Membership Inference Attack on CIFAR-100
70.37TPR @ 1% FPRReproMIA
Evaluation results
| Method | Links | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ReproMIABackbone=Res-182026.03 | 70.37 | — | — | — | — | 14.22 | 33.71 | — | — | — | — | — | — | |
| LDC-MIABackbone=Res-182026.03 | 68.49 | — | — | — | — | 12.9 | 30.78 | — | — | — | — | — | — | |
| ReproMIABackbone=Dense-1212026.03 | 48.2 | — | — | — | — | 6.52 | 16.3 | — | — | — | — | — | — | |
| LDC-MIABackbone=Dense-1212026.03 | 45.54 | — | — | — | — | 4.25 | 14.6 | — | — | — | — | — | — | |
| SimA-MC#Query=30, #mc=302025.09 | 44.66 | — | — | 0.9101 | — | — | — | — | — | — | — | 83.65 | — | |
| SimA-MC#Query=10, #mc=102025.09 | 43.14 | — | — | 0.902 | — | — | — | — | — | — | — | 82.79 | — | |
| SimA (⋆)#Query=12025.09 | 37.77 | — | — | 0.9005 | — | — | — | — | — | — | — | 83.12 | — | |
| Ours (BMIA)n=12025.03 | 35.75 | — | — | — | — | — | — | — | — | — | — | — | 26.44 | |
| SecMIstat#Query=122025.09 | 33.52 | — | — | 0.887 | — | — | — | — | — | — | — | 81.41 | — | |
| PIA#Query=22025.09 | 29.77 | — | — | 0.9027 | — | — | — | — | — | — | — | 82.97 | — | |
| Attack-Rn=82025.03 | 27.35 | — | — | — | — | — | — | — | — | — | — | — | 211.52 | |
| SecMI+FModel Architecture=DDIM, Training Settings=Default, High-frequency Filter=True2025.05 | 24.32 | — | — | 0.9374 | — | — | — | — | — | — | — | 88.09 | — | |
| PIA+FModel Architecture=DDIM, Training Settings=Default, High-frequency Filter=True2025.05 | 23.34 | — | — | 0.922 | — | — | — | — | — | — | — | 85.05 | — | |
| LiRAn=82025.03 | 23.2 | — | — | — | — | — | — | — | — | — | — | — | 211.52 | |
| Loss#Query=12025.09 | 20.35 | — | — | 0.8269 | — | — | — | — | — | — | — | 75.42 | — | |
| LiRAn=42025.03 | 19.67 | — | — | — | — | — | — | — | — | — | — | — | 105.76 | |
| Attack-Rn=42025.03 | 17.37 | — | — | — | — | — | — | — | — | — | — | — | 105.76 | |
| RMIAn=82025.03 | 16.91 | — | — | — | — | — | — | — | — | — | — | — | 211.52 | |
| SecMIModel Architecture=DDIM, Training Settings=Default2025.05 | 16.5 | — | — | 0.8721 | — | — | — | — | — | — | — | 80.56 | — | |
| RMIAn=42025.03 | 16.03 | — | — | — | — | — | — | — | — | — | — | — | 105.76 | |
| RMIAn=22025.03 | 12.86 | — | — | — | — | — | — | — | — | — | — | — | 52.88 | |
| PIAModel Architecture=DDIM, Training Settings=Default2025.05 | 12.27 | — | — | 0.848 | — | — | — | — | — | — | — | 77.51 | — | |
| Adversarially Robust LiRAlambda=5, perturbation budget=4.0/2552026.04 | 11.6 | — | — | 0.8408 | — | — | — | 24.73 | 26.55 | 40.65 | 65.6 | — | — | |
| Adversarially Robust LiRAlambda=10, perturbation budget=4.0/2552026.04 | 11.05 | — | — | 0.8387 | — | — | — | 25.45 | 25.95 | 39.5 | 64.3 | — | — | |
| Adversarially Robust LiRAlambda=20, perturbation budget=4.0/2552026.04 | 10.8 | — | — | 0.8353 | — | — | — | 25.65 | 24.55 | 38.5 | 63.5 | — | — | |
| Adversarially Robust LiRAlambda=25, perturbation budget=4.0/2552026.04 | 10.8 | — | — | 0.834 | — | — | — | 25.77 | 23.9 | 38.2 | 62.65 | — | — | |
| Adversarially Robust LiRAlambda=15, perturbation budget=4.0/2552026.04 | 10.75 | — | — | 0.8368 | — | — | — | 25.5 | 25 | 38.8 | 63.95 | — | — | |
| Adversarially Robust LiRAlambda=30, perturbation budget=4.0/2552026.04 | 10.6 | — | — | 0.8329 | — | — | — | 26.05 | 23.9 | 37.6 | 61.95 | — | — | |
| Adversarially Robust LiRAlambda=35, perturbation budget=4.0/2552026.04 | 10.35 | — | — | 0.8319 | — | — | — | 26.35 | 23.8 | 37.25 | 61.25 | — | — | |
| WatsonBackbone=Res-182026.03 | 10.06 | — | — | — | — | 0.41 | 2.94 | — | — | — | — | — | — | |
| LiRA Baselineperturbation budget=4.0/2552026.04 | 9.9 | — | — | 0.809 | — | — | — | 28.78 | 23 | 34.4 | 56.25 | — | — | |
| Naive+FModel Architecture=DDIM, Training Settings=Default, High-frequency Filter=True2025.05 | 9.73 | — | — | 0.8236 | — | — | — | — | — | — | — | 75.01 | — | |
| OursQuery=52025.10 | 9.65 | — | — | — | — | — | — | — | — | — | — | — | — | |
| SecMIQuery=122025.10 | 9.26 | — | — | — | — | — | — | — | — | — | — | — | — | |
| Attack-Rn=22025.03 | 9.06 | — | — | — | — | — | — | — | — | — | — | — | 52.88 | |
| WatsonBackbone=Dense-1212026.03 | 8.31 | — | — | — | — | 0.26 | 2.02 | — | — | — | — | — | — | |
| PFAMImet#Query=202025.09 | 8.26 | — | — | 0.7745 | — | — | — | — | — | — | — | 70.84 | — | |
| SalemBackbone=Res-182026.03 | 7.9 | — | — | — | — | 0 | 0.14 | — | — | — | — | — | — | |
| NaiveModel Architecture=DDIM, Training Settings=Default2025.05 | 7.13 | — | — | 0.7701 | — | — | — | — | — | — | — | 70.41 | — | |
| YeomBackbone=Res-182026.03 | 6.61 | — | — | — | — | 0 | 0.12 | — | — | — | — | — | — | |
| NaiveLossQuery=12025.10 | 4.79 | — | — | — | — | — | — | — | — | — | — | — | — | |
| LiRAn=22025.03 | 3.67 | — | — | — | — | — | — | — | — | — | — | — | 52.88 | |
| Attack-P2025.03 | 2.88 | — | — | — | — | — | — | — | — | — | — | — | — | |
| SalemBackbone=Dense-1212026.03 | 2.76 | — | — | — | — | 0 | 0.07 | — | — | — | — | — | — | |
| YeomBackbone=Dense-1212026.03 | 2.57 | — | — | — | — | 0 | 0.06 | — | — | — | — | — | — | |
| GAN-LeaksQuery=10002025.10 | 1.85 | — | — | — | — | — | — | — | — | — | — | — | — | |
| FedGA2025.12 | — | — | — | 1 | 100 | — | — | — | — | — | — | — | — | |
| FedKD2025.12 | — | — | — | 0.721 | 65.7 | — | — | — | — | — | — | — | — | |
| FedR2S2025.12 | — | — | — | 0.622 | 60 | — | — | — | — | — | — | — | — | |
| FedRetrainstatus=Gold2025.12 | — | — | — | 0.618 | 59.2 | — | — | — | — | — | — | — | — | |
| Initial ModelModel State=Before2026.04 | — | — | — | — | — | — | — | — | — | — | — | 89.34 | — | |
| JellyfishModel State=Unlearned2026.04 | — | — | — | — | — | — | — | — | — | — | — | 52.55 | — | |
| LiRABackbone=ResNet-50, n=22023.07 | — | 95.21 | 98.65 | — | — | — | — | — | — | — | — | — | — | |
| LiRABackbone=ResNet-50, n=42023.07 | — | 95.87 | 98.94 | — | — | — | — | — | — | — | — | — | — | |
| LiRABackbone=ResNet-50, n=62023.07 | — | 96.2 | 99.02 | — | — | — | — | — | — | — | — | — | — | |
| LiRABackbone=ResNet-50, n=82023.07 | — | 96.07 | 98.98 | — | — | — | — | — | — | — | — | — | — | |
| MarginalBackbone=ResNet-502023.07 | — | 58.81 | 65.75 | — | — | — | — | — | — | — | — | — | — | |
| Quantile Regression Membership Inference AttackBackbone=ResNet-502023.07 | — | 79.57 | 85.41 | — | — | — | — | — | — | — | — | — | — | |
| REMISVFU2025.12 | — | — | — | 0.609 | 55.3 | — | — | — | — | — | — | — | — | |
| Retrained Model (B1)Model State=Retrained2026.04 | — | — | — | — | — | — | — | — | — | — | — | 51.87 | — |