Active Membership Inference Test (aMINT)

• The paper introduces aMINT as a proactive auditing method that amplifies member/non-member separability using adversarial perturbations and multi-task learning.
• It details various constructions such as black-box canary queries, proactive reprogramming, white-box perceptual probing, and federated-learning attacks.
• Empirical results demonstrate that aMINT achieves higher AUC and TPR, especially in low false-positive regimes compared to passive inference methods.

Active Membership Inference Test (aMINT) denotes a class of active membership-inference methods that determine whether a sample was used in model training by intervening in the auditing process rather than only reading unmodified outputs. In the cited literature, the term is used for several non-identical constructions: adversarially optimized black-box query sets, training-time multi-task auditability heads, proactive model-reprogramming probes, white-box perceptual interrogation procedures, and a federated-learning attack in which a dishonest server embeds malicious parameters into the global model (Wen et al., 2022, DeAlcala et al., 9 Sep 2025, Huang et al., 30 Mar 2026, Nguyen et al., 2023, Taub et al., 5 Feb 2026). Across these formulations, the unifying idea is to amplify member/non-member separability so that inference remains effective in regimes where passive scores degrade, especially at low false-positive rates.

1. Terminology and problem formulations

A basic distinction in the literature is between passive membership inference and proactive or active membership inference. In the ReproMIA formulation, passive MIA takes a fixed sample $x$, computes a score $\mathrm{Score}_0(x)=g(M_\theta(x))$, and predicts membership if $\mathrm{Score}_0(x)>\tau$. The proactive variant first learns an input-space perturbation $\delta^*$ on shadow data and then queries $M_\theta(x\oplus\delta^*)$, with

$$\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].$$

Membership is then predicted from $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$ relative to a threshold $\tau$ (Huang et al., 30 Mar 2026).

A second formulation, titled "Active Membership Inference Test (aMINT)," casts auditability as a multi-task learning objective. Here the primary model $f_\theta$ solves the main task while a secondary MINT model $g_\phi$ predicts the membership label $\mathrm{Score}_0(x)=g(M_\theta(x))$0 from intermediate activations $\mathrm{Score}_0(x)=g(M_\theta(x))$1, using

$\mathrm{Score}_0(x)=g(M_\theta(x))$2

with $\mathrm{Score}_0(x)=g(M_\theta(x))$3 implemented as a binary cross-entropy loss on the membership label (DeAlcala et al., 9 Sep 2025).

A third usage treats aMINT as an active black-box test for a particular record $\mathrm{Score}_0(x)=g(M_\theta(x))$4, where the attacker optimizes adversarial queries in a small $\mathrm{Score}_0(x)=g(M_\theta(x))$5 ball around $\mathrm{Score}_0(x)=g(M_\theta(x))$6 so that models trained with the point and models trained without it respond differently (Wen et al., 2022). A fourth usage appears in federated learning, where a dishonest server embeds a chosen neuron into the transmitted model and decides membership from whether the corresponding gradient component is zero or nonzero after local client training (Nguyen et al., 2023). A fifth usage, inspired by LeakBoost, synthesizes an interrogation image $\mathrm{Score}_0(x)=g(M_\theta(x))$7 by minimizing an activation-space perceptual loss and then feeds $\mathrm{Score}_0(x)=g(M_\theta(x))$8 into an existing detector (Taub et al., 5 Feb 2026).

Formulation	Active mechanism	Representative source
Black-box canary aMINT	Adversarially optimized canary queries near $\mathrm{Score}_0(x)=g(M_\theta(x))$9	(Wen et al., 2022)
Training-time Active MINT	Joint optimization of task head and membership head	(DeAlcala et al., 9 Sep 2025)
ReproMIA / proactive MIA	Learned perturbation $\mathrm{Score}_0(x)>\tau$0 applied at audit time	(Huang et al., 30 Mar 2026)
FL active attack	Chosen neuron revealed by gradient component	(Nguyen et al., 2023)
White-box perceptual probing	Optimized interrogation image $\mathrm{Score}_0(x)>\tau$1	(Taub et al., 5 Feb 2026)

This multiplicity of definitions makes the term partly contextual rather than fully standardized. A plausible implication is that “active” identifies a design principle—deliberate amplification of privacy leakage—more than a single canonical algorithm.

2. Active probing in black-box and white-box settings

In the black-box canary framework, the attacker assumes a known training algorithm $\mathrm{Score}_0(x)>\tau$2 and only black-box access to the target model’s confidence or logits. The attacker trains $\mathrm{Score}_0(x)>\tau$3 shadow models on an auxiliary dataset $\mathrm{Score}_0(x)>\tau$4, partitions them into $\mathrm{Score}_0(x)>\tau$5 and $\mathrm{Score}_0(x)>\tau$6 depending on whether $\mathrm{Score}_0(x)>\tau$7 is present, and then solves an adversarial optimization within $\mathrm{Score}_0(x)>\tau$8 to obtain canary queries $\mathrm{Score}_0(x)>\tau$9 that maximize separation between IN and OUT models. In practice, the method uses the pre-softmax logit of the true label, with $\delta^*$0 and $\delta^*$1, optimized by projected gradient descent. Diversity is induced by sampling random subsets of IN and OUT shadows during optimization, and the final inference score averages likelihood-ratio statistics across $\delta^*$2 canaries after fitting Gaussians to transformed confidences $\delta^*$3 (Wen et al., 2022).

The reported hyperparameters are explicitly modest: $\delta^*$4 for CIFAR-10 images or $\delta^*$5 for MNIST, minibatch size $\delta^*$6, $\delta^*$7 optimization steps, and $\delta^*$8 canaries. In the online CIFAR-10 setting, LiRA achieves $\delta^*$9 and $M_\theta(x\oplus\delta^*)$0, whereas aMINT reaches $M_\theta(x\oplus\delta^*)$1 and $M_\theta(x\oplus\delta^*)$2. In the offline CIFAR-10 setting, LiRA achieves $M_\theta(x\oplus\delta^*)$3 and $M_\theta(x\oplus\delta^*)$4, while aMINT reaches $M_\theta(x\oplus\delta^*)$5 and $M_\theta(x\oplus\delta^*)$6. The gains are described as especially relevant in low-FPR legal settings, and the method is explicitly model-agnostic and black-box (Wen et al., 2022).

The white-box perceptual formulation replaces adversarial logits with activation matching. Given a target sample $M_\theta(x\oplus\delta^*)$7, it synthesizes an interrogation image $M_\theta(x\oplus\delta^*)$8 by minimizing

$M_\theta(x\oplus\delta^*)$9

where $$\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].$$0 is the activation at layer $$\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].$$1. Starting from $$\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].$$2 or $$\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].$$3, the method performs $$\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].$$4 steps of gradient descent,

$$\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].$$5

and then feeds $$\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].$$6 to an off-the-shelf detector such as GLiR (Taub et al., 5 Feb 2026).

The sensitivity analysis is specific: mid and late layers leak the strongest signals, early layers leak almost nothing, short runs with $$\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].$$7 are most effective, and lower learning rates $$\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].$$8 outperform higher rates, especially at small $$\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].$$9. On CIFAR-10, LeakBoost+GLiR raises ViT-4 AUC from $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$0 to $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$1 and $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$2 from $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$3 to $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$4; on AlexNet, it raises AUC from $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$5 to $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$6 and $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$7 from $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$8 to $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$9. On CIFAR-100, ViT-4 AUC rises from $\tau$0 to $\tau$1, while for AlexNet AUC is approximately $\tau$2 with a much larger $\tau$3 increase from $\tau$4 to $\tau$5 (Taub et al., 5 Feb 2026).

Together, these two strands show that active querying does not require a unique mechanism. It may operate through local adversarial neighborhoods in black-box settings or through direct activation-space optimization in white-box settings.

3. ReproMIA and proactive model reprogramming

ReproMIA defines proactive membership inference as a bilevel model-reprogramming problem in which a perturbation is trained to enlarge member/non-member score differences on a shadow model and then transferred to the audited target. The score-difference objective uses $\tau$6, with $\tau$7 mapping model outputs to a scalar score and $\tau$8 a smooth, increasing function such as softplus. The optimization is performed over the perturbation alone while freezing model weights, under constraints such as $\tau$9, $f_\theta$0, or a masked border-patch constraint. A surrogate loss is given by

$f_\theta$1

optimized by gradient ascent or, equivalently in the pseudocode, gradient descent on $f_\theta$2 with projection back into $f_\theta$3 when needed (Huang et al., 30 Mar 2026).

The theoretical analysis is organized around three propositions. Proposition 1 states a loss-landscape curvature gap: under mild overfitting assumptions, the input-space Hessian at non-members has a strictly larger top eigenvalue than at members, with

$f_\theta$4

where $f_\theta$5. Proposition 2 decomposes the gradient of the reprogramming objective into member and non-member streams, $f_\theta$6, and shows under overfitting that $f_\theta$7, so $f_\theta$8 is driven to degrade non-member outputs much more than member outputs. Proposition 3 states that, under a location-family noise model, the mutual information between membership and the perturbed outputs exceeds that of the vanilla outputs: if $f_\theta$9 and $g_\phi$0, then $g_\phi$1 for all $g_\phi$2 (Huang et al., 30 Mar 2026).

The framework is instantiated across LLMs, diffusion models, and classification models. For LLMs, ReproMIA learns a continuous soft prompt $g_\phi$3 prepended to token embeddings, uses per-token calibrated $g_\phi$4-scores

$g_\phi$5

and defines the sample score as the mean of the $g_\phi$6 smallest token scores, with prompt length $g_\phi$7, token selection $g_\phi$8, shadow set size approximately $g_\phi$9–$\mathrm{Score}_0(x)=g(M_\theta(x))$00 samples, AdamW with learning rate $\mathrm{Score}_0(x)=g(M_\theta(x))$01, and $\mathrm{Score}_0(x)=g(M_\theta(x))$02–$\mathrm{Score}_0(x)=g(M_\theta(x))$03 optimization steps. For diffusion models, it uses proximal initialization with $\mathrm{Score}_0(x)=g(M_\theta(x))$04, one DDIM inversion step at time $\mathrm{Score}_0(x)=g(M_\theta(x))$05, a normalized reconstruction error $\mathrm{Score}_0(x)=g(M_\theta(x))$06, and Adam with learning rate $\mathrm{Score}_0(x)=g(M_\theta(x))$07 for $\mathrm{Score}_0(x)=g(M_\theta(x))$08 iterations, with the perturbation bound approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$09–$\mathrm{Score}_0(x)=g(M_\theta(x))$10 and optimal around $\mathrm{Score}_0(x)=g(M_\theta(x))$11. For image classification, it learns a global border perturbation $\mathrm{Score}_0(x)=g(M_\theta(x))$12 on a $\mathrm{Score}_0(x)=g(M_\theta(x))$13 border mask; for graphs, it learns a feature perturbation $\mathrm{Score}_0(x)=g(M_\theta(x))$14 added to each node’s feature vector. The total classification loss combines preservation, separation, and regularization terms, with $\mathrm{Score}_0(x)=g(M_\theta(x))$15, $\mathrm{Score}_0(x)=g(M_\theta(x))$16, $\mathrm{Score}_0(x)=g(M_\theta(x))$17 steps, and learning rate $\mathrm{Score}_0(x)=g(M_\theta(x))$18 with cosine decay. The final score vector $\mathrm{Score}_0(x)=g(M_\theta(x))$19 is fed to a small MLP with two hidden layers of size $\mathrm{Score}_0(x)=g(M_\theta(x))$20, ReLU, and sigmoid output. All experiments were run on NVIDIA A100/H800 GPUs with PyTorch (Huang et al., 30 Mar 2026).

The empirical emphasis is low-FPR auditing. The reported metrics are balanced accuracy, AUC, and $\mathrm{Score}_0(x)=g(M_\theta(x))$21. On WikiMIA with length $\mathrm{Score}_0(x)=g(M_\theta(x))$22, averaged over six LLMs, the best passive baseline ReCaLL obtains approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$23 AUC and approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$24 $\mathrm{Score}_0(x)=g(M_\theta(x))$25, while ReproMIA obtains approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$26 AUC and approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$27 $\mathrm{Score}_0(x)=g(M_\theta(x))$28. On MIMIR, the average AUC gain is $\mathrm{Score}_0(x)=g(M_\theta(x))$29 and TPR gain $\mathrm{Score}_0(x)=g(M_\theta(x))$30 for $\mathrm{Score}_0(x)=g(M_\theta(x))$31B models. Under logits noise with $\mathrm{Score}_0(x)=g(M_\theta(x))$32 up to $\mathrm{Score}_0(x)=g(M_\theta(x))$33, ReproMIA retains $\mathrm{Score}_0(x)=g(M_\theta(x))$34 and $\mathrm{Score}_0(x)=g(M_\theta(x))$35. For diffusion DDPM, the runner-up RePIAN has approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$36 AUC and approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$37 $\mathrm{Score}_0(x)=g(M_\theta(x))$38, while ReproMIA reaches approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$39 AUC and approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$40 $\mathrm{Score}_0(x)=g(M_\theta(x))$41 using only two queries. For Stable Diffusion, ReproMIA achieves approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$42 AUC versus a best baseline of $\mathrm{Score}_0(x)=g(M_\theta(x))$43, and approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$44 $\mathrm{Score}_0(x)=g(M_\theta(x))$45 versus $\mathrm{Score}_0(x)=g(M_\theta(x))$46. For classification models, average $\mathrm{Score}_0(x)=g(M_\theta(x))$47 rises from $\mathrm{Score}_0(x)=g(M_\theta(x))$48 to $\mathrm{Score}_0(x)=g(M_\theta(x))$49, $\mathrm{Score}_0(x)=g(M_\theta(x))$50 from $\mathrm{Score}_0(x)=g(M_\theta(x))$51 to $\mathrm{Score}_0(x)=g(M_\theta(x))$52, and AUC from $\mathrm{Score}_0(x)=g(M_\theta(x))$53 to $\mathrm{Score}_0(x)=g(M_\theta(x))$54; on Cora, PubMed, and Citeseer, GNN AUC is approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$55–$\mathrm{Score}_0(x)=g(M_\theta(x))$56 versus baseline approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$57–$\mathrm{Score}_0(x)=g(M_\theta(x))$58 (Huang et al., 30 Mar 2026).

The framework’s practical recommendations are also explicit. Query budgets are small: LLMs and diffusion attacks require only one or two queries per sample, and classification uses one forward pass. Only a small shadow set of approximately $\mathrm{Score}_0(x)=g(M_\theta(x))$59–$\mathrm{Score}_0(x)=g(M_\theta(x))$60 known members and non-members is stated to be sufficient to train $\mathrm{Score}_0(x)=g(M_\theta(x))$61, and auditors are advised to maintain a small shadow audit set, learn $\mathrm{Score}_0(x)=g(M_\theta(x))$62 offline on cheaper surrogate models if necessary, and deploy the method by appending $\mathrm{Score}_0(x)=g(M_\theta(x))$63 to user queries and thresholding the output score (Huang et al., 30 Mar 2026).

4. Auditability as a training objective

The multi-task Active MINT formulation treats membership detection not as a post-hoc attack but as an optimization objective coupled to normal supervised learning. Let $\mathrm{Score}_0(x)=g(M_\theta(x))$64 be the audited model’s training set and $\mathrm{Score}_0(x)=g(M_\theta(x))$65 its held-out test set. For any sample $\mathrm{Score}_0(x)=g(M_\theta(x))$66, the membership label is $\mathrm{Score}_0(x)=g(M_\theta(x))$67 if $\mathrm{Score}_0(x)=g(M_\theta(x))$68 and $\mathrm{Score}_0(x)=g(M_\theta(x))$69 if $\mathrm{Score}_0(x)=g(M_\theta(x))$70, for example if $\mathrm{Score}_0(x)=g(M_\theta(x))$71. The goal is to learn a predictor of $\mathrm{Score}_0(x)=g(M_\theta(x))$72 (DeAlcala et al., 9 Sep 2025).

The architecture is a two-headed network with audited-model parameters $\mathrm{Score}_0(x)=g(M_\theta(x))$73 and MINT-model parameters $\mathrm{Score}_0(x)=g(M_\theta(x))$74. The primary classifier is $\mathrm{Score}_0(x)=g(M_\theta(x))$75, while $\mathrm{Score}_0(x)=g(M_\theta(x))$76 denotes intermediate activations—called “Auxiliary Auditable Data” (AAD)—extracted from shared layers and passed to the MINT head $\mathrm{Score}_0(x)=g(M_\theta(x))$77. The MINT loss is binary cross-entropy on the membership label, the task loss is standard classification loss, and the total objective adds an $\mathrm{Score}_0(x)=g(M_\theta(x))$78 regularizer $\mathrm{Score}_0(x)=g(M_\theta(x))$79. During back-propagation, gradients of $\mathrm{Score}_0(x)=g(M_\theta(x))$80 update $\mathrm{Score}_0(x)=g(M_\theta(x))$81 in layers downstream of the shared layers, while gradients of $\mathrm{Score}_0(x)=g(M_\theta(x))$82 update both $\mathrm{Score}_0(x)=g(M_\theta(x))$83 and the shared trunk in $\mathrm{Score}_0(x)=g(M_\theta(x))$84 (DeAlcala et al., 9 Sep 2025).

The audited architectures evaluated include MobileNet, ResNet50, ResNet101, DenseNet121, Xception, and ViT. Two split points are used in the network, “Entry” and “Middle,” yielding activation maps $\mathrm{Score}_0(x)=g(M_\theta(x))$85 and $\mathrm{Score}_0(x)=g(M_\theta(x))$86. The MINT model has two parallel CNN branches, or FC branches for ViT. In the E1 configuration, each branch has one convolution layer with $\mathrm{Score}_0(x)=g(M_\theta(x))$87 filters, kernel $\mathrm{Score}_0(x)=g(M_\theta(x))$88, stride $\mathrm{Score}_0(x)=g(M_\theta(x))$89, ReLU, and global average pooling to produce a $\mathrm{Score}_0(x)=g(M_\theta(x))$90-dimensional vector. In the E2 configuration, each branch has two convolution layers with $\mathrm{Score}_0(x)=g(M_\theta(x))$91 filters, kernel $\mathrm{Score}_0(x)=g(M_\theta(x))$92, stride $\mathrm{Score}_0(x)=g(M_\theta(x))$93, ReLU, and global pooling to produce a $\mathrm{Score}_0(x)=g(M_\theta(x))$94-dimensional vector. The branch outputs are concatenated and passed through two FC layers with dropout $\mathrm{Score}_0(x)=g(M_\theta(x))$95 for E1 and $\mathrm{Score}_0(x)=g(M_\theta(x))$96 for E2, ReLU activations, and a scalar membership logit whose sigmoid is the membership probability (DeAlcala et al., 9 Sep 2025).

The training procedure samples batches from the audited training set and from an external set $\mathrm{Score}_0(x)=g(M_\theta(x))$97, concatenates them, computes class loss only on $\mathrm{Score}_0(x)=g(M_\theta(x))$98 samples and membership loss on both, and optimizes the total loss with Adam or SGD. The experimental setup uses MNIST, CIFAR-10, GTSRB, Tiny-ImageNet, and CASIA-WebFace. For each dataset, the original training set is split $\mathrm{Score}_0(x)=g(M_\theta(x))$99 into audited training $\mathrm{Score}_0(x)>\tau$00 and external $\mathrm{Score}_0(x)>\tau$01. The optimizer is Adam with $\mathrm{Score}_0(x)>\tau$02, $\mathrm{Score}_0(x)>\tau$03, batch size $\mathrm{Score}_0(x)>\tau$04, learning rate $\mathrm{Score}_0(x)>\tau$05 for MNIST and $\mathrm{Score}_0(x)>\tau$06 for larger tasks, loss weighting $\mathrm{Score}_0(x)>\tau$07 for simple tasks and $\mathrm{Score}_0(x)>\tau$08 for complex tasks, regularization $\mathrm{Score}_0(x)>\tau$09 or $\mathrm{Score}_0(x)>\tau$10, and early stopping after $\mathrm{Score}_0(x)>\tau$11–$\mathrm{Score}_0(x)>\tau$12 epochs based on validation (DeAlcala et al., 9 Sep 2025).

The reported membership-detection accuracies in the Entry setup all exceed $\mathrm{Score}_0(x)>\tau$13. On MNIST, values range from $\mathrm{Score}_0(x)>\tau$14 for ViT to $\mathrm{Score}_0(x)>\tau$15 for MobileNet; on CIFAR-10, values range from $\mathrm{Score}_0(x)>\tau$16 to $\mathrm{Score}_0(x)>\tau$17 across all listed architectures except no drop below $\mathrm{Score}_0(x)>\tau$18; on GTSRB, MobileNet reaches $\mathrm{Score}_0(x)>\tau$19 and ViT reaches $\mathrm{Score}_0(x)>\tau$20; on Tiny-ImageNet, Xception reaches $\mathrm{Score}_0(x)>\tau$21 and ViT reaches $\mathrm{Score}_0(x)>\tau$22; on CASIA-WebFace, MobileNet reaches $\mathrm{Score}_0(x)>\tau$23 and ViT reaches $\mathrm{Score}_0(x)>\tau$24, while the text states that all exceed $\mathrm{Score}_0(x)>\tau$25 membership-detection accuracy. Audited-model accuracy dropped less than $\mathrm{Score}_0(x)>\tau$26 relative to standalone training. On ResNet50, the comparison to earlier methods is explicit: on CIFAR-10, Shokri et al. MIA achieves $\mathrm{Score}_0(x)>\tau$27, Passive MINT $\mathrm{Score}_0(x)>\tau$28, and Active MINT $\mathrm{Score}_0(x)>\tau$29; on GTSRB, Shokri et al. MIA achieves $\mathrm{Score}_0(x)>\tau$30, Passive MINT $\mathrm{Score}_0(x)>\tau$31, and Active MINT $\mathrm{Score}_0(x)>\tau$32 (DeAlcala et al., 9 Sep 2025).

The ablation results identify activation-point choice and task-weighting as central controls. Entry and Middle setups yield comparable high MINT accuracy, whereas Output or late layers consistently underperform with values below $\mathrm{Score}_0(x)>\tau$33. Higher $\mathrm{Score}_0(x)>\tau$34 favors MINT at a slight cost to classification, and the stated limitation is the small less-than-$\mathrm{Score}_0(x)>\tau$35 drop in primary-task performance, which can be managed by reducing shared layers or tuning $\mathrm{Score}_0(x)>\tau$36. Suggested deployment strategies include cryptographically signed logs, Docker containers with deterministic hashes, and secure MPC setups where the auditor controls the MINT branch (DeAlcala et al., 9 Sep 2025).

5. Federated-learning aMINT under local differential privacy

In federated learning, the active threat model is structurally different because the attacker is the coordinating server. The server broadcasts a global model, collects clients’ gradients, and is allowed to be actively dishonest rather than merely honest-but-curious. The goal is to decide whether a target point $\mathrm{Score}_0(x)>\tau$37 belonged to a chosen client’s private batch $\mathrm{Score}_0(x)>\tau$38. The paper formalizes this as a security game with an initialization oracle $\mathrm{Score}_0(x)>\tau$39 that returns a modified model $\mathrm{Score}_0(x)>\tau$40, a client gradient computation $\mathrm{Score}_0(x)>\tau$41 on possibly LDP-noised data, and an inference oracle $\mathrm{Score}_0(x)>\tau$42 that outputs a membership bit. The server’s advantage is

$\mathrm{Score}_0(x)>\tau$43

The client may also be forced to use a local differential privacy mechanism $\mathrm{Score}_0(x)>\tau$44 specified by the server (Nguyen et al., 2023).

The core attack is to inject a chosen neuron whose activation isolates the target sample. Let $\mathrm{Score}_0(x)>\tau$45 be first-layer weights, $\mathrm{Score}_0(x)>\tau$46 the second-layer weights, and

$\mathrm{Score}_0(x)>\tau$47

If the chosen neuron activates only on $\mathrm{Score}_0(x)>\tau$48 and not on other elements of $\mathrm{Score}_0(x)>\tau$49, then its gradient is nonzero if $\mathrm{Score}_0(x)>\tau$50 and zero if $\mathrm{Score}_0(x)>\tau$51. The test statistic is therefore the extracted gradient component $\mathrm{Score}_0(x)>\tau$52, with

$\mathrm{Score}_0(x)>\tau$53

The server’s construction routine samples decoy negatives from a public distribution, forms an auxiliary dataset with $\mathrm{Score}_0(x)>\tau$54 labeled positive and the decoys labeled negative, trains $\mathrm{Score}_0(x)>\tau$55 by cross-entropy so that $\mathrm{Score}_0(x)>\tau$56 and $\mathrm{Score}_0(x)>\tau$57 for $\mathrm{Score}_0(x)>\tau$58, embeds these parameters into the global model, and later extracts the chosen neuron’s gradient after local client training. Under LDP, the server instead trains the neuron on multiple noised copies $\mathrm{Score}_0(x)>\tau$59 of the target so that it remains active on noised versions of $\mathrm{Score}_0(x)>\tau$60 but inactive on other samples (Nguyen et al., 2023).

The theoretical guarantee is expressed through the expected activation of the chosen neuron under noising. Let $\mathrm{Score}_0(x)>\tau$61 and $\mathrm{Score}_0(x)>\tau$62. Using Monte Carlo estimates and Hoeffding bounds, the paper defines lower and upper confidence bounds on $\mathrm{Score}_0(x)>\tau$63 and $\mathrm{Score}_0(x)>\tau$64 and states a certified guarantee: if the lower bound on the target’s expected activation is strictly positive and the supremum of the upper bounds on all non-target activations is nonpositive, then with probability at least $\mathrm{Score}_0(x)>\tau$65 the server’s aMINT test will succeed (Nguyen et al., 2023).

The experiments use CelebA with batch size $\mathrm{Score}_0(x)>\tau$66, ImageNet-10 with batch size $\mathrm{Score}_0(x)>\tau$67, and CIFAR-10 with batch size $\mathrm{Score}_0(x)>\tau$68, all on a two-layer fully connected network over frozen ResNet-18 embeddings of dimension $\mathrm{Score}_0(x)>\tau$69. The LDP mechanisms are BitRand and OME on $\mathrm{Score}_0(x)>\tau$70-bit-quantized embeddings, with attack parameters $\mathrm{Score}_0(x)>\tau$71 neurons in the first layer and one chosen neuron in the second. The reported metrics are advantage, true positive rate, and true negative rate. Without LDP, aMINT reaches $\mathrm{Score}_0(x)>\tau$72 success within a single round. Under BitRand, even at $\mathrm{Score}_0(x)>\tau$73 the advantage is at least $\mathrm{Score}_0(x)>\tau$74 on all three datasets, and for $\mathrm{Score}_0(x)>\tau$75 it exceeds $\mathrm{Score}_0(x)>\tau$76. Under OME, success rates remain above $\mathrm{Score}_0(x)>\tau$77 for $\mathrm{Score}_0(x)>\tau$78. The paper further states that pushing $\mathrm{Score}_0(x)>\tau$79 very low, such as $\mathrm{Score}_0(x)>\tau$80, drives attack success toward $\mathrm{Score}_0(x)>\tau$81 but collapses model utility; that DP-SGD with sufficiently small privacy budgets prevents ConvNet training from converging on CIFAR-10 or ImageNet; and that malicious weights are empirically statistically indistinguishable from clean weights by KDE overlap (Nguyen et al., 2023).

This formulation broadens the meaning of aMINT beyond test-time query synthesis. Here “active” refers to malicious intervention in the training loop itself, with gradient observability substituting for direct black-box scoring.

6. Evaluation criteria, defenses, and interpretive issues

Evaluation protocols differ across formulations, but all focus on separability between member and non-member responses. ReproMIA reports balanced accuracy, ROC AUC, and $\mathrm{Score}_0(x)>\tau$82, with a specific emphasis on low-FPR gains (Huang et al., 30 Mar 2026). The black-box canary framework reports AUC and $\mathrm{Score}_0(x)>\tau$83, emphasizing online and offline settings and low-FPR utility in legal contexts (Wen et al., 2022). The multi-task Active MINT work reports membership-detection accuracy across architectures and datasets (DeAlcala et al., 9 Sep 2025). The federated-learning attack reports advantage, TPR, and TNR (Nguyen et al., 2023). The perceptual probing framework reports AUC together with $\mathrm{Score}_0(x)>\tau$84 and $\mathrm{Score}_0(x)>\tau$85 (Taub et al., 5 Feb 2026).

A recurrent finding is that active procedures preserve or enlarge separation where passive methods weaken. ReproMIA explicitly attributes its gains to overfitting-induced curvature and gradient asymmetries, and states that the largest relative gains occur in low-FPR regimes because mutual information and score separation are increased so that ROC tails spread apart (Huang et al., 30 Mar 2026). The canary method likewise reports its strongest practical relevance in low-FPR settings (Wen et al., 2022). The perceptual probing results concentrate improvements in gradient-based detectors and in mid/late layers rather than early representations (Taub et al., 5 Feb 2026). This suggests that active membership inference is best understood as a signal-amplification strategy rather than as a single detector family.

A common misconception is that active membership inference is necessarily black-box. The literature does not support that restriction. The canary and ReproMIA approaches are black-box or black-box-compatible (Wen et al., 2022, Huang et al., 30 Mar 2026), the perceptual interrogation framework assumes white-box access to activations and gradients (Taub et al., 5 Feb 2026), the multi-task formulation is intrinsic to the training procedure (DeAlcala et al., 9 Sep 2025), and the federated-learning attack relies on server control over model transmission and access to returned gradients (Nguyen et al., 2023).

Another common misconception is that differential privacy or injected noise categorically neutralize active tests. The cited papers instead report partial robustness and privacy–utility trade-offs. ReproMIA retains $\mathrm{Score}_0(x)>\tau$86 and $\mathrm{Score}_0(x)>\tau$87 under logits noise $\mathrm{Score}_0(x)>\tau$88 up to $\mathrm{Score}_0(x)>\tau$89 for LLM defenses, and on diffusion defenses under DP-SGD with $\mathrm{Score}_0(x)>\tau$90 still reaches approximately $\mathrm{Score}_0(x)>\tau$91–$\mathrm{Score}_0(x)>\tau$92 AUC and approximately $\mathrm{Score}_0(x)>\tau$93–$\mathrm{Score}_0(x)>\tau$94 $\mathrm{Score}_0(x)>\tau$95; for classification defenses, AUC under DP-SGD with $\mathrm{Score}_0(x)>\tau$96 drops to $\mathrm{Score}_0(x)>\tau$97 but remains above baselines, while under smoothing $\mathrm{Score}_0(x)>\tau$98 it remains above $\mathrm{Score}_0(x)>\tau$99 (Huang et al., 30 Mar 2026). The canary framework states that under DP defenses it still improves LiRA by $\delta^*$00–$\delta^*$01 AUC with TPR gains up to $\delta^*$02 (Wen et al., 2022). The federated-learning work reports that sufficiently strong noise to suppress the attack substantially damages utility or training convergence (Nguyen et al., 2023).

The practical implications therefore vary by setting. In post-hoc black-box auditing, active probes can be precomputed and then reused, including in offline settings (Wen et al., 2022). In proactive privacy auditing, a learned perturbation can be trained on small shadow sets and deployed with one or two queries per sample (Huang et al., 30 Mar 2026). In training-time governance, auditability can be made an explicit optimization target with only a small drop in primary accuracy (DeAlcala et al., 9 Sep 2025). In federated learning, the same active principle exposes the risk that privacy guarantees can fail under a malicious coordinator even when local differential privacy is present (Nguyen et al., 2023).