on CIFAR-10 .

Panel of Figure 19 — Figure 19: Comparison of the ROC Curve for Our Member Fabrication Detection Across Diverse Perturbation Bounds on CIFAR-100 .

Panel of Figure 20 — Figure 20: Comparison of the ROC Curve for Our Member Fabrication Detection Across Diverse Perturbation Bounds on CINIC-10 .

Panel of Figure 21 — Figure 21: Comparison of the ROC Curve for Our Member Fabrication Detection Across Diverse Perturbation Bounds on SVHN .

Panel of Figure 22 — Figure 22: Comparison of the ROC Curve for Our Member Fabrication Detection Across Diverse Perturbation Bounds on ImageNet-100 .

Panel of Figure 23 — Figure 23: Comparison of ROC Curves for Our Adversarially Robust MIAs and Baselines on CIFAR-10 .

Panel of Figure 24 — Figure 24: Comparison of ROC Curves for Our Adversarially Robust MIAs and Baselines on CIFAR-100 .

Panel of Figure 25 — Figure 25: Comparison of ROC Curves for Our Adversarially Robust MIAs and Baselines on SVHN .

Panel of Figure 26 — Figure 26: Comparison of ROC Curves for Our Adversarially Robust MIAs and Baselines on CINIC-10 .

CIFAR-10
Perturbation	Natural	I-FGSM	I-BIM	I-PGD	I-CW	I-APGD	OURS
$\\|\delta\\|_{\infty}\leq 1.0/255$	0.3685	0.5649	0.5955	0.5953	0.5818	0.5942	0.5969
$\\|\delta\\|_{\infty}\leq 2.0/255$	0.3685	0.6773	0.7723	0.7719	0.7477	0.7679	0.7761
$\\|\delta\\|_{\infty}\leq 3.0/255$	0.3685	0.7374	0.8833	0.8827	0.8593	0.8783	0.8887
$\\|\delta\\|_{\infty}\leq 4.0/255$	0.3685	0.7706	0.9403	0.9399	0.9228	0.9369	0.9451
$\\|\delta\\|_{\infty}\leq 5.0/255$	0.3685	0.7883	0.9684	0.9680	0.9568	0.9657	0.9719

Appendix

Table 3: The Comparison of Error Area between Our Member Fabrication Attack with Baselines across Diverse Datasets.

Perturbation	Loss	LiRA	Attack R	RMIA
CIFAR-10
Natural	0.3685	0.2814	0.3110	0.2830
$\\|\delta\\|_{\infty}\leq 4.0/255$	0.9451	0.3523	0.8852	0.3502
CIFAR-100
Natural	0.1040	0.0423	0.1021	0.0808
$\\|\delta\\|_{\infty}\leq 4.0/255$	0.6136	0.3398	0.5217	0.3178

Appendix

Table 4: The Error Area of Our Member Fabrication Attack across Diverse MIAs and Datasets.

Perturbation	Loss	LiRA	Attack R	RMIA
CIFAR-10
Natural	42.30%	36.70%	36.35%	36.40%
$\\|\delta\\|_{\infty}\leq 4.0/255$	87.60%	41.85%	82.25%	38.20%
CIFAR-100
Natural	15.60%	12.10%	17.40%	18.30%
$\\|\delta\\|_{\infty}\leq 4.0/255$	59.80%	41.00%	67.20%	39.05%

Appendix

Table 5: The Equal Error Rate of Our Member Fabrication Attack across Diverse MIAs and Datasets.

CIFAR-10
Perturbation	Natural	I-FGSM	I-BIM	I-PGD	I-CW	I-APGD	OURS
$\\|\delta\\|_{\infty}\leq 1.0/255$	42.30%	56.60%	58.80%	58.75%	57.90%	58.65%	58.90%
$\\|\delta\\|_{\infty}\leq 2.0/255$	42.30%	65.00%	72.10%	72.10%	70.00%	71.85%	72.40%
$\\|\delta\\|_{\infty}\leq 3.0/255$	42.30%	69.40%	80.55%	80.55%	77.95%	80.10%	81.00%
$\\|\delta\\|_{\infty}\leq 4.0/255$	42.30%	71.80%	86.80%	86.75%	84.50%	86.30%	87.60%
$\\|\delta\\|_{\infty}\leq 5.0/255$	42.30%	73.20%	90.85%	90.75%	89.05%	90.50%	91.45%

Appendix

Table 6: The Comparison of Equal Error Rate between Our Member Fabrication Attack with Baselines across Diverse Datasets.

Methods	AUC value	EER value	TPR@1%FPR	TPR@5%FPR	TPR@10%FPR	TPR@20%FPR
CIFAR-10 $(\\|\delta\\|_{\infty}\leq 4.0/255)$
Attack R Baseline	0.4019	58.20%	0.37%	1.84%	3.68%	7.35%
[OURS] $\lambda=5$	0.7745	31.30%	9.80%	25.16%	35.25%	52.25%
[OURS] $\lambda=10$	0.7831	31.08%	11.05%	26.15%	37.55%	55.55%
[OURS] $\lambda=15$	0.7862	30.15%	10.85%	26.75%	37.55%	56.08%
[OURS] $\lambda=20$	0.7871	29.80%	11.13%	25.80%	39.46%	56.10%

Appendix

Table 7: Comparison of Attack R and Our Adversarially Robust Attack R.

Methods	AUC value	EER value	TPR@1%FPR	TPR@5%FPR	TPR@10%FPR	TPR@20%FPR
CIFAR-10 $(\\|\delta\\|_{\infty}\leq 4.0/255)$
LiRA Baseline	0.6832	38.48%	2.80%	9.55%	17.55%	32.25%
[OURS] $\lambda=5$	0.7925	28.95%	4.55%	18.45%	34.35%	57.05%
[OURS] $\lambda=10$	0.7937	28.23%	3.60%	17.95%	32.95%	57.00%
[OURS] $\lambda=15$	0.7927	28.43%	3.55%	17.05%	31.95%	55.50%
[OURS] $\lambda=20$	0.7913	28.60%	3.50%	16.95%	31.25%	54.25%

Appendix

Table 8: Comparison of LiRA and Our Adversarially Robust LiRA.

Methods	AUC value	EER value	TPR@1%FPR	TPR@5%FPR	TPR@10%FPR	TPR@20%FPR
CIFAR-10 $(\\|\delta\\|_{\infty}\leq 4.0/255)$
RMIA Baseline	0.6834	37.30%	8.55%	18.50%	28.95%	42.80%
[OURS] $\lambda=5$	0.7834	30.88%	10.90%	25.60%	36.40%	51.65%
[OURS] $\lambda=10$	0.7941	29.98%	11.30%	25.85%	38.15%	55.65%
[OURS] $\lambda=15$	0.7988	29.23%	11.10%	25.70%	37.90%	56.90%
[OURS] $\lambda=20$	0.8021	28.82%	11.00%	25.45%	37.95%	58.25%

Appendix

Table 9: Comparison of RMIA and Our Adversarially Robust RMIA.

Membership Inference Attacks

Membership inference attacks test whether records or entities were used to train a machine-learning model, revealing potential privacy leakage.

See all 116 papers

COMPASS: Membership Inference Attack Against Vision Large Language Models via Adaptive Noise Calibration
Oct 12, 2026Damien Lo, Hong Kyu Lee, Ruixuan Liu +1Membership Inference Attacks Large Vision-Language Models
Department of Computer Science, Emory University, Atlanta, GA
DistractMIA: Black-Box Membership Inference on Vision-Language Models via Semantic Distraction
May 12, 2026Hongyi Tang, Zhihao Zhu, Yi YangVision-Language Models Membership Inference Attacks
The Hong Kong University of Science and Technology
VLALeaks: Membership Inference Attacks against Vision-Language-Action Models
Jun 13, 2026Xukun Luan, Jinyan Liu, Xuesong Li +4Membership Inference Attacks Privacy Leakage in Language Models
School of Computer Science and Technology, Beijing Institute of Technology · School of Computer Science and Engineering, Northeastern University · PRADA Lab, King Abdullah University of Science and Technology

Oct 12, 2026J/K move · Enter open · S save

COMPASS: Membership Inference Attack Against Vision Large Language Models via Adaptive Noise Calibration

Damien Lo, Hong Kyu Lee, Ruixuan Liu, Li Xiong

Department of Computer Science, Emory University, Atlanta, GA

Membership Inference Attacks Large Vision-Language Models

Open paper AskPDF arXiv

Vision large language models (VLLMs) are deployed in privacy-sensitive domains, raising training-data exposure concerns. Existing gray-box membership inference attacks (MIAs) commonly rely on entropy statistics or generated descriptions, requiring costly generation with limited membership separation. Perturbation-based methods instead measure response changes but focus on large perturbations, leaving VLLM membership behavior under smaller perturbations poorly understood. We systematically characterize VLLM membership behavior under controlled Gaussian perturbations across noise levels at fine resolution. We find that optimal perturbation magnitude and membership-signal direction vary across model-dataset pairs. In many settings, a previously unstudied low-noise regime yields stronger separation than large perturbations, with members exhibiting lower divergence than non-members, reversing the conventional score direction. Other settings retain the conventional direction, demonstrating that neither a fixed perturbation magnitude nor a predetermined score orientation is universally reliable. We propose COMPASS, an adaptive gray-box MIA that calibrates both the perturbation magnitude and membership-score direction using a loosely distribution-matched, known non-member reference set. We instantiate COMPASS using Renyi-normalized KL divergence and Renyi divergence, with max-k aggregation over the most informative image-logit positions. Across LLaVA v1.5-7B, MiniGPT-4, and HuluMed-32B, spanning pretraining, instruction-tuning, and medical-image datasets, COMPASS outperforms baselines. On general-domain data, COMPASS achieves AUCs up to 0.88. On the distribution-matched medical evaluation, it reaches 0.64 AUC, while the strongest baseline remains at chance level. These results establish full-range adaptive perturbation analysis as an effective approach to VLLM membership inference.

Abstract

Membership Inference Attacks

Explore similar work

COMPASS: Membership Inference Attack Against Vision Large Language Models via Adaptive Noise Calibration

DistractMIA: Black-Box Membership Inference on Vision-Language Models via Semantic Distraction

VLALeaks: Membership Inference Attacks against Vision-Language-Action Models