# Membership Inference

A 123.5-million-parameter generative model, Didymos, was trained once without task labels on 409,297 intensive care stays from seven databases in five countries and answers prediction questions by sampling a patient's futures. On held-out stays it read 13 primary endpoints from those futures at AUROC 0.83–0.98 and ranked first on average among 20 predictors, including label-trained LightGBM and TabPFN-3.5. Its simulated treatment responses agreed with eight of nine observational contrasts, yet at two hospitals in Russia and China that contributed no training data it needed minutes of continued training on unlabelled local stays to match locally supervised models.

A 123.5-million-parameter generative model, Didymos, was trained once without task labels on 409,297 intensive care stays from seven databases in five countries and answers prediction questions by sampling a patient's futures. On held-out stays it read 13 primary endpoints from those futures at AUROC 0.83–0.98 and ranked first on average among 20 predictors, including label-trained LightGBM and TabPFN-3.5. Its simulated treatment responses agreed with eight of nine observational contrasts, yet at two hospitals in Russia and China that contributed no training data it needed minutes of continued training on unlabelled local stays to match locally supervised models.

The authors introduce PrivTab, a tabular foundation model that embeds a differential-privacy mechanism in its architecture: pretrained on simulated datasets, it uses in-context learning to compress sensitive rows into compact, provably private summaries, outperforming DP-LR and DP-MLP on 33 TabArena classification datasets across six privacy regimes under moderate-to-strong privacy, maintaining well-calibrated predictions, and reducing fitting time from minutes to a single forward pass of about 10 milliseconds.

The authors introduce PrivTab, a tabular foundation model that embeds a differential-privacy mechanism in its architecture: pretrained on simulated datasets, it uses in-context learning to compress sensitive rows into compact, provably private summaries, outperforming DP-LR and DP-MLP on 33 TabArena classification datasets across six privacy regimes under moderate-to-strong privacy, maintaining well-calibrated predictions, and reducing fitting time from minutes to a single forward pass of about 10 milliseconds.

The authors propose an evaluation framework with five necessary conditions (C0 sensitive disclosure potential, C1 non-overfitted model, C2 competitive model, C3 reliable membership inference, C4 computational feasibility) and use it to review 13 representative black-box membership inference attacks across 61 attack-dataset pairs, concluding that no attack satisfies C1 through C4 simultaneously and that under these realistic conditions membership inference attacks represent weak privacy threats.

The authors propose an evaluation framework with five necessary conditions (C0 sensitive disclosure potential, C1 non-overfitted model, C2 competitive model, C3 reliable membership inference, C4 computational feasibility) and use it to review 13 representative black-box membership inference attacks across 61 attack-dataset pairs, concluding that no attack satisfies C1 through C4 simultaneously and that under these realistic conditions membership inference attacks represent weak privacy threats.

The authors introduce MemGuard-Alpha, comprising a composite contamination score combining five membership inference attack (MIA) methods with a temporal proximity feature, plus Cross-Model Memorization Disagreement exploiting variation in training cutoffs across models, and audit both across seven LLMs (124M–7B), 50 S&P 100 constituents, 42,800 prompts and 299,600 prompt-model MIA scores spanning 2019–2024, yielding three negative results: the temporal proximity feature recovers the in-sample label perfectly (ROC-AUC 1.000) because it is a monotone transform of the defining variable, the discriminative power of MIA scores is largely attributable to scale differences between models (raw scores reach AUC up to 0.99 at a fixed date but fall to 0.487–0.

The authors introduce MemGuard-Alpha, comprising a composite contamination score combining five membership inference attack (MIA) methods with a temporal proximity feature, plus Cross-Model Memorization Disagreement exploiting variation in training cutoffs across models, and audit both across seven LLMs (124M–7B), 50 S&P 100 constituents, 42,800 prompts and 299,600 prompt-model MIA scores spanning 2019–2024, yielding three negative results: the temporal proximity feature recovers the in-sample label perfectly (ROC-AUC 1.000) because it is a monotone transform of the defining variable, the discriminative power of MIA scores is largely attributable to scale differences between models (raw scores reach AUC up to 0.99 at a fixed date but fall to 0.487–0.