Aug 2026· International Journal of Intelligent Systems and Data Science· 0 citations· 31 references
TL;DR
This paper presents a systematic framework for membership inference attacks, in which an adversary with only black-box query access to a deployed classifier determines whether a specific individual's record was part of its training set.
Abstract
Machine-learning-as-a-service (MLaaS) platforms let organizations deploy predictive models without revealing their internal architecture, but this opacity does not guarantee the privacy of the data used to train them. This paper presents a systematic framework for membership inference attacks, in which an adversary with only black-box query access to a deployed classifier determines whether a specific individual's record was part of its training set. We introduce a shadow-model methodology that trains auxiliary classifiers on synthetically generated data produced via model-based synthesis, known population statistics, or noisy real data to learn the behavioral differences a target model exhibits on seen versus unseen inputs. Evaluated against commercial platforms including Google Prediction API and Amazon ML across seven datasets spanning healthcare, retail, location, and image domains, our attacks achieve median precision of 0.657 and 0.678 on the two platforms, respectively, with healthcare records showing vulnerability of approximately 65.7% precision. We identify overfitting, output granularity, and class imbalance as primary drivers of leakage, and evaluate mitigations such as output truncation, temperature scaling, and regularization, finding that each offers only partial protection at the cost of utility. These findings expose significant gaps in current regulatory frameworks such as GDPR and HIPAA regarding inference-based privacy violations.
This paper studies embedding-space privacy as a representation-level learning problem. Rather than altering raw records directly, the proposed framework applies embeddingspace transformation to full-record representations through Gaussian perturbation and adversarial representation sanitization. The method is evaluated through ablation across utility metrics, linkage attacks, attribute-inference attacks, and membership-inference tests. The primary empirical evaluation uses a synthetic fusion recommendation benchmark built from MovieLens [1], [2] 32M behavior and Adult-derived demographics [3], while a secondary synthetic medical benchmark is used to examine cross-domain transferability under more constrained conditions. The strongest results appear in the recommendation experiments. Under grouped demographic privacy evaluation, the combined condition preserves recommendation utility with $N D C G {@} K=0.6312$ while reducing exact and entity linkage from 0.7090/0.7204 to 0.0001/0.0000. Sensitive-target attacker performance remains near the majority baseline, supporting the claim of empirical privacy improvement without visible ranking degradation in that benchmark. The healthcare experiments also demonstrate meaningful embedding transformation and linkage reduction, though the current benchmark remains datalimited and therefore less conclusive for utility-focused evaluation. Overall, the findings support the conclusion that embeddingspace transformation can preserve downstream utility while substantially reducing linkage risk and sensitive-information recoverability under explicit attacker evaluation. The findings support embedding-space transformation as a practical privacypreserving strategy for embedding-driven AI systems under explicit attacker evaluation.
D. Panagoulias, Evangelia-Aikaterini Tsichrintzi, E. Sakkopoulos· International Conference on...· 0 citations
To efficiently exploit a valuable data source (e.g., facial or medical images), it is frequently harnessed to fulfill multiple learning objectives (e.g., facial recognition, age estimation, and race classification). Each trained model is then deployed as an independent API service for corresponding inference. However, the privacy risk introduced by this one-dataset-multiple-model (ODMM) paradigm is completely overlooked by the community. For the first time, this work reveals that the ODMM setting substantially amplifies privacy leakage. We establish a theoretical framework that proves that privacy leakage accumulates as more ODMM models are exposed, a phenomenon we term ODMM privacy composition. Guided by this theoretical foundation, we propose PRIME (Privacy Amplification RIsk from One-Dataset-Multiple-Model Exposure) to systematically assess this risk and quantify the resulting leakage using membership inference attacks (MIAs). Under black-box access to ODMM models, we design an aggregation mechanism that collectively captures carefully identified privacy signals leaked by individual ODMM models, and construct an attack meta-classifier over the aggregated meta-information to infer the membership status of a given sample jointly. Our results provide strong evidence that dataset reuse across ODMM models strikingly jeopardizes privacy, which is consistently evident across five privacy-sensitive image and textual benchmark datasets and diverse model architectures (from ResNet and ViT to Qwen3-1.7B), spanning three domains: facial analysis, medical imaging, and textual attribution analysis. While mitigations such as differential privacy can reduce the effectiveness of PRIME with trade-offs, our attack still consistently outperforms single-task MIAs.
Qirui Huang, Na Li, Hongsheng Hu et al.· 0 citations
GradLock is introduced, a novel training-time injection attack that stealthily injects sensitive training data directly into the model parameters and employs dynamic gradient locking to prevent payload degradation during the optimization process.
Jin-Seong Kim, Han-Ju Lee, Seok-Won Hong et al.· 0 citations
Membership inference attacks (MIAs) determine whether a queried record was included in a model's training set, posing a significant privacy risk to deployed machine learning services. Existing black-box attacks often depend on confidence vectors or numerous augmented queries, resulting in high query costs. This paper investigates a query-efficient black-box MIA based on adaptive sparse perturbations, which probes only a small subset of input coordinates and stops querying once sufficient prediction instability is observed. We formalize the attack pipeline under a score-based black-box threat model in which the adversary observes the full output probability vector but does not know model internals, training data, deployed defenses, or hidden preprocessing steps. We further define input coordinates as scalar dimensions of numeric inputs, specify sparse-coordinate sampling and perturbation magnitudes, and calibrate adaptive stopping thresholds on held-out validation data rather than on the final evaluation split. Using archived experimental results, the adaptive high-precision attack achieves the same average AUC as the fixed high-precision baseline (0.7525 vs. 0.7522) while reducing queries by $25.41 {\%}$. Relaxed sparse variants further cut query costs by up to 82.97% with only minor AUC degradation. Taken as an archival reanalysis, the results indicate that sparse local instability is a useful membership signal and that adaptive stopping can substantially reduce attack cost in black-box privacy evaluation.
Chi Xu· 2026 3rd World Conference on...· 0 citations
: Membership Inference Attacks (MIAs) pose a significant privacy risk in machine learning by enabling adversaries to infer whether specific data samples were used during training, particularly in sensitive domains such as social media and mental health analytics. To address this challenge, this paper proposes HEbdMIA, a lightweight homomorphic encryption-based defense that operates at the post-inference stage by encrypting model output logits without requiring retraining or architectural modifications. The proposed approach preserves the relative ordering of predictions while obscuring confidence patterns exploited by MIAs. Experimental evaluation on DepInferAttack and BotInferAttack demonstrates that HEbdMIA achieves a reduction in MIA success rates of 31.0% and 27.3%, respectively, with an associated accuracy decrease of 29.3% and 26.4%, reflecting a controlled privacy and utility trade off. Additional analysis using precision, recall, F1-score, and ROC-AUC confirms a substantial decline in adversarial inference capability. These findings indicate that HEbdMIA provides an effective, scalable, and deployment-friendly solution for enhancing privacy in real-world machine learning systems.
Akash Shah, M. A. Wani, R. Chaturvedi et al.· Computers, Materials & C...· 0 citations
A privacy-preserving zk-SNARK-based audit framework that searches for probes designed in the spirit of adversarial examples to amplify logit drift between an approved model and a modified deployment and demonstrates that token-based probes consistently deliver the strongest mean sensitivity across models and GPU platforms, although operating in a black-box setting.
Cameron Wilding, Mina Shaker, Fatemeh Ganji· 0 citations