A Simple Presentation of Robust Membership Inference Attacks

Renaud Gaucher; Ephraim Linder; Adam Smith; Jonathan Ullman; Lydia Zakynthinou

cs.CROct 27, 2026

A Simple Presentation of Robust Membership Inference Attacks

Authors: Renaud Gaucher, Ephraim Linder, Adam Smith, Jonathan Ullman, Lydia Zakynthinou

Organizations: CMAP, École Polytechnique, Inria. · Department of Computer Science, Boston University. · Khoury College of Computer Sciences, Northeastern University. · Department of Computer Science, Johns Hopkins University.

Abstract

In a membership inference attack, an attacker is given the data of a particular individual, and tries to determine if that individual was included in a particular dataset, given some kind of statistics derived from the dataset or a model trained on the dataset. Roughly, a membership inference attack is robust if it succeeds even when the statistics are highly noisy, regardless of how that noise is introduced. We give a simple presentation of robust membership inference attacks for mean estimation, covering both multivariate Gaussian distributions and binary product distributions. We also give a summary of the literature on robust membership inference, covering history, extensions, and connections to other research areas.

Figures & tables

Panel of Figure 1 — Figure 1: The basic membership inference setting. The tester observes the released output $A$ and a target record $Z$ . In the IN scenario , $Z=X_{I}$ for a uniformly random $I\in\{1,\ldots,n\}$ ; in the OUT scenario , $Z=X_{0}$ is drawn independently from $P$ . The two paths into $Z$ represent alternative scenarios.

Panel of Figure 2 — Figure 2: The inner product of the orange and blue vectors captures the expected value of the test statistic in the IN case ( Equation 1 ). The conditional distribution of $\mu$ given $X=x$ , depicted by the shaded gray area, is spherical, but in high dimension, most of the mass lies on vectors $\mu$ for which the blue vector $\bar{x}-\mu$ is roughly orthogonal to the dashed black line segment $a-\bar{x}$ . The choices for $\mu$ , where the orange-blue inner product is small or negative, occur with small probability under the conditional distribution of $\mu$ given $X=x$ . The low-score region is depicted as narrow for emphasis.

Membership Inference Attacks

Membership inference attacks test whether records or entities were used to train a machine-learning model, revealing potential privacy leakage.

See all 116 papers

The Sample Complexity of Membership Inference and Privacy Auditing
Aug 26, 2025Mahdi Haghifam, Adam Smith, Jonathan UllmanMembership Inference Attacks Sample Complexity
Khoury College of Computer Sciences, Northeastern University. · Department of Computer Science, Boston University.
A Critical Review on the Effectiveness and Privacy Threats of Membership Inference Attacks
Mar 24, 2026Najeeb Jebreel, David Sánchez, Josep Domingo-FerrerMembership Inference Attacks Privacy-Preserving ML
Universitat Rovira i Virgili, Department of Computer Engineering and Mathematics, CYBERCAT-Center for Cybersecurity Research of Catalonia, ComSCIAM-Center for Computational Science and Applied Mathematics Av. Països Catalans 26, 43007 Tarragona, Catalonia
Membership Inference via Pairwise Likelihood Ratios
Sep 11, 2026Shengjie Niu, Zebin Yun, Yeheng Ge +1Membership Inference Attacks Likelihood Ratio Testing
The Hong Kong Polytechnic University, Hong Kong, China · Tel Aviv University, Israel

Aug 26, 2025J/K move · Enter open · S save

The Sample Complexity of Membership Inference and Privacy Auditing

Mahdi Haghifam, Adam Smith, Jonathan Ullman

Khoury College of Computer Sciences, Northeastern University. · Department of Computer Science, Boston University.

Membership Inference Attacks Sample Complexity Privacy Auditing Statistical Learning Theory

Open paper AskPDF arXiv

A membership-inference attack gets the output of a learning algorithm, and a target individual, and tries to determine whether this individual is a member of the training data or an independent sample from the same distribution. A successful membership-inference attack typically requires the attacker to have some knowledge about the distribution that the training data was sampled from, and this knowledge is often captured through a set of independent reference samples from that distribution. In this work we study how much information the attacker needs for membership inference by investigating the sample complexity-the minimum number of reference samples required-for a successful attack. We study this question in the fundamental setting of Gaussian mean estimation where the learning algorithm is given

n

samples from a Gaussian distribution

\mathcal{N}(μ,Σ)

d

dimensions, and tries to estimate

\hatμ

up to some error

\mathbb{E}[\|\hat μ- μ\|^2_Σ]\leq ρ^2 d

. Our result shows that for membership inference in this setting,

Ω(n + n^2 ρ^2)

samples can be necessary to carry out any attack that competes with a fully informed attacker. Our result is the first to show that the attacker sometimes needs many more samples than the training algorithm uses to train the model. This result has significant implications for practice, as all attacks used in practice have a restricted form that uses

O(n)

samples and cannot benefit from

ω(n)

samples. Thus, these attacks may be underestimating the possibility of membership inference, and better attacks may be possible when information about the distribution is easy to obtain.

Abstract

Membership Inference Attacks

Explore similar work

The Sample Complexity of Membership Inference and Privacy Auditing

A Critical Review on the Effectiveness and Privacy Threats of Membership Inference Attacks

Membership Inference via Pairwise Likelihood Ratios