Label-Only Attack

Unlike traditional membership inference attacks that require confidence scores or logit vectors, label-only attacks operate with the most restricted adversary model. The attacker receives only the predicted class label (e.g., 'dog' vs 'cat') from the target model. This makes the attack far more practical against real-world APIs that return only top-1 predictions without probability distributions. The attack exploits the observation that models exhibit higher robustness to adversarial perturbations on training data points compared to non-training data.

The core mechanism exploits a fundamental asymmetry: models are more confident and robust on training examples than on unseen data. The attacker applies adversarial perturbations—small, carefully crafted noise patterns—to a query sample and observes how many perturbations are required to flip the predicted label. Training members require significantly more perturbation to change classification, creating a measurable robustness gap that serves as the membership signal.

Label-only attacks effectively measure the distance to the model's decision boundary for each query sample. Training data points typically reside farther from decision boundaries in the model's learned feature space, requiring larger perturbations to cross into another class. The attack algorithm iteratively applies minimal perturbations until the label flips, using the number of perturbation steps or total perturbation magnitude as a proxy for membership. This transforms a black-box label query into a quantitative distance metric.

Several algorithmic approaches exist for label-only membership inference:

• Boundary Distance Attack: Estimates the minimum L2 distance to the decision boundary through iterative gradient estimation and binary search
• Rotation-Translation Attack: Applies geometric transformations and counts label changes to infer membership
• Augmentation-Based Attack: Uses semantically meaningful data augmentations rather than adversarial noise, observing label consistency across augmented versions
• Transfer Attack: Trains a local shadow model to mimic the target's decision boundary, then performs white-box distance calculations on the proxy

Effective defenses against label-only attacks must address the underlying robustness disparity:

• Adversarial Training: Training on adversarially perturbed examples reduces the robustness gap between members and non-members
• Differential Privacy (DP-SGD): Adding calibrated noise during training provides provable membership privacy guarantees
• Label Smoothing: Softening hard labels during training reduces overconfidence on training data
• Decision Boundary Regularization: Explicitly penalizing large distances between training points and decision boundaries
• Output Randomization: Occasionally returning random labels with small probability to mask robustness signals

Label-only attacks are particularly dangerous because they align with realistic API constraints. Major ML-as-a-service platforms often expose only the predicted class to end users. Research has demonstrated successful membership inference on commercial computer vision APIs and cloud NLP services using only label outputs. The attack requires significantly more queries than confidence-based methods—typically thousands per sample—but query costs remain economically viable. This makes label-only attacks a genuine privacy threat for deployed models.

A membership inference technique that measures the confidence gap between a model's prediction for the true label and its next highest confidence score. Training data typically exhibits a larger gap than non-training data. This metric is particularly relevant to label-only attacks because the gap can often be inferred from the robustness of the prediction under perturbation, even when raw confidence scores are hidden.

A defense that truncates or rounds output confidence scores to limited precision, or reveals only the top-K predictions. By suppressing fine-grained probability information, confidence masking reduces the signal available to traditional membership inference attacks. However, label-only attacks can still succeed against this defense by exploiting the observation that models are more robust to input perturbations on training examples.

The process of identifying when a model has memorized specific training examples rather than learning generalizable patterns. Overfitting is the primary vulnerability exploited by membership inference attacks. Key indicators include:

• Large generalization gap between training and test accuracy
• High confidence on incorrect predictions
• Sensitivity to specific training examples detectable via influence functions

A defense mechanism that adds calibrated noise directly to model output predictions or confidence vectors. By smoothing the statistical differences between training and non-training data, output perturbation masks the subtle signals exploited by membership inference attacks. For label-only attacks, perturbation must be sufficient to occasionally flip the predicted label itself, not just the confidence score.