Calibrating One-Round Membership Inference with Neighbors

2026-09-28

AI Summary

This study addresses the dual challenges of weak signals and calibration difficulties in single-query membership inference attacks against large models, which arise from the absence of reference models. To overcome these limitations, this work proposes substituting auxiliary models with neighboring data of the target sample for per-sample calibration. The core innovation lies in demonstrating that nearest-neighbor queries can equivalently extract information from reference models. Furthermore, a complementary neighbor acquisition strategy is designed, leveraging early training checkpoints to recover strong signals without additional training. Extensive experiments across three image classification datasets under various settings demonstrate that the proposed method achieves highly competitive attack performance with zero extra training cost, establishing an efficient new paradigm for reference-model-free membership inference.

Abstract

The state-of-the-art Membership Inference (MI) methods calibrate their signal separately for each example using reference models, auxiliary models trained to exclude the target. This paradigm scales poorly to modern large models, however, whose training is too expensive to replicate. This has motivated one-round settings, where only a single trained model is available; but without reference models the per-example calibration that drives the strongest attacks can no longer be estimated, leaving the membership signal weak. We ask whether neighbors of the target point can recover this calibration without training any additional model. Our key observation is that reference models serve only to reveal how an example behaves under models not trained on it, and that querying the target model on nearby samples yields the same information. We propose two complementary ways to obtain such neighbors, and show that querying them against an early training checkpoint further sharpens the signal. We evaluate across three image classification datasets and three training setups, showing that neighbors yield strong membership signals and competitive attack performance at no additional training cost.

Problem

• Membership Inference
• One-Round Setting
• Per-Example Calibration
• Reference Models
• Neighbor Samples

Innovation

• Membership Inference
• One-Round Calibration
• Neighbor Samples
• Early Training Checkpoint
• Training-Free