Revisiting the LiRA Membership Inference Attack Under Realistic Assumptions
This research provides a more accurate assessment of privacy leakage for machine learning practitioners and researchers by demonstrating that current state-of-the-art membership inference attacks are less effective than previously thought under realistic conditions, thereby influencing privacy auditing protocols.
This paper re-evaluated the Likelihood-Ratio Attack (LiRA), a state-of-the-art membership inference attack, under more realistic assumptions for machine learning models. They found that anti-overfitting (AOF) and transfer learning (TL) significantly weaken LiRA's effectiveness, especially when using shadow-based thresholds and skewed membership priors, leading to a substantial drop in Positive Predictive Value (PPV).
Membership inference attacks (MIAs) have become the standard tool for evaluating privacy leakage in machine learning (ML). Among them, the Likelihood-Ratio Attack (LiRA) is widely regarded as the state of the art when sufficient shadow models are available. However, prior evaluations have often overstated the effectiveness of LiRA by attacking models overconfident on their training samples, calibrating thresholds on target data, assuming balanced membership priors, and/or overlooking attack reproducibility. We re-evaluate LiRA under a realistic protocol that (i) trains models using anti-overfitting (AOF) and transfer learning (TL), when applicable, to reduce overconfidence as in production models; (ii) calibrates decision thresholds using shadow models and data rather than target data; (iii) measures positive predictive value (PPV, or precision) under shadow-based thresholds and skewed membership priors (pi <= 10%); and (iv) quantifies per-sample membership reproducibility across different seeds and training variations. We find that AOF significantly weakens LiRA, while TL further reduces attack effectiveness while improving model accuracy. Under shadow-based thresholds and skewed priors, LiRA's PPV often drops substantially, especially under AOF or AOF+TL. We also find that thresholded vulnerable sets at extremely low FPR show poor reproducibility across runs, while likelihood-ratio rankings are more stable. These results suggest that LiRA, and likely weaker MIAs, are less effective than previously suggested under realistic conditions, and that reliable privacy auditing requires evaluation protocols that reflect practical training practices, feasible attacker assumptions, and reproducibility considerations. Code is available at https://github.com/najeebjebreel/lira_analysis.