Practical Bayes-Optimal Membership Inference Attacks

We develop practical and theoretically grounded membership inference attacks (MIAs) against both independent and identically distributed (i.i.d.) data and graph-structured data. Building on the Bayesian decision-theoretic framework of Sablayrolles et al., we derive the Bayes-optimal membership inference rule for node-level MIAs against graph neural networks, addressing key open questions about optimal query strategies in the graph setting. We introduce BASE and G-BASE, computationally efficient approximations of the Bayes-optimal attack. G-BASE achieves superior performance compared to previously proposed classifier-based node-level MIA attacks. BASE, which is also applicable to non-graph data, matches or exceeds the performance of prior state-of-the-art MIAs, such as LiRA and RMIA, at a significantly lower computational cost. Finally, we show that BASE and RMIA are equivalent under a specific hyperparameter setting, providing a principled, Bayes-optimal justification for the RMIA attack.

@article{lassila2025_2505.24089,
  title={ Practical Bayes-Optimal Membership Inference Attacks },
  author={ Marcus Lassila and Johan Östman and Khac-Hoang Ngo and Alexandre Graell i Amat },
  journal={arXiv preprint arXiv:2505.24089},
  year={ 2025 }
}