Machine Learning (ML) models are vulnerable to membership inference attacks (MIAs), where an adversary aims to determine whether a specific sample was part of the model’s training data. Traditional MIAs exploit differences in the model’s output posteriors, but in more challenging scenarios Decision Boundary shortestBD Sample Siyuan Wu Institute of Software, Chinese Academy of Sciences Dengguo Feng Institute of Software, Chinese Academy of Sciences Fixed Sample fixedBD HopSkipJump Decision Boundary of Target Model Decision Boundary of Shadow Model Fixed Sample shortestBD fixedBD Member (label-only scenarios) where only predicted labels are available, existing works directly utilize the shortest distance of samples reaching decision boundaries as membership sigfixedBD (a) Number of Queries shortestBD Non-member (b) Distinguishability nals, denoted as the shortestBD. However, they face two key challenges: low distinguishability between members and nonmembersduetosamplediversity,andhighqueryrequirements stemming from direction diversity. To overcome these limitations, we propose a novel labelonly attack called DHAttack, designed for Higher performance and Higher stealth, focusing on the boundary distance of individual samples to mitigate the effects of sample diversity, and measuring this distance toward a fixed point to minimize query overhead. Empirical results demonstrate that DHAttack consistently outperforms other advanced attack methods. Notably, in some cases, DHAttack achieves more than an order of magnitude improvement over all baselines in terms of TPR @ 0.1% FPR with just 5 to 30 queries. Furthermore, we explore the reasons for DHAttack’s success, and then analyze other crucial factors in the attack performance. Finally, we evaluate several defense mechanisms against DHAttack and demonstrate its superiority over all baseline attacks.
Usenix Security Symposium (USENIX-Security)
2025-08-13
2026-06-22