Using Approximate Bayesian Neural Networks for Membership Inference

Abstract

As machine learning systems are increasingly deployed in privacy-sensitive settings, evaluating their vulnerability to Membership Inference Attacks (MIA) has become an important security concern. These attacks aim to determine whether a given data point was part of a target model’s training set, thereby potentially revealing sensitive information about individuals or organisations. Although state-of-the-art attacks such as LiRA, rMIA, and BASE can achieve strong performance, they typically rely on training an ensemble of shadow models and therefore require substantial computational resources. This work investigates a more efficient alternative based on approximate Bayesian inference. In particular, we evaluate four Bayesian Neural Networks approximations: Monte Carlo Dropout, SWAG, Laplace approximation, and Regularized Variational Inference as cost-effective alternatives for membership inference against deterministic target models. We compare these methods across multiple classification settings and against shadow-model-based attacks. Our results show that Monte Carlo Dropout and SWAG can achieve performance comparable to a limited shadow-model ensemble, providing a useful trade-off between attack strength and computational cost, while also showing that metrics such as diversity and accuracy can serve as helpful predictors of attack performance.