1/ Most membership inference attacks (MIAs) have seemingly converged to black-box settings, driven by empirical evidence and theoretical folklore suggesting black-box access was optimal. But what if this assumption missed something critical? 😨 tl;dr? It did 🧵

Temporally shifted data splits in membership inference can be misleading ⚠️ Be cautious when interpreting these benchmarks!

Wrote a blurb for my submission "adversarial rinsing" 😈🧼 to the 'Erasing the Invisible' competition organized by @bang_an_ @furongh & co - awesome job btw! 🎉 Ranked nowhere near the top lol but a great learning experience! anshumansuri.com/post/eti/

Does white-box access help with membership inference? 🤔 tl;dr: Yes ✅ Come find Xiao (@xzhang_0427) at the High-dimensional Learning Dynamics (HiLD) Workshop at @icmlconf this Friday to learn more 📊🔍 Prior works (@alexsablay et al. proceedings.mlr.press/v97/sa…) theoretically show how black-box access is optimal for membership inference, and these findings seem to align with folklore and empirical observations around MIAs. However, the underlying assumptions for this theoretical result do not hold for models trained with SGD. We theoretically show that parameter access helps. Our theory also prescribes an attack that can be used for privacy auditing without any reference models. Read the full paper: arxiv.org/pdf/2406.11544 #ICML2024

Our MIA evaluation research for LLMs has been accepted at @COLM_conf! 🥳 It's time to think beyond just exact-record membership for privacy audits. Hope to see you in Philly soon! Meanwhile, check out this fascinating collection of related works that have emerged recently 👇 – at Charlottesville, VA

Super stoked about this work!! (interesting problem *and* superb collaborators 😍) Turns out certain LLM training characteristics (*and the way we think of membership for generative models) make MI hard! Read more at: iamgroot42.github.io/mimir.g… (+ @mcduan01 @UdacityDave) – at Charlottesville, VA