Membership Inference Attack on CIFAR100 (Balanced Accuracy, AUROC)
93.49AUROCCurv ZO NLL
Evaluation results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| Curv ZO NLLshadow models=642024.07 | 93.49 | 84.47 | — | — | — | |
| ReproMIAQuery=1+1, Target Model=DDPM2026.03 | 91 | — | 26.1 | — | — | |
| Ye et al.shadow models=642024.07 | 90.88 | 80.73 | — | — | — | |
| Curv ZO LRshadow models=642024.07 | 90.15 | 80.48 | — | — | — | |
| Carlini et al.shadow models=642024.07 | 88.89 | 81.55 | — | — | — | |
| PIANQuery=1+1, Target Model=DDPM2026.03 | 87.77 | — | 22.08 | — | — | |
| PIAQuery=1+1, Target Model=DDPM2026.03 | 85.3 | — | 19.84 | — | — | |
| LeakBoostTarget Architecture=ViT-42026.02 | 83.8 | — | 10.6 | 1.42 | 0.0006 | |
| SecMIQuery=10+2, Target Model=DDPM2026.03 | 83.48 | — | 13.05 | — | — | |
| MINT2026.01 | 82.6 | 74.5 | — | — | — | |
| Song and Mittalshadow models=642024.07 | 82.28 | 75.58 | — | — | — | |
| Yeom et al.shadow models=642024.07 | 82.11 | 76.29 | — | — | — | |
| Sablayrolles et al.shadow models=642024.07 | 81.11 | 70.22 | — | — | — | |
| Yeom et al.2026.01 | 80.4 | 77.2 | — | — | — | |
| Song et al.2026.01 | 80.4 | 77.3 | — | — | — | |
| NAQuery=1, Target Model=DDPM2026.03 | 77.85 | — | 10.47 | — | — | |
| Watson et al.2026.01 | 77.8 | 72.7 | — | — | — | |
| SIFTarget Architecture=ResNet-182026.02 | 74.3 | — | 1.1 | 0.14 | 0.0001 | |
| GLiRTarget Architecture=ResNet-182026.02 | 71.8 | — | 1.62 | 0.15 | 0.0001 | |
| Watson et al.shadow models=642024.07 | 71.66 | 62.71 | — | — | — | |
| LeakBoostTarget Architecture=ResNet-182026.02 | 67.8 | — | 1.86 | 0.28 | 0.0001 | |
| LAEQTarget Architecture=ResNet-182026.02 | 67.7 | — | 1.4 | 0.08 | 0.0001 | |
| GLiRTarget Architecture=AlexNet2026.02 | 67.5 | — | 1.56 | 0.18 | 0.0001 | |
| SIFTarget Architecture=AlexNet2026.02 | 67 | — | 0.98 | 0.11 | 0.0001 | |
| LAEQTarget Architecture=AlexNet2026.02 | 66.9 | — | 1.51 | 0.12 | 0.0001 | |
| LeakBoostTarget Architecture=AlexNet2026.02 | 65.3 | — | 30.49 | 3.38 | 0.0017 | |
| SIFTarget Architecture=DenseNet2026.02 | 64.2 | — | 1.01 | 0.05 | 0.0001 | |
| GLiRTarget Architecture=DenseNet2026.02 | 63.7 | — | 1.53 | 0.23 | 0.0001 | |
| LAEQTarget Architecture=DenseNet2026.02 | 63.5 | — | 1.3 | 0.17 | 0.0001 | |
| GLiRTarget Architecture=ViT-42026.02 | 62.4 | — | 1.37 | 0.14 | 0.0001 | |
| IATarget Architecture=ResNet-182026.02 | 62 | — | 1.66 | 0.21 | 0.0001 | |
| Salem et al.2026.01 | 61.2 | 57.7 | — | — | — | |
| Ye et al.2026.01 | 60.5 | 57.8 | — | — | — | |
| LeakBoostTarget Architecture=DenseNet2026.02 | 59.1 | — | 1.54 | 0.28 | 0.0001 | |
| IATarget Architecture=AlexNet2026.02 | 57.7 | — | 1.36 | 0.14 | 0.0001 | |
| IATarget Architecture=ViT-42026.02 | 56.4 | — | 1.49 | 0.15 | 0.0001 | |
| IATarget Architecture=DenseNet2026.02 | 56.1 | — | 1.11 | 0.13 | 0.0001 | |
| SIFTarget Architecture=ViT-42026.02 | 55.9 | — | 1.47 | 0.12 | 0.0001 | |
| LAEQTarget Architecture=ViT-42026.02 | 50.2 | — | 1.15 | 0.18 | 0.0001 |