{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/membership-inference-attacks-from-first","title":"Membership Inference Attacks From First Principles","arxiv_id":"2112.03570","date":"2021-12-07","proceeding":null,"authors":["Nicholas Carlini","Steve Chien","Milad Nasr","Shuang Song","Andreas Terzis","Florian Tramer"],"abstract":"A membership inference attack allows an adversary to query a trained machine learning model to predict whether or not a particular example was contained in the model's training dataset. These attacks are currently evaluated using average-case \"accuracy\" metrics that fail to characterize whether the attack can confidently identify any members of the training set. We argue that attacks should instead be evaluated by computing their true-positive rate at low (e.g., <0.1%) false-positive rates, and find most prior attacks perform poorly when evaluated in this way. To address this we develop a Likelihood Ratio Attack (LiRA) that carefully combines multiple ideas from the literature. Our attack is 10x more powerful at low false-positive rates, and also strictly dominates prior attacks on existing metrics.","url_abs":"https://arxiv.org/abs/2112.03570v2","url_pdf":"https://arxiv.org/pdf/2112.03570v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"membership-inference-attacks-from-first","repo_url":"https://github.com/nicomanzonelli/topic_model_attacks","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":null},{"paper_slug":"membership-inference-attacks-from-first","repo_url":"https://github.com/privacytrustlab/ml_privacy_meter","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null},{"paper_slug":"membership-inference-attacks-from-first","repo_url":"https://github.com/ubc-tea/DESA","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"membership-inference-attacks-from-first","repo_url":"https://github.com/vlgiitr/confidence-is-all-you-need","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"jax","reach":null},{"paper_slug":"membership-inference-attacks-from-first","repo_url":"https://github.com/orientino/lira-pytorch","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[{"task_slug":"inference-attack","task_name":"Inference Attack"},{"task_slug":"membership-inference-attack","task_name":"Membership Inference Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2112.03570","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2112.03570"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ubc-tea/DESA","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/vlgiitr/confidence-is-all-you-need","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/privacytrustlab/ml_privacy_meter","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/orientino/lira-pytorch","reach":{"status":"ok","spdx":"Apache-2.0"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/nicomanzonelli/topic_model_attacks","reach":null}],"summary":{"ran_draft_wrong":2,"ran_fixture":3,"unverified":3},"by_repo_kind":{"listed":{"samples":8,"ran":5,"repositories":3}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":3,"samples":[{"code_sha256_prefix":"2831112d87704fe9","entry":"fltn","repo":"nicomanzonelli/topic_model_attacks","repo_kind":"listed","path":"topic_mia.py","file_url":"https://github.com/nicomanzonelli/topic_model_attacks/blob/HEAD/topic_mia.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2831112d87704fe9"}},{"code_sha256_prefix":"485b4287a66c1520","entry":"generate_ours","repo":"vlgiitr/confidence-is-all-you-need","repo_kind":"listed","path":"plot.py","file_url":"https://github.com/vlgiitr/confidence-is-all-you-need/blob/HEAD/plot.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"485b4287a66c1520"}},{"code_sha256_prefix":"8ec11ed7f1947e36","entry":"load_data","repo":"vlgiitr/confidence-is-all-you-need","repo_kind":"listed","path":"plot.py","file_url":"https://github.com/vlgiitr/confidence-is-all-you-need/blob/HEAD/plot.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8ec11ed7f1947e36"}},{"code_sha256_prefix":"05b194730e79b0f1","entry":"map_calculate_stats","repo":"nicomanzonelli/topic_model_attacks","repo_kind":"listed","path":"topic_mia.py","file_url":"https://github.com/nicomanzonelli/topic_model_attacks/blob/HEAD/topic_mia.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"05b194730e79b0f1"}},{"code_sha256_prefix":"a54e9a3450249b65","entry":"map_train_shadow_model","repo":"nicomanzonelli/topic_model_attacks","repo_kind":"listed","path":"simulation_utils.py","file_url":"https://github.com/nicomanzonelli/topic_model_attacks/blob/HEAD/simulation_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a54e9a3450249b65"}},{"code_sha256_prefix":"f84881dc40325e67","entry":"generate_ours","repo":"orientino/lira-pytorch","repo_kind":"listed","path":"plot.py","file_url":"https://github.com/orientino/lira-pytorch/blob/HEAD/plot.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"f84881dc40325e67"}},{"code_sha256_prefix":"3e8be43ae654d580","entry":"generate_ours_offline","repo":"orientino/lira-pytorch","repo_kind":"listed","path":"plot.py","file_url":"https://github.com/orientino/lira-pytorch/blob/HEAD/plot.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3e8be43ae654d580"}},{"code_sha256_prefix":"18da2122420deb20","entry":"sweep","repo":"vlgiitr/confidence-is-all-you-need","repo_kind":"listed","path":"plot.py","file_url":"https://github.com/vlgiitr/confidence-is-all-you-need/blob/HEAD/plot.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"18da2122420deb20"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}