Attack Configuration
LiRA trains 16 shadow models on calibration data and uses likelihood ratio statistics to estimate the probability that a dataset was included in the target model's training set.
Attack Stages
Stage 1 — Initializing shadow model ensemble (16/16)
Stage 2 — Partitioning member / non-member sets
Stage 3 — Training shadow models on calibration data
Stage 4 — Calibrating likelihood ratio thresholds
Stage 5 — Probing target model API
Stage 6 — Computing per-asset membership probabilities
Stage 7 — Aggregating dataset risk score