{"id":"https://openalex.org/W4288057780","doi":"https://doi.org/10.1109/sp46214.2022.9833649","title":"Membership Inference Attacks From First Principles","display_name":"Membership Inference Attacks From First Principles","publication_year":2022,"publication_date":"2022-05-01","ids":{"openalex":"https://openalex.org/W4288057780","doi":"https://doi.org/10.1109/sp46214.2022.9833649"},"language":"en","primary_location":{"id":"doi:10.1109/sp46214.2022.9833649","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46214.2022.9833649","pdf_url":null,"source":{"id":"https://openalex.org/S4363606603","display_name":"2022 IEEE Symposium on Security and Privacy (SP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5034257647","display_name":"Nicholas Carlini","orcid":"https://orcid.org/0000-0002-1463-3461"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nicholas Carlini","raw_affiliation_strings":["Google Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google Research","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078367630","display_name":"Steve Chien","orcid":"https://orcid.org/0000-0003-1023-9480"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Steve Chien","raw_affiliation_strings":["Google Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google Research","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059480732","display_name":"Milad Nasr","orcid":"https://orcid.org/0000-0002-1913-6157"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]},{"id":"https://openalex.org/I24603500","display_name":"University of Massachusetts Amherst","ror":"https://ror.org/0072zz521","country_code":"US","type":"education","lineage":["https://openalex.org/I24603500"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Milad Nasr","raw_affiliation_strings":["Google Research","University of Massachusetts, Amherst"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google Research","institution_ids":["https://openalex.org/I1291425158"]},{"raw_affiliation_string":"University of Massachusetts, Amherst","institution_ids":["https://openalex.org/I24603500"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100731553","display_name":"Shuang Song","orcid":"https://orcid.org/0000-0002-0037-1499"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shuang Song","raw_affiliation_strings":["Google Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google Research","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103331911","display_name":"Andreas Terzis","orcid":"https://orcid.org/0000-0002-5681-3399"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Andreas Terzis","raw_affiliation_strings":["Google Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google Research","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5006851333","display_name":"Florian Tram\u00e8r","orcid":"https://orcid.org/0000-0001-8703-8762"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Florian Tram\u00e8r","raw_affiliation_strings":["Google Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google Research","institution_ids":["https://openalex.org/I1291425158"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":410,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1897","last_page":"1914"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.9939000010490417,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7472580671310425},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.6790556907653809},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3458680510520935},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.29332342743873596}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7472580671310425},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.6790556907653809},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3458680510520935},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.29332342743873596}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/sp46214.2022.9833649","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46214.2022.9833649","pdf_url":null,"source":{"id":"https://openalex.org/S4363606603","display_name":"2022 IEEE Symposium on Security and Privacy (SP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":98,"referenced_works":["https://openalex.org/W42722137","https://openalex.org/W1985511977","https://openalex.org/W2000159976","https://openalex.org/W2025183033","https://openalex.org/W2027595342","https://openalex.org/W2040228409","https://openalex.org/W2051267297","https://openalex.org/W2095272373","https://openalex.org/W2108598243","https://openalex.org/W2112796928","https://openalex.org/W2121749752","https://openalex.org/W2144513243","https://openalex.org/W2160208155","https://openalex.org/W2194775991","https://openalex.org/W2198253679","https://openalex.org/W2473418344","https://openalex.org/W2520881573","https://openalex.org/W2535690855","https://openalex.org/W2566079294","https://openalex.org/W2581082771","https://openalex.org/W2752373508","https://openalex.org/W2778284298","https://openalex.org/W2785361959","https://openalex.org/W2795435272","https://openalex.org/W2798657499","https://openalex.org/W2884280357","https://openalex.org/W2884943453","https://openalex.org/W2887995258","https://openalex.org/W2897830718","https://openalex.org/W2930926105","https://openalex.org/W2945237470","https://openalex.org/W2946363484","https://openalex.org/W2946930197","https://openalex.org/W2947160092","https://openalex.org/W2956128647","https://openalex.org/W2963263347","https://openalex.org/W2963378725","https://openalex.org/W2963456518","https://openalex.org/W2964137095","https://openalex.org/W2979575719","https://openalex.org/W2983140679","https://openalex.org/W2993330478","https://openalex.org/W2998508940","https://openalex.org/W3013068160","https://openalex.org/W3022536969","https://openalex.org/W3035168593","https://openalex.org/W3035261884","https://openalex.org/W3042943646","https://openalex.org/W3046102592","https://openalex.org/W3048045781","https://openalex.org/W3048684575","https://openalex.org/W3081595899","https://openalex.org/W3096692244","https://openalex.org/W3103245149","https://openalex.org/W3104224589","https://openalex.org/W3113004165","https://openalex.org/W3118608800","https://openalex.org/W3126152116","https://openalex.org/W3150395569","https://openalex.org/W3154109599","https://openalex.org/W3158753499","https://openalex.org/W3170901302","https://openalex.org/W3214437258","https://openalex.org/W4226445324","https://openalex.org/W4287553002","https://openalex.org/W4295727797","https://openalex.org/W4298422451","https://openalex.org/W4308410483","https://openalex.org/W4394639701","https://openalex.org/W6678051712","https://openalex.org/W6681151457","https://openalex.org/W6713132643","https://openalex.org/W6726497184","https://openalex.org/W6727099177","https://openalex.org/W6728484576","https://openalex.org/W6743979602","https://openalex.org/W6746849571","https://openalex.org/W6747732332","https://openalex.org/W6750182894","https://openalex.org/W6753280856","https://openalex.org/W6755174528","https://openalex.org/W6760759230","https://openalex.org/W6763077247","https://openalex.org/W6763393573","https://openalex.org/W6765055791","https://openalex.org/W6769415613","https://openalex.org/W6775482175","https://openalex.org/W6776644305","https://openalex.org/W6779987556","https://openalex.org/W6781475444","https://openalex.org/W6781689620","https://openalex.org/W6782331252","https://openalex.org/W6787335730","https://openalex.org/W6789723219","https://openalex.org/W6790161207","https://openalex.org/W6791412975","https://openalex.org/W6803256842","https://openalex.org/W6804559052"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"A":[0],"membership":[1],"inference":[2],"attack":[3,44,105],"allows":[4],"an":[5],"adversary":[6],"to":[7,14,40],"query":[8],"a":[9,19,91],"trained":[10],"machine":[11],"learning":[12],"model":[13],"predict":[15],"whether":[16,42],"or":[17],"not":[18],"particular":[20],"example":[21],"was":[22],"contained":[23],"in":[24,83],"the":[25,43,51,102],"model\u2019s":[26],"training":[27,52],"dataset.":[28],"These":[29],"attacks":[30,57,78,119],"are":[31],"currently":[32],"evaluated":[33,61,82],"using":[34],"average-case":[35],"\u201caccuracy\u201d":[36],"metrics":[37],"that":[38,56,96],"fail":[39],"characterize":[41],"can":[45],"confidently":[46],"identify":[47],"any":[48],"members":[49],"of":[50],"set.":[53],"We":[54],"argue":[55],"should":[58],"instead":[59],"be":[60],"by":[62],"computing":[63],"their":[64],"true-positive":[65],"rate":[66],"at":[67,110],"low":[68,111],"(e.g.,":[69],"\u2264":[70],"0.1%)":[71],"false-positive":[72,112],"rates,":[73,113],"and":[74,114],"find":[75],"most":[76],"prior":[77,118],"perform":[79],"poorly":[80],"when":[81],"this":[84,88],"way.":[85],"To":[86],"address":[87],"we":[89],"develop":[90],"Likelihood":[92],"Ratio":[93],"Attack":[94],"(LiRA)":[95],"carefully":[97],"combines":[98],"multiple":[99],"ideas":[100],"from":[101],"literature.":[103],"Our":[104],"is":[106],"$10\\times$":[107],"more":[108],"powerful":[109],"also":[115],"strictly":[116],"dominates":[117],"on":[120],"existing":[121],"metrics.":[122]},"counts_by_year":[{"year":2026,"cited_by_count":62},{"year":2025,"cited_by_count":149},{"year":2024,"cited_by_count":118},{"year":2023,"cited_by_count":70},{"year":2022,"cited_by_count":10},{"year":2021,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}