{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2603-07567","title":"Revisiting the LiRA Membership Inference Attack Under Realistic Assumptions","arxiv_id":"2603.07567","date":"2026-03-08","proceeding":null,"authors":["Najeeb Jebreel","Mona Khalil","David Sánchez","Josep Domingo-Ferrer"],"abstract":"Membership inference attacks (MIAs) have become the standard tool for evaluating privacy leakage in machine learning (ML). Among them, the Likelihood-Ratio Attack (LiRA) is widely regarded as the state of the art when sufficient shadow models are available. However, prior evaluations have often overstated the effectiveness of LiRA by attacking models overconfident on their training samples, calibrating thresholds on target data, assuming balanced membership priors, and/or overlooking attack reproducibility. We re-evaluate LiRA under a realistic protocol that (i) trains models using anti-overfitting (AOF) and transfer learning (TL), when applicable, to reduce overconfidence as in production models; (ii) calibrates decision thresholds using shadow models and data rather than target data; (iii) measures positive predictive value (PPV, or precision) under shadow-based thresholds and skewed membership priors (pi <= 10%); and (iv) quantifies per-sample membership reproducibility across different seeds and training variations. We find that AOF significantly weakens LiRA, while TL further reduces attack effectiveness while improving model accuracy. Under shadow-based thresholds and skewed priors, LiRA's PPV often drops substantially, especially under AOF or AOF+TL. We also find that thresholded vulnerable sets at extremely low FPR show poor reproducibility across runs, while likelihood-ratio rankings are more stable. These results suggest that LiRA, and likely weaker MIAs, are less effective than previously suggested under realistic conditions, and that reliable privacy auditing requires evaluation protocols that reflect practical training practices, feasible attacker assumptions, and reproducibility considerations. Code is available at https://github.com/najeebjebreel/lira_analysis.","url_abs":"https://arxiv.org/abs/2603.07567","url_pdf":"https://arxiv.org/pdf/2603.07567","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2603.07567","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2603.07567"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/najeebjebreel/lira_analysis","reach":null}],"summary":{"unverified":23},"by_repo_kind":{"found_in_text":{"samples":23,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"30c1c468615ed8aa","entry":"collect_topk_images","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/compose_top_vulnerable.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/compose_top_vulnerable.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"30c1c468615ed8aa"}},{"code_sha256_prefix":"a412bade5c864edb","entry":"compute_identical_over_thresholds","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/reproducibility_analysis.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/reproducibility_analysis.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a412bade5c864edb"}},{"code_sha256_prefix":"54526585121a623a","entry":"compute_precision","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/metrics.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/metrics.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"54526585121a623a"}},{"code_sha256_prefix":"99a772f122b776db","entry":"compute_roc_metrics","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/metrics.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/metrics.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"99a772f122b776db"}},{"code_sha256_prefix":"cf5ec905e15dd612","entry":"compute_tpr_at_fpr","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/metrics.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/metrics.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cf5ec905e15dd612"}},{"code_sha256_prefix":"982573cf8895bdfa","entry":"create_output_directory","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/analysis_utils.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/analysis_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"982573cf8895bdfa"}},{"code_sha256_prefix":"ca73aedeabad1c37","entry":"create_output_directory","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/run_analysis.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/run_analysis.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ca73aedeabad1c37"}},{"code_sha256_prefix":"e214cc0b45e0daee","entry":"fpr_to_tag","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/reproducibility_analysis.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/reproducibility_analysis.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e214cc0b45e0daee"}},{"code_sha256_prefix":"408beb717e5ac9fd","entry":"fpr_to_tag","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/run_analysis.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/run_analysis.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"408beb717e5ac9fd"}},{"code_sha256_prefix":"7f54c1a69ee2722e","entry":"freedman_diaconis_bins","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/plot_benchmark_distribution.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/plot_benchmark_distribution.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7f54c1a69ee2722e"}},{"code_sha256_prefix":"0128a2f4eb9aceaf","entry":"generate_reproducibility_panels","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/reproducibility_analysis.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/reproducibility_analysis.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0128a2f4eb9aceaf"}},{"code_sha256_prefix":"970e527fa55fb4bf","entry":"get_attack_methods","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"attack.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"970e527fa55fb4bf"}},{"code_sha256_prefix":"33f9972a2979215a","entry":"get_experiment_info","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/analysis_utils.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/analysis_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"33f9972a2979215a"}},{"code_sha256_prefix":"9ee0cfeab3854a74","entry":"load_experiment_config","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/analysis_utils.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/analysis_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9ee0cfeab3854a74"}},{"code_sha256_prefix":"67d36c79acbea5e2","entry":"load_pooled_thresholds","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/threshold_distribution.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/threshold_distribution.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"67d36c79acbea5e2"}},{"code_sha256_prefix":"a6bc219cba07af29","entry":"load_thresholds_filtered","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/threshold_distribution.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/threshold_distribution.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a6bc219cba07af29"}},{"code_sha256_prefix":"2aa1b93743d08c9d","entry":"mean_std","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/rank_stability_utils.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/rank_stability_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2aa1b93743d08c9d"}},{"code_sha256_prefix":"b4263be4e1529343","entry":"normalize_columns","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/loss_ratio_tpr.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/loss_ratio_tpr.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b4263be4e1529343"}},{"code_sha256_prefix":"08a2335c3fcc3802","entry":"parse_panel","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/plot_benchmark_distribution.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/plot_benchmark_distribution.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"08a2335c3fcc3802"}},{"code_sha256_prefix":"e4629aee855b31c7","entry":"resolve_config_paths","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/plot_benchmark_distribution.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/plot_benchmark_distribution.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e4629aee855b31c7"}},{"code_sha256_prefix":"1a7471281a81be03","entry":"robust_stats_1d","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/rank_stability_utils.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/rank_stability_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1a7471281a81be03"}},{"code_sha256_prefix":"34e81e2a77283b09","entry":"safe_spearman","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/rank_stability_utils.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/rank_stability_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"34e81e2a77283b09"}},{"code_sha256_prefix":"096a5b0d17325f3e","entry":"save_latex_summary","repo":"najeebjebreel/lira_analysis","repo_kind":"found_in_text","path":"comprehensive_analysis/run_analysis.py","file_url":"https://github.com/najeebjebreel/lira_analysis/blob/HEAD/comprehensive_analysis/run_analysis.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"096a5b0d17325f3e"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.LG","source":"arxiv_2026.jsonl"},"syntology_extracted_results":null}