Meta-Learning-Based Few-Shot Membership Inference Attacks Under Restricted Black-Box Access to Ranked Top-K Probabilities

Abstract

Membership inference attacks (MIAs) determine whether a sample was used to train a target model. Existing attacks often require abundant auxiliary data or many reference models, which may be unavailable in restricted services. We propose a meta-learning-based few-shot MIA for black-box interfaces returning only ranked Top-K probabilities. Shadow-model responses form episodic tasks for a relation network; at inference, ten known target members are aggregated as support and compared with each query. Across six directed dataset–architecture transfers, descriptive mean AUCs range from 0.8115 to 0.9471. In the primary Mini-ImageNet/ResNet-18 to CIFAR-100/ViT-B/16 transfer, three independent target/relation-network pipelines achieve an AUC of 0.9444±0.0061 and a TPR of 0.0998±0.0455 at 1% FPR. Performance is competitive with raw Top-1 (0.9435±0.0036) and few-shot-fine-tuned Shokri (0.9420±0.0022), with no uniform dominance. Reducing the target’s member–held-out accuracy gap from 77.17 to 18.53 percentage points lowers AUC to 0.6038±0.0094. Support and relation-function controls also vary by initialization. Thus, ranked Top-K outputs can leak membership information, particularly for overfitted targets, while learned support conditioning provides no universal advantage.