Preprint
Machine Learning

Membership Inference Attacks on Machine Learning: A Survey

Hongsheng Hu(University of Auckland), Zoran Salčić(University of Auckland), Lichao Sun(Lehigh University), Gillian Dobbie(University of Auckland), Philip S. Yu(University of Illinois Chicago), Xuyun Zhang(Macquarie University)
January 31, 2022ACM Computing Surveys704 citations
arXivPDFDOI

704

Citations

28

Influential Citations

ACM Computing Surveys

Venue

2022

Year

Abstract

Machine learning (ML) models have been widely applied to various applications, including image classification, text generation, audio recognition, and graph data analysis. However, recent studies have shown that ML models are vulnerable to membership inference attacks (MIAs), which aim to infer whether a data record was used to train a target model or not. MIAs on ML models can directly lead to a privacy breach. For example, via identifying the fact that a clinical record that has been used to train a model associated with a certain disease, an attacker can infer that the owner of the clinical record has the disease with a high chance. In recent years, MIAs have been shown to be effective on various ML models, e.g., classification models and generative models. Meanwhile, many defense methods have been proposed to mitigate MIAs. Although MIAs on ML models form a newly emerging and rapidly growing research area, there has been no systematic survey on this topic yet. In this article, we conduct the first comprehensive survey on membership inference attacks and defenses. We provide the taxonomies for both attacks and defenses, based on their characterizations, and discuss their pros and cons. Based on the limitations and gaps identified in this survey, we point out several promising future research directions to inspire the researchers who wish to follow this area. This survey not only serves as a reference for the research community but also provides a clear description for researchers outside this research domain. To further help the researchers, we have created an online resource repository, which we will keep updated with future relevant work. Interested readers can find the repository at https://github.com/HongshengHu/membership-inference-machine-learning-literature.

Analysis

Why This Paper Matters

Membership inference attacks (MIAs) pose a critical privacy threat to machine learning models, as they can reveal whether a specific data record was part of the training set. This is especially concerning in sensitive domains like healthcare, where inferring membership can leak personal health information. Despite the rapid growth of this research area, no comprehensive survey existed until this work. The paper fills that gap by systematically organizing the landscape of MIAs and defenses, making it an essential resource for both newcomers and experienced researchers.

The survey's timeliness is underscored by the increasing deployment of ML models in privacy-sensitive applications. By providing clear taxonomies and discussing pros and cons, the authors enable practitioners to better understand the threat model and select appropriate defenses. The inclusion of an online repository further enhances its utility as a living reference.

Technical Contributions

The paper's main innovations are:

  • First comprehensive taxonomy of MIAs, categorizing attacks based on attacker knowledge, model type, and inference strategy.
  • Taxonomy of defenses, including differential privacy, regularization, and adversarial training, with analysis of their trade-offs.
  • Identification of research gaps, such as the lack of studies on generative models and graph data, and the need for more robust evaluation metrics.
  • Future directions including adaptive attacks, defenses for complex models, and real-world deployment considerations.

Results

As a survey, the paper does not present new experimental results. Instead, it synthesizes findings from over 100 prior works. Key observations include:

  • MIAs achieve high success rates (often >80%) on overfitted models, but effectiveness drops with regularization or differential privacy.
  • Defenses like differential privacy can reduce attack accuracy but often at the cost of model utility.
  • Most existing work focuses on classification models; generative models and graph neural networks are underexplored.

Significance

This survey has broad impact by establishing a structured foundation for a rapidly evolving field. It helps researchers quickly understand the state of the art, compare approaches, and identify open problems. For practitioners, it raises awareness of privacy risks and provides guidance on mitigation strategies. The online repository ensures the survey remains relevant as new work emerges. Overall, this paper is likely to influence future research directions and contribute to the development of more privacy-preserving ML systems.

membership-inferenceprivacy-attacksmachine-learningsurveydefensesclassification-modelsgenerative-models

Related Papers