Member inference (MI) attacks aim to determine if a specific data sample was used to train a
machine learning model. Thus, MI is a major privacy threat to models trained on private
sensitive data, such as medical records. In MI attacks one may consider the black-box
settings, where the model's parameters and activations are hidden from the adversary, or the
white-box case where they are available to the attacker. In this work, we focus on the latter
and present a novel MI attack for it that employs influence functions, or more specifically the …

Algorithm A1 summarizes the fitting of our self-influence function (SIF) attack model A. For
every sample in the training set Dtrain mem or Dtrain non− mem (defined in Section 4.2 in
the main paper), we collect the ISIF measure (Eq.(3)) together with a variable m that
indicates if the target model h predicted the same class as the groundtruth label. These
values are then used to calculate the parameters, τ1 and τ2, of the attack model A that is
provided by Algorithm A2 (line# 25). The procedure in Algorithm A2 aims to find an interval …