\section{Preliminaries and Problem Formulation}
%\subsection{Membership Inference Attacks}
Membership inference attacks aim to detect whether a sample belongs to the target model's training set or not. Hence, it can be formulated as a binary classification task. Suppose there is an attack model $f_a(\cdot; \theta_a)$ with parameters $\theta_a$ and a target model $f(\cdot; \theta)$ with parameters $\theta$. Then the attacker can predict whether the sample $x$ is in or out of the target model's training dataset:
\begin{equation}
%\small
    \operatorname*{arg\,max} f_a(f(x;\theta);\theta_a)
\end{equation}
%Developing an attack model, it needs to mimic the target models' prediction distributions. 
If one were to develop an attack model, the model needs to mimic the target model's prediction distribution. A widely adopted solution is the shadow model approach \cite{shokri2017membership}. Through some shadow models $f(\cdot; \theta)$ with parameters $\theta_s$, the attack model tries to find the best decision boundary to determine the samples:
\begin{equation}
%\small
\begin{aligned}
    \operatorname*{max}_{\theta_a} & 
    [ \mathbb{E}_{(x, y) \in D_{in}} f_a(f_s(x;\theta_s);\theta_a) \\ +
    & [ \mathbb{E}_{(x, y) \in D_{out}} (1 - f_a(f_s(x;\theta_s);\theta_a))]
\end{aligned}
\end{equation}
where $D_{in}$ is the shadow models' training set and $D_{out}$ is a non-intersection set of the training set.
Once the MIA's successful rate is maximized on the shadow models, the attack model can be considered to be successfully trained.
In the appendix, a summary and discussion/comparisons of existing defense mechanisms are provided.