Likelihood Ratio Attack

LiRA frames membership inference as a statistical hypothesis test. It computes the log-ratio of two probabilities:

• H_in (Member Hypothesis): The probability of the model's output given the target point was in training.
• H_out (Non-Member Hypothesis): The probability of the model's output given the target point was not in training.

A high ratio indicates the output is substantially more likely under the member distribution, signaling a positive membership inference. This probabilistic framing provides calibrated confidence scores rather than binary guesses.

The attack's power comes from training multiple shadow models to estimate the H_in and H_out distributions:

• IN models: Trained on datasets that include the target point. These model the output distribution when the point is a member.
• OUT models: Trained on datasets that explicitly exclude the target point. These model the non-member output distribution.

By querying these reference models with the target point, the adversary builds empirical distributions of confidence scores or loss values for both hypotheses, enabling precise likelihood computation.

LiRA operates in two modes depending on computational constraints:

• Parametric LiRA: Fits a Gaussian distribution to the per-sample loss values from IN and OUT shadow models. Assumes losses are normally distributed, enabling efficient scoring with minimal storage.
• Online LiRA: Trains many more shadow models and uses a non-parametric approach, directly estimating likelihoods from the empirical CDF of losses. More accurate but computationally expensive.

Both variants outperform earlier attack methods like the Shokri et al. attack by leveraging per-example distributional information.

A key advantage of LiRA is its well-calibrated membership scores. The likelihood ratio naturally produces a continuous score interpretable as the strength of evidence for membership.

• True Positive Rate at Low FPR: LiRA achieves high TPR even at very low false positive rates (e.g., 0.1%), critical for real-world attacks where false accusations are costly.
• Score Thresholding: Adversaries can tune the decision threshold to balance precision and recall based on their objectives.
• Confidence Intervals: The statistical framework allows computing uncertainty bounds around membership predictions.

LiRA demonstrates significant robustness against common defenses:

• Differential Privacy (DP-SGD): While DP-SGD reduces LiRA's effectiveness, the attack can still detect membership at moderate privacy budgets (ε > 8). Only strong privacy guarantees (ε < 1) reliably defeat it.
• Confidence Masking: LiRA operates effectively even when only top-1 predictions or loss values are available, bypassing defenses that truncate confidence vectors.
• Label-Only Variants: Adapted versions work with only predicted labels by analyzing prediction robustness to data augmentation, exploiting the observation that models are more consistent on training points.

LiRA directly measures unintended memorization in neural networks:

• Atypical Examples: Points that are outliers or mislabeled are significantly more vulnerable to LiRA, as the model must memorize them to fit the training data.
• Duplicate Influence: Examples appearing multiple times in the training set exhibit stronger membership signals.
• Canary Insertion: LiRA is used as an auditing tool by inserting canary data points and measuring their detectability, providing an empirical upper bound on memorization.

This connection makes LiRA valuable not only as an attack but as a privacy auditing primitive for model developers.

The cornerstone of the Likelihood Ratio Attack is the reference model. An adversary trains one or more shadow models on data drawn from the same population distribution as the target model's training set, but excluding the target point. The likelihood of the target point under the target model is compared to its likelihood under the reference model. A high ratio indicates membership because the target model has overfitted to that specific data point, assigning it a disproportionately higher probability than the general population model would.

The attack formalizes membership inference as a hypothesis test:

• Null Hypothesis (H₀): The data point is NOT in the training set.
• Alternative Hypothesis (H₁): The data point IS in the training set. The test statistic is the log-likelihood ratio: Λ(x) = log P(x|θ_target) - log P(x|θ_ref). A threshold is set on Λ(x) to control the false positive rate. This framework provides a calibrated membership score with well-understood statistical properties, unlike heuristic confidence-based attacks.

To compute the likelihood ratio, the adversary must construct a reference distribution. This is typically done via shadow model training:

• Train multiple models on datasets sampled from the same distribution as the target's training data.
• For each target point, use shadow models trained without that point to estimate the population likelihood.
• This approximates the marginal distribution of the data under the model training algorithm. The quality of the attack depends heavily on how well the adversary can match the target model's architecture and training procedure.

The Likelihood Ratio Attack provides a tight operational interpretation of differential privacy (DP). If a model is trained with DP, the output distributions on adjacent datasets are bounded. This directly limits the maximum likelihood ratio an adversary can observe. Specifically, under (ε, δ)-DP, the log-likelihood ratio is bounded by ε with probability at least 1-δ. This makes the likelihood ratio test the optimal attack against DP mechanisms, establishing a fundamental privacy-utility trade-off.

The Exposure Metric operationalizes the likelihood ratio for auditing memorization. A canary (a unique, random string) is inserted into the training set. The exposure is defined as the log-likelihood ratio between the model trained with the canary and a reference model without it. Formally: Exposure(s) = log₂(Pr(s|θ_with) / Pr(s|θ_without)). High exposure indicates the model has memorized the secret, making it vulnerable to extraction via likelihood ratio tests.

The Likelihood Ratio Attack can be executed in both white-box and black-box settings:

• White-Box: The adversary has full access to model parameters and can compute exact log-probabilities for any input sequence.
• Black-Box: The adversary estimates likelihoods by querying the model's output logits or by using perplexity as a proxy for negative log-likelihood in language models. The white-box variant is provably optimal; black-box variants degrade gracefully with limited query access.