apcMIA: Adaptive Perturbation-assisted Contrastive Membership Inference Attacks

Abstract

Membership inference becomes especially difficult when target models generalize well or are trained with defenses, since member and non-member posterior vectors often overlap substantially in the low-false-positive-rate regime. We present apcMIA, a strict black-box, single-query membership inference attack that operates directly on posterior vectors. The core idea is to identify ambiguous non-member samples that are both member-like in posterior space and highly uncertain, then selectively perturb them so that the attack model can learn a sharper decision boundary. apcMIA jointly learns this selection process, the perturbation model, and the downstream attack objective through a unified differentiable pipeline with a contrastive loss. Across representative image and tabular benchmarks, apcMIA overall improves low-FPR inference over strong baselines and remains effective even in challenging settings where conventional posterior-based attacks degrade substantially. These results show that carefully reshaping the hardest nonmember region can expose subtle membership signals that remain difficult for existing black-box attacks to exploit.