Imitative Membership Inference Attack

• IMIA is a black-box membership inference attack that employs target-informed imitative training to construct ensembles mimicking a target classifier’s behavior.
• It reduces variance and computational overhead compared to conventional shadow model attacks by utilizing pivot-based fine-tuning and scaled-confidence margins.
• Empirical evaluations demonstrate IMIA’s enhanced low-FPR performance and efficiency across diverse datasets, though it remains sensitive to distribution shifts and privacy defenses.

Imitative Membership Inference Attack (IMIA) is a black-box membership inference paradigm in which the adversary replaces target-agnostic shadow training with target-informed imitative training, constructing a small ensemble of models that mimic a target classifier’s behavior and then comparing the target’s observed score on a query to the score distributions induced by imitative “out” and “in” models (Du et al., 8 Sep 2025). In the formulation introduced in "Imitative Membership Inference Attack" (Du et al., 8 Sep 2025), the target is a classifier $f_T : \mathcal{X} \to \Delta^c$ queried through softmax posteriors, auxiliary data $D_{\mathrm{adv}}$ are sampled from the same data distribution, and membership is inferred from a non-parametric discrepancy score built from scaled-confidence margins. The acronym IMIA is not uniform across the literature: it has also been used for "Iterations for Membership Inference Attack," which bases inference on adversarial-generation iteration counts (Xue et al., 3 Jun 2025), and related wireless-security work employs an imitative surrogate stage to compensate for over-the-air channel mismatch (Shi et al., 2021). Within current usage, however, IMIA most commonly denotes the target-informed imitative-training attack of 2025 (Du et al., 8 Sep 2025).

1. Threat model and conceptual basis

The goal of IMIA is the standard membership inference task: given a target classifier $f_T$ trained on $D_{\mathrm{train}} \subset \mathbb{D}$, decide for a queried labeled instance $(x,y)$ whether $x \in D_{\mathrm{train}}$ or $x \notin D_{\mathrm{train}}$ (Du et al., 8 Sep 2025). The attack assumes black-box access to the target’s softmax probabilities with default temperature $1$; where available, pre-softmax logits improve performance but are not strictly required. Label-only access is not the focus of the method. As in standard MIAs, the adversary may sample auxiliary data from the same distribution in order to construct $D_{\mathrm{adv}}$ (Du et al., 8 Sep 2025).

The method is defined for two operational settings. In the non-adaptive, or offline, setting, imitative models are trained before the query set $D_{\mathrm{query}}$ is observed and are then reused across queries. In the adaptive, or online, setting, imitative models may be trained after observing $D_{\mathrm{adv}}$0 and may depend on each query instance. The formulation follows the membership inference security game of Du et al. as summarized in the paper (Du et al., 8 Sep 2025).

IMIA is motivated by a limitation of conventional shadow-model attacks. Traditional shadow MIAs train many target-agnostic shadows on random subsets of $D_{\mathrm{adv}}$1, and the resulting membership signals can exhibit high variance across models and instances, especially in difficult cases. Strong attacks such as LiRA and PMIA therefore rely on hundreds of shadows, which induces substantial computational overhead. IMIA conditions model construction on target outputs in order to reduce this variance. The paper makes this intuition explicit through the Law of Total Variance: $D_{\mathrm{adv}}$2 where $D_{\mathrm{adv}}$3 denotes observable outputs of the target. The intended implication is that conditioning on target outputs stabilizes the membership signal $D_{\mathrm{adv}}$4 (Du et al., 8 Sep 2025).

This conditioning is operationalized by training imitative out models to match target behavior on non-members and then fine-tuning those same models on carefully selected pivot instances so as to produce imitative in models. The paper reports that with $D_{\mathrm{adv}}$5 imitative models, IMIA can obtain stable in/out score distributions while using less than $D_{\mathrm{adv}}$6 of the computational cost of state-of-the-art shadow-based approaches (Du et al., 8 Sep 2025).

2. Mathematical formulation and imitative training

The central scalar statistic in IMIA is the scaled-confidence margin. For posterior vector $D_{\mathrm{adv}}$7 and true class $D_{\mathrm{adv}}$8, the method defines

$D_{\mathrm{adv}}$9

When logits $f_T$0 are available, the numerically stable form is

$f_T$1

The paper treats this quantity as more membership-informative than raw loss and uses it throughout both model construction and final inference (Du et al., 8 Sep 2025).

The first training phase constructs imitative out models $f_T$2 by minimizing a weighted mean-squared error between the log probabilities of the imitative model and the target: $f_T$3 The weighting scheme emphasizes the ground-truth class $f_T$4 and the target’s most likely wrong class $f_T$5, while the remaining classes receive weight $f_T$6. The paper identifies this weighting as preferable to standard KL-based distillation because it concentrates on the logits viewed as most membership-indicative (Du et al., 8 Sep 2025).

The second phase produces imitative in models by continuing training on a pivot dataset $f_T$7 with cross-entropy: $f_T$8 This phase is intended to preserve the target-informed behavior learned during imitation while encoding behavior associated with training inclusion (Du et al., 8 Sep 2025).

Pivot selection is itself target-informed. The paper selects, for each class, the $f_T$9 auxiliary instances with lowest target loss: $D_{\mathrm{train}} \subset \mathbb{D}$0 with default $D_{\mathrm{train}} \subset \mathbb{D}$1. For a query $D_{\mathrm{train}} \subset \mathbb{D}$2, proxies are all members of $D_{\mathrm{train}} \subset \mathbb{D}$3 with the same class label $D_{\mathrm{train}} \subset \mathbb{D}$4 (Du et al., 8 Sep 2025).

The resulting two-phase construction is what distinguishes IMIA from ordinary shadow training and from distillation-only MIA variants. The first phase mimics target behavior on auxiliary data, and the second injects an explicit “in” signal through cross-entropy on carefully chosen pivots. The paper argues that distillation-only methods such as Attack-D, SeqMIA, and GLiRA lack this dual behavior modeling and therefore perform poorly in the low-FPR regime relative to IMIA (Du et al., 8 Sep 2025).

3. Membership score, decision rule, and operational variants

For a query $D_{\mathrm{train}} \subset \mathbb{D}$5, IMIA collects the target’s observed scaled-confidence score

$D_{\mathrm{train}} \subset \mathbb{D}$6

It then evaluates the query against the ensemble of imitative out models and the corresponding imitative in models. The out scores are

$D_{\mathrm{train}} \subset \mathbb{D}$7

The in scores are aggregated across the imitative in models and the class-matched proxies in $D_{\mathrm{train}} \subset \mathbb{D}$8, yielding a mean $D_{\mathrm{train}} \subset \mathbb{D}$9. Membership is then scored with the non-parametric squared-distance difference

$(x,y)$0

The default decision rule is to predict member if $(x,y)$1, though in practice the paper also calibrates a threshold $(x,y)$2 to meet a target FPR and declares member iff $(x,y)$3 (Du et al., 8 Sep 2025).

In the non-adaptive setting, the attack prepares the imitative ensemble once. The adversary samples $(x,y)$4, queries the target on $(x,y)$5, selects $(x,y)$6, and for each $(x,y)$7 trains an imitative out model for $(x,y)$8 epochs on $(x,y)$9, then continues training for $x \in D_{\mathrm{train}}$0 epochs on $x \in D_{\mathrm{train}}$1 over $x \in D_{\mathrm{train}}$2 to obtain an imitative in model. The paper’s default hyperparameters are $x \in D_{\mathrm{train}}$3, $x \in D_{\mathrm{train}}$4, $x \in D_{\mathrm{train}}$5, $x \in D_{\mathrm{train}}$6, and temperature $x \in D_{\mathrm{train}}$7 (Du et al., 8 Sep 2025).

In the adaptive setting, the attack is query-dependent. For each query $x \in D_{\mathrm{train}}$8, the adversary samples $x \in D_{\mathrm{train}}$9, defines $x \notin D_{\mathrm{train}}$0 and $x \notin D_{\mathrm{train}}$1, trains $x \notin D_{\mathrm{train}}$2 and $x \notin D_{\mathrm{train}}$3 with the same two-phase procedure, and uses the resulting in/out ensembles to score the query (Du et al., 8 Sep 2025).

The default IMIA scorer is non-parametric and does not require Gaussian fitting of score distributions. The paper nonetheless describes an “IMIA-LiRA” variant in which LiRA-style Gaussian likelihood-ratio modeling is applied to imitative scores when more imitative models are available, yielding additional gains at increased computational cost (Du et al., 8 Sep 2025).

4. Empirical behavior, low-FPR performance, and efficiency

The empirical evaluation covers image datasets MNIST, Fashion-MNIST, CIFAR-10, and CIFAR-100 with ResNet-50, VGG-16, DenseNet-121, and MobileNet-V2 targets, as well as the tabular datasets Purchase-100 and Texas-100 with MLP targets. Training uses SGD with learning rate $x \notin D_{\mathrm{train}}$4, momentum $x \notin D_{\mathrm{train}}$5, weight decay $x \notin D_{\mathrm{train}}$6, cosine learning-rate scheduling, and standard image augmentation (Du et al., 8 Sep 2025). The primary metrics are $x \notin D_{\mathrm{train}}$7, $x \notin D_{\mathrm{train}}$8, and balanced accuracy.

In the non-adaptive ResNet-50 setting, IMIA outperforms PMIA, LiRA, Canary, GLiRA, RMIA, and RAPID across the datasets reported in the paper. On MNIST, IMIA attains $x \notin D_{\mathrm{train}}$9 versus $1$0 for PMIA, $1$1 versus $1$2, and balanced accuracy $1$3 versus $1$4. On Fashion-MNIST, the corresponding values are $1$5 versus $1$6, $1$7 versus $1$8, and $1$9 versus $D_{\mathrm{adv}}$0. On CIFAR-10, IMIA reports $D_{\mathrm{adv}}$1 versus $D_{\mathrm{adv}}$2, $D_{\mathrm{adv}}$3 versus $D_{\mathrm{adv}}$4, and $D_{\mathrm{adv}}$5 versus $D_{\mathrm{adv}}$6. On CIFAR-100, it reports $D_{\mathrm{adv}}$7 versus $D_{\mathrm{adv}}$8, $D_{\mathrm{adv}}$9 versus $D_{\mathrm{query}}$0, and $D_{\mathrm{query}}$1 versus $D_{\mathrm{query}}$2 (Du et al., 8 Sep 2025).

The adaptive ResNet-50 results preserve this ordering. On MNIST, IMIA yields $D_{\mathrm{query}}$3 versus $D_{\mathrm{query}}$4 for LiRA and $D_{\mathrm{query}}$5 versus $D_{\mathrm{query}}$6. On Fashion-MNIST, the values are $D_{\mathrm{query}}$7 versus $D_{\mathrm{query}}$8 and $D_{\mathrm{query}}$9 versus $D_{\mathrm{adv}}$00. On CIFAR-10, they are $D_{\mathrm{adv}}$01 versus $D_{\mathrm{adv}}$02 and $D_{\mathrm{adv}}$03 versus $D_{\mathrm{adv}}$04. On CIFAR-100, they are $D_{\mathrm{adv}}$05 versus $D_{\mathrm{adv}}$06 and $D_{\mathrm{adv}}$07 versus $D_{\mathrm{adv}}$08 (Du et al., 8 Sep 2025).

The non-image results are more pronounced. On Purchase-100 in the non-adaptive setting, IMIA reports $D_{\mathrm{adv}}$09 versus $D_{\mathrm{adv}}$10 for PMIA, $D_{\mathrm{adv}}$11 versus $D_{\mathrm{adv}}$12, and balanced accuracy $D_{\mathrm{adv}}$13 versus $D_{\mathrm{adv}}$14. On Texas-100, it reports $D_{\mathrm{adv}}$15 versus $D_{\mathrm{adv}}$16, $D_{\mathrm{adv}}$17 versus $D_{\mathrm{adv}}$18, and $D_{\mathrm{adv}}$19 versus $D_{\mathrm{adv}}$20 (Du et al., 8 Sep 2025).

A notable feature of IMIA is reduced variance across random targets. The paper reports, for example, that on MNIST in the non-adaptive setting, IMIA achieves $D_{\mathrm{adv}}$21, compared with $D_{\mathrm{adv}}$22 for PMIA and $D_{\mathrm{adv}}$23 for LiRA. Residual analyses further indicate that normalized residuals under Gaussian fits follow $D_{\mathrm{adv}}$24 more closely for imitative models than for shadow models, and Wasserstein distances between in/out distributions are substantially larger for imitative models, including a reported $D_{\mathrm{adv}}$25 versus $D_{\mathrm{adv}}$26 on CIFAR-100 (Du et al., 8 Sep 2025).

The computational results are central to the method’s positioning. On a single A100 GPU in the non-adaptive setting, IMIA runs in $D_{\mathrm{adv}}$27 h on MNIST, $D_{\mathrm{adv}}$28 h on Fashion-MNIST, $D_{\mathrm{adv}}$29 h on CIFAR-10, $D_{\mathrm{adv}}$30 h on CIFAR-100, $D_{\mathrm{adv}}$31 h on Purchase, and $D_{\mathrm{adv}}$32 h on Texas, compared with $D_{\mathrm{adv}}$33–$D_{\mathrm{adv}}$34 h for PMIA and LiRA. In the adaptive setting, the corresponding runtimes are $D_{\mathrm{adv}}$35, $D_{\mathrm{adv}}$36, $D_{\mathrm{adv}}$37, $D_{\mathrm{adv}}$38, $D_{\mathrm{adv}}$39, and $D_{\mathrm{adv}}$40 h, versus $D_{\mathrm{adv}}$41–$D_{\mathrm{adv}}$42 h for LiRA. The paper summarizes these reductions as approximately $D_{\mathrm{adv}}$43 or greater across datasets (Du et al., 8 Sep 2025).

5. Nomenclature, related constructions, and interpretation across domains

The acronym IMIA has been used for distinct attack families, and distinguishing them is important for correct interpretation. In "Privacy Leaks by Adversaries: Adversarial Iterations for Membership Inference Attack" (Xue et al., 3 Jun 2025), IMIA stands for Iterations for Membership Inference Attack, not imitative training. There, the attack infers membership from the minimal number of adversarial-attack iterations $D_{\mathrm{adv}}$44 required to generate a successful adversarial example, with decision rule

$D_{\mathrm{adv}}$45

That method operates in score-based black-box, decision-based black-box, and white-box settings using SimBA, HSJA, and PGD respectively, and it does not train shadow models or imitative models. Its empirical signal is therefore tied to adversarial-generation dynamics rather than to target-informed imitation (Xue et al., 3 Jun 2025).

A different use of imitation appears in wireless signal classification. "Membership Inference Attack and Defense for Wireless Signal Classifiers with Deep Learning" (Shi et al., 2021) studies an over-the-air scenario in which the adversary’s received signal differs from the service provider’s view because of channel mismatch. The adversary therefore trains a surrogate classifier $D_{\mathrm{adv}}$46 on its own received features and labels inferred from observed admissions so as to imitate the target on the adversary’s input domain. Membership inference is then performed by a learned binary model $D_{\mathrm{adv}}$47 over $D_{\mathrm{adv}}$48 or $D_{\mathrm{adv}}$49, with decision threshold $D_{\mathrm{adv}}$50. This is an imitative pipeline, but it is structurally distinct from the target-informed imitative-training ensemble of (Du et al., 8 Sep 2025, Shi et al., 2021).

The question of how IMIA transfers to LLMs is addressed indirectly in "CheckMIABench: Firm Foundations For Membership Inference Attacks on LLMs" (Wang et al., 16 Jun 2026). That benchmark does not explicitly define, implement, or evaluate IMIA. Instead, it constructs an i.i.d. evaluation protocol by partitioning shuffled pre-training data around an intermediate checkpoint, so that member and non-member samples are drawn from the same distribution $D_{\mathrm{adv}}$51. The attack interface is the standard binary MIA setting: draw $D_{\mathrm{adv}}$52 or $D_{\mathrm{adv}}$53, compute a score $D_{\mathrm{adv}}$54, threshold at $D_{\mathrm{adv}}$55, and report ROC, AUC, and $D_{\mathrm{adv}}$56 (Wang et al., 16 Jun 2026).

Within that framework, IMIA would have to be added as a new attack module. The paper explicitly states that IMIA is not “blind,” since it requires model outputs to train the imitator, and it notes that a black-box IMIA using next-token probabilities would be compatible with the benchmark. It also reports that on cleaned Pythia and OLMo splits, existing likelihood-based, calibration-based, and white-box attacks remain close to chance, with AUCs typically near $D_{\mathrm{adv}}$57 and very low $D_{\mathrm{adv}}$58. This suggests that an LLM adaptation of IMIA would be evaluated under much stricter controls against distribution shift than many earlier MIA benchmarks provided (Wang et al., 16 Jun 2026).

6. Ablations, defenses, limitations, and open problems

The ablation studies in (Du et al., 8 Sep 2025) isolate several design choices. Replacing the imitation loss with KL-based distillation or replacing imitative training with conventional shadow training significantly degrades low-FPR performance. On MNIST in the non-adaptive setting, $D_{\mathrm{adv}}$59 is $D_{\mathrm{adv}}$60 for IMIA, compared with $D_{\mathrm{adv}}$61 for distillation and $D_{\mathrm{adv}}$62 for shadow training; on CIFAR-10, the corresponding values are $D_{\mathrm{adv}}$63, $D_{\mathrm{adv}}$64, and $D_{\mathrm{adv}}$65. Using soft targets at temperature $D_{\mathrm{adv}}$66 outperforms hard labels at temperature $D_{\mathrm{adv}}$67, while remaining robust for $D_{\mathrm{adv}}$68. Per-class lowest-loss pivots outperform random pivots and remain robust for $D_{\mathrm{adv}}$69 to $D_{\mathrm{adv}}$70. Emphasizing the true class and top competitor in $D_{\mathrm{adv}}$71 is important, and square-root weighting is reported as the default best choice. Too small a pivot fine-tuning budget, such as $D_{\mathrm{adv}}$72, underfits; too many epochs can overfit the CE phase and erode target-informed behavior. Pre-softmax logits are preferred for $D_{\mathrm{adv}}$73, while pure loss is inferior as a membership signal (Du et al., 8 Sep 2025).

The method has explicit assumptions. It relies on access to posterior probabilities or logits and on auxiliary data from the same distribution as the target’s training data. It does not directly target label-only interfaces. As with other MIAs, distribution shift between $D_{\mathrm{adv}}$74 and $D_{\mathrm{adv}}$75 degrades performance, especially in very low-FPR regimes. The paper reports, for example, that when the target is trained on CIFAR-10 but the adversary uses CINIC-ImageNet, low-FPR performance drops notably across attacks, including IMIA (Du et al., 8 Sep 2025).

Defenses reduce IMIA along with competing attacks. Under strong DP-SGD on CIFAR-10 in the non-adaptive setting, with $D_{\mathrm{adv}}$76 and $D_{\mathrm{adv}}$77, the target accuracy drops to approximately $D_{\mathrm{adv}}$78 and IMIA’s $D_{\mathrm{adv}}$79 falls to approximately $D_{\mathrm{adv}}$80. Adaptive comparisons at $D_{\mathrm{adv}}$81 still show IMIA leading, but the absolute leakage is much smaller; for example, at $D_{\mathrm{adv}}$82, the reported $D_{\mathrm{adv}}$83 is $D_{\mathrm{adv}}$84 for IMIA versus $D_{\mathrm{adv}}$85 for LiRA and $D_{\mathrm{adv}}$86 for Canary (Du et al., 8 Sep 2025).

For LLMs, the principal open problem is not only whether an imitative attack can be implemented, but whether it retains measurable power once evaluation artifacts are removed. CheckMIABench shows that blind baselines collapse to AUCs near $D_{\mathrm{adv}}$87 on cleaned splits and that published MIAs also struggle under i.i.d. pre-/post-checkpoint construction (Wang et al., 16 Jun 2026). A plausible implication is that any LLM instantiation of IMIA would need unusually clear access assumptions, carefully controlled query budgets, and stronger evidence of statistical significance than earlier distribution-shifted benchmarks required.

In current usage, therefore, IMIA denotes a target-informed, low-variance alternative to large shadow ensembles: it models target behavior through weighted imitation, refines “in” behavior through pivot-based fine-tuning, and infers membership from a non-parametric comparison of scaled-confidence margins (Du et al., 8 Sep 2025). Its empirical profile is strongest in low-FPR auditing settings with posterior access and matched auxiliary data, while its main constraints are dependence on target outputs, sensitivity to distribution shift, and diminishing absolute power under strong privacy defenses (Du et al., 8 Sep 2025).