---
title: Active Membership Inference Test (aMINT)
url: https://www.emergentmind.com/topics/active-membership-inference-test-amint
type: topic
---

# Active Membership Inference Test (aMINT)

Active Membership Inference Test (aMINT) denotes a class of active membership-inference methods that determine whether a sample was used in model training by intervening in the auditing process rather than only reading unmodified outputs. In the cited literature, the term is used for several non-identical constructions: adversarially optimized black-box query sets, training-time multi-task auditability heads, proactive model-reprogramming probes, white-box perceptual interrogation procedures, and a federated-learning attack in which a dishonest server embeds malicious parameters into the global model [2210.10750] [2509.07879] [2603.28942] [2302.12685] [2602.05748]. Across these formulations, the unifying idea is to amplify member/non-member separability so that inference remains effective in regimes where passive scores degrade, especially at low false-positive rates.

## 1. Terminology and problem formulations

A basic distinction in the literature is between passive membership inference and proactive or active membership inference. In the ReproMIA formulation, passive MIA takes a fixed sample $x$, computes a score
$\mathrm{Score}_0(x)=g(M_\theta(x))$, and predicts membership if $\mathrm{Score}_0(x)>\tau$. The proactive variant first learns an input-space perturbation $\delta^*$ on shadow data and then queries $M_\theta(x\oplus\delta^*)$, with
$$
\delta^*=\arg\max_{\delta\in\Omega}\mathbb{E}_{x\sim D_m^s,\;z\sim D_{nm}^s}\big[\Phi(M_\theta(x\oplus\delta),M_\theta(z\oplus\delta))\big].
$$
Membership is then predicted from $\mathrm{Score}_a(x)=g(M_\theta(x\oplus\delta^*))$ relative to a threshold $\tau$ [2603.28942].

A second formulation, titled "Active Membership Inference Test (aMINT)," casts auditability as a multi-task learning objective. Here the primary model $f_\theta$ solves the main task while a secondary MINT model $g_\phi$ predicts the membership label $y^m\in\{0,1\}$ from intermediate activations $h_\theta(x)$, using
$$
L_{\text{total}}(\theta,\phi)=L_{\text{task}}(\theta;D)+\lambda\cdot L_{\text{mint}}(\theta,\phi;D\cup E)+R(\theta,\phi),
$$
with $L_{\text{mint}}$ implemented as a binary cross-entropy loss on the membership label [2509.07879].

A third usage treats aMINT as an active black-box test for a particular record $(x^*,y^*)$, where the attacker optimizes adversarial queries in a small $L_\infty$ ball around $x^*$ so that models trained with the point and models trained without it respond differently [2210.10750]. A fourth usage appears in federated learning, where a dishonest server embeds a chosen neuron into the transmitted model and decides membership from whether the corresponding gradient component is zero or nonzero after local client training [2302.12685]. A fifth usage, inspired by LeakBoost, synthesizes an interrogation image $I^*$ by minimizing an activation-space perceptual loss and then feeds $I^*$ into an existing detector [2602.05748].

| Formulation | Active mechanism | Representative source |
|---|---|---|
| Black-box canary aMINT | Adversarially optimized canary queries near $x^*$ | [2210.10750] |
| Training-time Active MINT | Joint optimization of task head and membership head | [2509.07879] |
| ReproMIA / proactive MIA | Learned perturbation $\delta^*$ applied at audit time | [2603.28942] |
| FL active attack | Chosen neuron revealed by gradient component | [2302.12685] |
| White-box perceptual probing | Optimized interrogation image $I^*$ | [2602.05748] |

This multiplicity of definitions makes the term partly contextual rather than fully standardized. A plausible implication is that “active” identifies a design principle—deliberate amplification of privacy leakage—more than a single canonical algorithm.

## 2. Active probing in black-box and white-box settings

In the black-box canary framework, the attacker assumes a known training algorithm $\mathcal{T}$ and only black-box access to the target model’s confidence or logits. The attacker trains $N$ shadow models on an auxiliary dataset $D_{\text{aux}}$, partitions them into $S_{\text{in}}$ and $S_{\text{out}}$ depending on whether $(x^*,y^*)$ is present, and then solves an adversarial optimization within $\|\Delta\|_\infty\le\epsilon$ to obtain canary queries $q_j=x^*+\Delta$ that maximize separation between IN and OUT models. In practice, the method uses the pre-softmax logit of the true label, with
$L_{\text{in}}(q,\theta)=-z_{y^*}(q;\theta)$ and $L_{\text{out}}(q,\theta)=+z_{y^*}(q;\theta)$, optimized by projected gradient descent. Diversity is induced by sampling random subsets of IN and OUT shadows during optimization, and the final inference score averages likelihood-ratio statistics across $K$ canaries after fitting Gaussians to transformed confidences $\phi(s)=\log\!\bigl(s/(1-s)\bigr)$ [2210.10750].

The reported hyperparameters are explicitly modest: $\epsilon=2/255$ for CIFAR-10 images or $\epsilon=6/255$ for MNIST, minibatch size $b=2$, $T=40$ optimization steps, and $K=10$ canaries. In the online CIFAR-10 setting, LiRA achieves $\mathrm{AUC}=0.7436$ and $\mathrm{TPR}@1\%\mathrm{FPR}=17.84\%$, whereas aMINT reaches $\mathrm{AUC}=0.7625$ and $\mathrm{TPR}@1\%\mathrm{FPR}=21.98\%$. In the offline CIFAR-10 setting, LiRA achieves $\mathrm{AUC}=0.5540$ and $\mathrm{TPR}@1\%=9.85\%$, while aMINT reaches $\mathrm{AUC}=0.6154$ and $\mathrm{TPR}@1\%=12.60\%$. The gains are described as especially relevant in low-FPR legal settings, and the method is explicitly model-agnostic and black-box [2210.10750].

The white-box perceptual formulation replaces adversarial logits with activation matching. Given a target sample $x$, it synthesizes an interrogation image $I$ by minimizing
$$
\mathcal{L}_{\text{perceptual}}(x,I)=\sum_{\ell\in L}\|\phi_\ell(I)-\phi_\ell(x)\|^2,
$$
where $\phi_\ell(\cdot)$ is the activation at layer $\ell$. Starting from $I^{(0)}\sim\mathcal{N}(0,\sigma^2I)$ or $I^{(0)}\leftarrow x$, the method performs $T$ steps of gradient descent,
$$
I^{(t+1)}=\mathrm{Clip}\bigl(I^{(t)}-\eta_t\nabla_I\mathcal{L}^{(t)}\bigr),
$$
and then feeds $I^*$ to an off-the-shelf detector such as GLiR [2602.05748].

The sensitivity analysis is specific: mid and late layers leak the strongest signals, early layers leak almost nothing, short runs with $T\approx 80$ are most effective, and lower learning rates $\eta\approx 0.05$ outperform higher rates, especially at small $T$. On CIFAR-10, LeakBoost+GLiR raises ViT-4 AUC from $0.53$ to $0.81$ and $\mathrm{TPR}@1\%$ from $0.9\%$ to $11.8\%$; on AlexNet, it raises AUC from $0.58$ to $0.89$ and $\mathrm{TPR}@1\%$ from $1.3\%$ to $20.2\%$. On CIFAR-100, ViT-4 AUC rises from $0.62$ to $0.84$, while for AlexNet AUC is approximately $0.68$ with a much larger $\mathrm{TPR}@1\%$ increase from $1.6\%$ to $30.5\%$ [2602.05748].

Together, these two strands show that active querying does not require a unique mechanism. It may operate through local adversarial neighborhoods in black-box settings or through direct activation-space optimization in white-box settings.

## 3. ReproMIA and proactive model reprogramming

ReproMIA defines proactive membership inference as a bilevel model-reprogramming problem in which a perturbation is trained to enlarge member/non-member score differences on a shadow model and then transferred to the audited target. The score-difference objective uses
$\Phi(a,b)=\phi(g(a)-g(b))$, with $g$ mapping model outputs to a scalar score and $\phi(\cdot)$ a smooth, increasing function such as softplus. The optimization is performed over the perturbation alone while freezing model weights, under constraints such as $\|\delta\|_\infty\le\epsilon$, $\|\delta\|_2\le\epsilon$, or a masked border-patch constraint. A surrogate loss is given by
$$
L_{\text{rep}}(\delta)=\mathbb{E}_{x\in D_m^s,\;z\in D_{nm}^s}\big[\mathrm{softplus}(g(M_\theta(z\oplus\delta))-g(M_\theta(x\oplus\delta))+\gamma)\big]+\lambda\|\delta\|_2^2,
$$
optimized by gradient ascent or, equivalently in the pseudocode, gradient descent on $L$ with projection back into $\Omega$ when needed [2603.28942].

The theoretical analysis is organized around three propositions. Proposition 1 states a loss-landscape curvature gap: under mild overfitting assumptions, the input-space Hessian at non-members has a strictly larger top eigenvalue than at members, with
$$
\mathbb{E}_{x_{nm}}[\lambda_{\max}(H(x_{nm}))]-\mathbb{E}_{x_m}[\lambda_{\max}(H(x_m))]\ge C(\rho-1)>0,
$$
where $\rho=L_{\text{test}}/L_{\text{train}}>1$.
Proposition 2 decomposes the gradient of the reprogramming objective into member and non-member streams,
$\nabla_\delta F=G_1-G_2$,
and shows under overfitting that $\|G_2\|\gg\|G_1\|$, so $\delta$ is driven to degrade non-member outputs much more than member outputs. Proposition 3 states that, under a location-family noise model, the mutual information between membership and the perturbed outputs exceeds that of the vanilla outputs: if $I_0=I(M;M_\theta(x))$ and $I_\delta=I(M;M_\theta(x\oplus\delta^*))$, then $I_\delta>I_0$ for all $\rho>1$ [2603.28942].

The framework is instantiated across LLMs, diffusion models, and classification models. For LLMs, ReproMIA learns a continuous soft prompt $P\in\mathbb{R}^{L\times d}$ prepended to token embeddings, uses per-token calibrated $z$-scores
$$
z(t_i)=\frac{\log p(t_i\mid h_{<i})-\mu_i}{\sigma_i},
$$
and defines the sample score as the mean of the $K\%$ smallest token scores, with prompt length $L\approx 80$, token selection $K\%=0.2$, shadow set size approximately $50$–$80$ samples, AdamW with learning rate $10^{-2}$, and $100$–$200$ optimization steps. For diffusion models, it uses proximal initialization with $\tilde x=\mathrm{clamp}(x+\delta,0,1)$, one DDIM inversion step at time $t\approx 150$, a normalized reconstruction error $E(\tilde x,\delta)$, and Adam with learning rate $10^{-3}$ for $2000$ iterations, with the perturbation bound approximately $4$–$64/255$ and optimal around $16/255$. For image classification, it learns a global border perturbation $\delta_{\text{global}}$ on a $32\times 32$ border mask; for graphs, it learns a feature perturbation $\delta_{\text{feat}}$ added to each node’s feature vector. The total classification loss combines preservation, separation, and regularization terms, with $\alpha=1$, $\beta=10^{-3}$, $2000$ steps, and learning rate $10^{-2}$ with cosine decay. The final score vector $[s,s_{\text{cal}},y]$ is fed to a small MLP with two hidden layers of size $64$, ReLU, and sigmoid output. All experiments were run on NVIDIA A100/H800 GPUs with PyTorch [2603.28942].

The empirical emphasis is low-FPR auditing. The reported metrics are balanced accuracy, AUC, and $\mathrm{TPR}@\mathrm{FPR}\in\{0.01\%,0.1\%,1\%,5\%\}$. On WikiMIA with length $128$, averaged over six LLMs, the best passive baseline ReCaLL obtains approximately $86.06\%$ AUC and approximately $18.31\%$ $\mathrm{TPR}@1\%$, while ReproMIA obtains approximately $94.08\%$ AUC and approximately $39.07\%$ $\mathrm{TPR}@1\%$. On MIMIR, the average AUC gain is $+1.33\%$ and TPR gain $+0.87\%$ for $12$B models. Under logits noise with $\sigma$ up to $0.5$, ReproMIA retains $\mathrm{AUC}>90\%$ and $\mathrm{TPR}@1\%>\sim 35\%$. For diffusion DDPM, the runner-up RePIAN has approximately $88.34\%$ AUC and approximately $31.09\%$ $\mathrm{TPR}@1$, while ReproMIA reaches approximately $92.83\%$ AUC and approximately $34.14\%$ $\mathrm{TPR}@1$ using only two queries. For Stable Diffusion, ReproMIA achieves approximately $76.16\%$ AUC versus a best baseline of $71.68\%$, and approximately $31.52\%$ $\mathrm{TPR}@1\%$ versus $16.84\%$. For classification models, average $\mathrm{TPR}@0.01\%$ rises from $0.46\%$ to $0.62\%$, $\mathrm{TPR}@1\%$ from $3.73\%$ to $9.20\%$, and AUC from $80.48\%$ to $81.31\%$; on Cora, PubMed, and Citeseer, GNN AUC is approximately $78$–$82\%$ versus baseline approximately $67$–$73\%$ [2603.28942].

The framework’s practical recommendations are also explicit. Query budgets are small: LLMs and diffusion attacks require only one or two queries per sample, and classification uses one forward pass. Only a small shadow set of approximately $50$–$100$ known members and non-members is stated to be sufficient to train $\delta$, and auditors are advised to maintain a small shadow audit set, learn $\delta$ offline on cheaper surrogate models if necessary, and deploy the method by appending $\delta$ to user queries and thresholding the output score [2603.28942].

## 4. Auditability as a training objective

The multi-task Active MINT formulation treats membership detection not as a post-hoc attack but as an optimization objective coupled to normal supervised learning. Let $S_{\text{train}}=\{(x_i,y_i)\}_{i=1}^N$ be the audited model’s training set and $S_{\text{test}}=\{(x_j,y_j)\}_{j=1}^M$ its held-out test set. For any sample $x_i$, the membership label is $y_i^m=1$ if $x_i\in S_{\text{train}}$ and $y_i^m=0$ if $x_i\notin S_{\text{train}}$, for example if $x_i\in E$. The goal is to learn a predictor of $P(y^m=1\mid x)$ [2509.07879].

The architecture is a two-headed network with audited-model parameters $\theta$ and MINT-model parameters $\phi$. The primary classifier is $f_\theta(\cdot)$, while $h_\theta(x)$ denotes intermediate activations—called “Auxiliary Auditable Data” (AAD)—extracted from shared layers and passed to the MINT head $g_\phi(\cdot)$. The MINT loss is binary cross-entropy on the membership label, the task loss is standard classification loss, and the total objective adds an $L_2$ regularizer $R(\theta,\phi)=\alpha\|\theta\cup\phi\|_2^2$. During back-propagation, gradients of $L_{\text{task}}$ update $\theta$ in layers downstream of the shared layers, while gradients of $L_{\text{mint}}$ update both $\phi$ and the shared trunk in $\theta$ [2509.07879].

The audited architectures evaluated include MobileNet, ResNet50, ResNet101, DenseNet121, Xception, and ViT. Two split points are used in the network, “Entry” and “Middle,” yielding activation maps $h_\theta^1(x)\in\mathbb{R}^{H_1\times W_1\times C_1}$ and $h_\theta^2(x)\in\mathbb{R}^{H_2\times W_2\times C_2}$. The MINT model has two parallel CNN branches, or FC branches for ViT. In the E1 configuration, each branch has one convolution layer with $256$ filters, kernel $3\times 3$, stride $1$, ReLU, and global average pooling to produce a $256$-dimensional vector. In the E2 configuration, each branch has two convolution layers with $1024\rightarrow 2048$ filters, kernel $3\times 3$, stride $1$, ReLU, and global pooling to produce a $2048$-dimensional vector. The branch outputs are concatenated and passed through two FC layers with dropout $0.4$ for E1 and $0.2$ for E2, ReLU activations, and a scalar membership logit whose sigmoid is the membership probability [2509.07879].

The training procedure samples batches from the audited training set and from an external set $E$, concatenates them, computes class loss only on $S_{\text{train}}$ samples and membership loss on both, and optimizes the total loss with Adam or SGD. The experimental setup uses MNIST, CIFAR-10, GTSRB, Tiny-ImageNet, and CASIA-WebFace. For each dataset, the original training set is split $50/50$ into audited training $D$ and external $E$. The optimizer is Adam with $\beta_1=0.9$, $\beta_2=0.999$, batch size $64$, learning rate $10^{-5}$ for MNIST and $10^{-4}$ for larger tasks, loss weighting $\lambda_2/\lambda_1=10$ for simple tasks and $10\,000$ for complex tasks, regularization $\alpha=10^{-4}$ or $10^{-5}$, and early stopping after $50$–$100$ epochs based on validation [2509.07879].

The reported membership-detection accuracies in the Entry setup all exceed $0.80$. On MNIST, values range from $0.80$ for ViT to $0.86$ for MobileNet; on CIFAR-10, values range from $0.86$ to $0.87$ across all listed architectures except no drop below $0.86$; on GTSRB, MobileNet reaches $0.89$ and ViT reaches $0.80$; on Tiny-ImageNet, Xception reaches $0.88$ and ViT reaches $0.81$; on CASIA-WebFace, MobileNet reaches $0.86$ and ViT reaches $0.76$, while the text states that all exceed $0.80$ membership-detection accuracy. Audited-model accuracy dropped less than $2\%$ relative to standalone training. On ResNet50, the comparison to earlier methods is explicit: on CIFAR-10, Shokri et al. MIA achieves $0.64$, Passive MINT $0.66$, and Active MINT $0.86$; on GTSRB, Shokri et al. MIA achieves $0.79$, Passive MINT $0.61$, and Active MINT $0.86$ [2509.07879].

The ablation results identify activation-point choice and task-weighting as central controls. Entry and Middle setups yield comparable high MINT accuracy, whereas Output or late layers consistently underperform with values below $0.82$. Higher $\lambda$ favors MINT at a slight cost to classification, and the stated limitation is the small less-than-$2\%$ drop in primary-task performance, which can be managed by reducing shared layers or tuning $\lambda$. Suggested deployment strategies include cryptographically signed logs, Docker containers with deterministic hashes, and secure MPC setups where the auditor controls the MINT branch [2509.07879].

## 5. Federated-learning aMINT under local differential privacy

In federated learning, the active threat model is structurally different because the attacker is the coordinating server. The server broadcasts a global model, collects clients’ gradients, and is allowed to be actively dishonest rather than merely honest-but-curious. The goal is to decide whether a target point $t$ belonged to a chosen client’s private batch $D$. The paper formalizes this as a security game with an initialization oracle $\mathrm{INIT}(t)$ that returns a modified model $\theta$, a client gradient computation $G=\nabla_\theta L(D,\theta)$ on possibly LDP-noised data, and an inference oracle $\mathrm{INFER}(t,G)$ that outputs a membership bit. The server’s advantage is
$$
\mathrm{Adv}=\tfrac12\Pr[b'=1\mid b=1]+\tfrac12\Pr[b'=0\mid b=0] > 0.5.
$$
The client may also be forced to use a local differential privacy mechanism $M(\cdot,\epsilon)$ specified by the server [2302.12685].

The core attack is to inject a chosen neuron whose activation isolates the target sample. Let $W\in\mathbb{R}^{r\times d}$ be first-layer weights, $h\in\mathbb{R}^r$ the second-layer weights, and
$$
s(x)=h^\top\mathrm{ReLU}(Wx).
$$
If the chosen neuron activates only on $t$ and not on other elements of $D$, then its gradient is nonzero if $t\in D$ and zero if $t\notin D$. The test statistic is therefore the extracted gradient component $g_t$, with
$$
\mathrm{aMINT}(t,G)=[g_t\neq 0].
$$
The server’s construction routine samples decoy negatives from a public distribution, forms an auxiliary dataset with $t$ labeled positive and the decoys labeled negative, trains $(h,W)$ by cross-entropy so that $s(t)\approx 1$ and $s(x)\approx 0$ for $x\neq t$, embeds these parameters into the global model, and later extracts the chosen neuron’s gradient after local client training. Under LDP, the server instead trains the neuron on multiple noised copies $M(t,\epsilon)$ of the target so that it remains active on noised versions of $t$ but inactive on other samples [2302.12685].

The theoretical guarantee is expressed through the expected activation of the chosen neuron under noising. Let
$v(t)=h^\top\mathrm{ReLU}(W\,M(t,\epsilon))$ and $v(x)=h^\top\mathrm{ReLU}(Wx)$. Using Monte Carlo estimates and Hoeffding bounds, the paper defines lower and upper confidence bounds on $\hat E[v(t)]$ and $\hat E[v(x)]$ and states a certified guarantee: if the lower bound on the target’s expected activation is strictly positive and the supremum of the upper bounds on all non-target activations is nonpositive, then with probability at least $1-\delta$ the server’s aMINT test will succeed [2302.12685].

The experiments use CelebA with batch size $20$, ImageNet-10 with batch size $64$, and CIFAR-10 with batch size $100$, all on a two-layer fully connected network over frozen ResNet-18 embeddings of dimension $512$. The LDP mechanisms are BitRand and OME on $512$-bit-quantized embeddings, with attack parameters $r=1{,}000$ neurons in the first layer and one chosen neuron in the second. The reported metrics are advantage, true positive rate, and true negative rate. Without LDP, aMINT reaches $100\%$ success within a single round. Under BitRand, even at $\epsilon=5$ the advantage is at least $0.8$ on all three datasets, and for $\epsilon\ge 9$ it exceeds $0.99$. Under OME, success rates remain above $0.9$ for $\epsilon\ge 3$. The paper further states that pushing $\epsilon$ very low, such as $\epsilon<1$, drives attack success toward $0.5$ but collapses model utility; that DP-SGD with sufficiently small privacy budgets prevents ConvNet training from converging on CIFAR-10 or ImageNet; and that malicious weights are empirically statistically indistinguishable from clean weights by KDE overlap [2302.12685].

This formulation broadens the meaning of aMINT beyond test-time query synthesis. Here “active” refers to malicious intervention in the training loop itself, with gradient observability substituting for direct black-box scoring.

## 6. Evaluation criteria, defenses, and interpretive issues

Evaluation protocols differ across formulations, but all focus on separability between member and non-member responses. ReproMIA reports balanced accuracy, ROC AUC, and $\mathrm{TPR}@\mathrm{FPR}=\{0.01\%,0.1\%,1\%,5\%\}$, with a specific emphasis on low-FPR gains [2603.28942]. The black-box canary framework reports AUC and $\mathrm{TPR}@1\%\mathrm{FPR}$, emphasizing online and offline settings and low-FPR utility in legal contexts [2210.10750]. The multi-task Active MINT work reports membership-detection accuracy across architectures and datasets [2509.07879]. The federated-learning attack reports advantage, TPR, and TNR [2302.12685]. The perceptual probing framework reports AUC together with $\mathrm{TPR}@1\%$ and $\mathrm{TPR}@0.1\%$ [2602.05748].

A recurrent finding is that active procedures preserve or enlarge separation where passive methods weaken. ReproMIA explicitly attributes its gains to overfitting-induced curvature and gradient asymmetries, and states that the largest relative gains occur in low-FPR regimes because mutual information and score separation are increased so that ROC tails spread apart [2603.28942]. The canary method likewise reports its strongest practical relevance in low-FPR settings [2210.10750]. The perceptual probing results concentrate improvements in gradient-based detectors and in mid/late layers rather than early representations [2602.05748]. This suggests that active membership inference is best understood as a signal-amplification strategy rather than as a single detector family.

A common misconception is that active membership inference is necessarily black-box. The literature does not support that restriction. The canary and ReproMIA approaches are black-box or black-box-compatible [2210.10750] [2603.28942], the perceptual interrogation framework assumes white-box access to activations and gradients [2602.05748], the multi-task formulation is intrinsic to the training procedure [2509.07879], and the federated-learning attack relies on server control over model transmission and access to returned gradients [2302.12685].

Another common misconception is that differential privacy or injected noise categorically neutralize active tests. The cited papers instead report partial robustness and privacy–utility trade-offs. ReproMIA retains $\mathrm{AUC}>90\%$ and $\mathrm{TPR}@1\%>\sim 35\%$ under logits noise $\sigma$ up to $0.5$ for LLM defenses, and on diffusion defenses under DP-SGD with $\epsilon\approx 0.5$ still reaches approximately $91$–$92\%$ AUC and approximately $25$–$30\%$ $\mathrm{TPR}@1\%$; for classification defenses, AUC under DP-SGD with $\epsilon\approx 1$ drops to $53\%$ but remains above baselines, while under smoothing $\sigma=0.5$ it remains above $80\%$ [2603.28942]. The canary framework states that under DP defenses it still improves LiRA by $0.6$–$3.6\%$ AUC with TPR gains up to $+1.14\%$ [2210.10750]. The federated-learning work reports that sufficiently strong noise to suppress the attack substantially damages utility or training convergence [2302.12685].

The practical implications therefore vary by setting. In post-hoc black-box auditing, active probes can be precomputed and then reused, including in offline settings [2210.10750]. In proactive privacy auditing, a learned perturbation can be trained on small shadow sets and deployed with one or two queries per sample [2603.28942]. In training-time governance, auditability can be made an explicit optimization target with only a small drop in primary accuracy [2509.07879]. In federated learning, the same active principle exposes the risk that privacy guarantees can fail under a malicious coordinator even when local differential privacy is present [2302.12685].

Source: https://www.emergentmind.com/topics/active-membership-inference-test-amint