Query-Efficient Black-Box Membership Inference Attacks via Adaptive Sparse Perturbations

Abstract

Membership inference attacks (MIAs) determine whether a queried record was included in a model's training set, posing a significant privacy risk to deployed machine learning services. Existing black-box attacks often depend on confidence vectors or numerous augmented queries, resulting in high query costs. This paper investigates a query-efficient black-box MIA based on adaptive sparse perturbations, which probes only a small subset of input coordinates and stops querying once sufficient prediction instability is observed. We formalize the attack pipeline under a score-based black-box threat model in which the adversary observes the full output probability vector but does not know model internals, training data, deployed defenses, or hidden preprocessing steps. We further define input coordinates as scalar dimensions of numeric inputs, specify sparse-coordinate sampling and perturbation magnitudes, and calibrate adaptive stopping thresholds on held-out validation data rather than on the final evaluation split. Using archived experimental results, the adaptive high-precision attack achieves the same average AUC as the fixed high-precision baseline (0.7525 vs. 0.7522) while reducing queries by $25.41 {\%}$. Relaxed sparse variants further cut query costs by up to 82.97% with only minor AUC degradation. Taken as an archival reanalysis, the results indicate that sparse local instability is a useful membership signal and that adaptive stopping can substantially reduce attack cost in black-box privacy evaluation.