The paper introduces PSCMIA, a power side‑channel membership inference attack that can determine whether a data sample was used to train an embedded machine learning model by analyzing power traces, without needing prediction probabilities or labels. The authors evaluate PSCMIA on MNIST, FMNIST, CIFAR10, and CINIC10 datasets using fully connected and convolutional neural networks on STM32F3 and XMEGA platforms, achieving ROC‑AUC values up to 0.907 for fully connected models and close performance to probability‑vector attacks for CNNs. PSCMIA outperforms label‑only attacks in 11 of 16 configurations, showing that physical execution can leak membership information even when conventional outputs are suppressed.
By Sahan Sanjaya, Prabhat Mishra
The paper introduces a method to estimate a model’s vulnerability to the Likelihood Ratio Attack (LiRA) without training reference models, using only the target model’s train and test loss distributions. It shows that LiRA’s per‑sample signal can be decomposed into a variance‑ratio term and a residual mean‑shift term, and that different loss‑distribution shapes dictate which reference‑free proxy to use. Two proxies are presented: the LOSS attack TNR for heavy‑tailed losses and the LOSS attack AUC for symmetric losses, both achieving low RMSE in predicting LiRA TPR across multiple architectures and datasets.
By Euodia Dodd, Nata\v{s}a Kr\v{c}o, Igor Shilov, Matthew Wicker, Yves-Alexandre de Montjoye
arXiv:2602. 18934v2 Announce Type: replace Abstract: Membership inference attacks (MIAs) threaten the privacy of machine learning models by revealing whether a specific data point was used during training.
By Abdullah Caglar Oksuz, Anisa Halimi, Erman Ayday
The paper introduces Pairwise Likelihood MIA (PL‑MIA), a unified membership inference attack that combines a Gaussian likelihood‑ratio statistic with population calibration and the Cauchy combination test. PL‑MIA generates p‑values from pairwise comparisons between a query point and reference points, then aggregates these continuous signals using the Cauchy test to preserve evidence strength. Experiments show that PL‑MIA surpasses strong baselines, boosting true positive rates by over 25% in low‑false‑positive settings, thereby validating the theoretical advantages of the proposed statistical framework.
By Shengjie Niu, Zebin Yun, Yeheng Ge, Jian Huang
The paper introduces AutoMIA, a framework that uses large language model agents to automatically design and implement new membership inference attack (MIA) signal computations. By systematically exploring a wide range of attack strategies, AutoMIA discovers novel MIAs tailored to specific target models and datasets, achieving up to a 0.18 absolute improvement in AUC over existing methods. This demonstrates that LLM agents can serve as an effective and scalable approach for creating state‑of‑the‑art MIAs.
By Toan Tran, Olivera Kotevska, Li Xiong
arXiv:2607. 13541v1 Announce Type: cross Abstract: To overcome data scarcity and privacy constraints in data collection, it has become standard practice across academia and industry to augment real training data with text-to-image (T2I)-generated synthetic data, a paradigm we term Real-Synthetic Mix-Training (RSMT).
By Na Li, Boyu Kuang, Hongsheng Hu, Liquan Chen, Hyoungshick Kim, Yansong Gao, Anmin Fu
The paper examines the reliability of membership inference attack (MIA) vulnerability evaluation. It identifies two weaknesses: finite‑sample bias from sampling shadow datasets from a fixed superset, and miscalibration when aggregating true positive rates across individuals at very low false positive rates. The authors propose simple fixes that avoid extra computational cost and suggest further improvements with additional computation.
By Joonas J\"alk\"o, Gauri Pradhan, Ossi R\"ais\"a, Antti Honkela
The paper "Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses" provides a comprehensive review of model inversion (MI) attacks that exploit trained deep neural networks to reconstruct private training data. It traces the evolution of MI from early machine‑learning contexts to recent DNN‑based attacks across various modalities and learning tasks, offering a detailed taxonomy and comparative analysis of both attacks and defenses. The authors also present an open‑source toolbox on GitHub to support further research in this area.
By Hao Fang, Yixiang Qiu, Hongyao Yu, Wenbo Yu, Jiawei Kong, Baoli Chong, Bin Chen, Xuan Wang, Shu-Tao Xia, Ke Xu
arXiv:2606. 17464v1 Announce Type: new Abstract: Membership inference attacks (MIAs) are a canonical way to assess a machine learning model's privacy properties.
By Jeffrey G. Wang, Jason Wang, Marvin Li, Seth Neel
arXiv:2412. 12640v2 Announce Type: replace Abstract: The increasing demand for data privacy, alongside the benefits of aggregating data from networked devices, has catalyzed the emergence of federated learning (FL).
By Rui Zhang, Ka-Ho Chow
The paper surveys 25 studies that use explainable AI to compromise machine learning models, covering attacks such as model extraction, membership inference, and model inversion. It distinguishes between how explanations are obtained—through target releases, attacker-derived methods, secondary disclosure, privileged access, or global artifacts—and shows that explanations can lower extraction costs and reveal membership signals via statistics, recourse distance, and robustness. The authors compare threat models, signals, and defenses, concluding that no single explanation type is always unsafe and that protection must be tailored to the specific acquisition path and target asset.
By Abdullah Caglar Oksuz, Anisa Halimi, Erman Ayday
The paper demonstrates that routing information logged by Mixture-of-Experts (MoE) language models can be used to infer whether a specific example was part of a model’s fine‑tuning data. By combining router telemetry with standard output signals and training a membership classifier on shadow models, the authors achieve higher true‑positive rates across multiple MoE architectures and data domains. The study shows that this privacy leakage persists under various fine‑tuning regimes and even with limited telemetry, indicating that router logs can become an additional privacy risk for deployed MoE models.
By Yixin Tan, Jiayang Liu, Lu Sun, Yuke Hu, Zheng Li, Rui Wen