ImpMIA: Leveraging Implicit Bias for Membership Inference Attack under Realistic Scenarios

2025-10-12

AI Summary

Membership inference attacks (MIAs) suffer severe performance degradation in realistic settings due to unrealistic black-box assumptions—such as known hyperparameters, identically distributed data, and fixed training-set proportions—which are rarely satisfied in practice. Method: This paper proposes a white-box MIA that requires only model weights and a superset of the training data. It introduces, for the first time, the maximum-margin implicit bias theory into MIA, eliminating reliance on reference models or distributional assumptions. Leveraging the Karush–Kuhn–Tucker (KKT) optimality conditions, it reconstructs model parameters via gradient-direction analysis to identify training samples. Results: Extensive experiments demonstrate that our method significantly outperforms state-of-the-art black-box and white-box MIAs under weak supervision, achieving higher attack accuracy and robustness across multiple benchmarks. It establishes a more reliable and practical paradigm for privacy risk assessment in real-world scenarios.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Adversarial Attacks & Robustness
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Determining which data samples were used to train a model-known as Membership Inference Attack (MIA)-is a well-studied and important problem with implications for data privacy. Black-box methods presume access only to the model's outputs and often rely on training auxiliary reference models. While they have shown strong empirical performance, they rely on assumptions that rarely hold in real-world settings: (i) the attacker knows the training hyperparameters; (ii) all available non-training samples come from the same distribution as the training data; and (iii) the fraction of training data in the evaluation set is known. In this paper, we demonstrate that removing these assumptions leads to a significant drop in the performance of black-box attacks. We introduce ImpMIA, a Membership Inference Attack that exploits the Implicit Bias of neural networks, hence removes the need to rely on any reference models and their assumptions. ImpMIA is a white-box attack -- a setting which assumes access to model weights and is becoming increasingly realistic given that many models are publicly available (e.g., via Hugging Face). Building on maximum-margin implicit bias theory, ImpMIA uses the Karush-Kuhn-Tucker (KKT) optimality conditions to identify training samples. This is done by finding the samples whose gradients most strongly reconstruct the trained model's parameters. As a result, ImpMIA achieves state-of-the-art performance compared to both black and white box attacks in realistic settings where only the model weights and a superset of the training data are available.

Problem

• Removing unrealistic assumptions from black-box membership inference attacks
• Exploiting neural network implicit bias without reference models
• Identifying training samples using gradient-based KKT optimality conditions

Innovation

• Exploits implicit bias via KKT optimality conditions
• Uses gradient reconstruction to identify training samples
• Operates without reference models in white-box setting