How does an attacker's set of shadow models turn a returned probability vector into a membership decision?

## The move A membership attack needs a rule that says, for a candidate record, whether the observed response looks like one a model gives to something it trained on. The stand-in family builds that rule offline, on models the adversary owns, and then transfers it. Understanding it means being precise about three things: what the *inputs* to the rule are, where the *labels* come from, and why *several* stand-ins are used rather than one. Keep the setting fixed: a credit-limit-increase decision model reachable over an ordinary API, returning a full probability vector across the decision classes. The adversary has no weights, no gradients, no explanations, and no per-record loss from the target. ## The input: the response, not the record The object being classified is the model's **response**, not the applicant. A probability vector carries several usable properties at once: - how **peaked** it is — how much mass sits on the top class; - the **margin** between the top class and the runner-up; - the overall **entropy** of the distribution; - **which class** was predicted, and whether that matches the record's known true class. All of those tend to differ between a record a model fitted and a record it did not, because the fit is tighter on what was seen. The adversary does not have to decide in advance which of these properties matters, or where to put a cut-off. That is exactly what fitting the rule does for them. ## The labels: free, because they ran the experiment This is the part that makes the family work. The adversary trains stand-in models on their own same-distribution sample, deliberately including some records and holding others out. For every record they own, they therefore know the ground truth for every stand-in: seen, or not seen. So each observation is a pair — the response a stand-in gave, and a member/non-member tag — and the collection of them is an ordinary supervised dataset. No part of it required anything from the target. This is why the build is described as an *offline calibration*: everything up to the finished rule happens on the adversary's own machines. ## Why several stand-ins One model's memorisation is noisy and idiosyncratic. Which records a given training run over-fits depends on initialisation, ordering, and where each record sits relative to the mass of the data. A rule fitted against a single stand-in learns that one run's quirks along with the systematic effect. Training several stand-ins on overlapping-but-different samples lets the rule see the same record both included and excluded, across runs, and average out what is idiosyncratic. The count of stand-ins is one half of this attack's real cost — the other half is the credibility of the same-distribution sample — and it is the number a red-teamer is asked to justify. ## Per-class rules Confidence profiles are not comparable across classes. A model is routinely peaked and confident on a large, easy class for members and non-members alike, and diffuse on a rare class for both. A single global rule blurs the two and loses most of the signal. So the discriminator is normally fitted **per predicted class**, which is one of the practical advantages of the stand-in family: the calibration is done separately where the behaviour differs. ## Transferring the boundary rather than a number The useful framing for an interview: this family transfers a **decision boundary learned in response space**, not a threshold on a single scalar. That is what it buys over a hand-set cut-off — it can combine several properties of the response, adapt per class, and it needs no calibration point taken from the target. What it pays for that is the whole build: a defensible same-distribution sample and several training runs. ## What it does not do The output is still one bit per candidate record, and a noisy one. The rule does not reveal the target's parameters, does not reconstruct any record, and does not tell you *why* a record was in the set. Its quality is measured as advantage over the base rate of membership among the candidates you are testing, not as raw accuracy — a rule that says "member" for everything scores impressively when most candidates really are members. And the rule inherits the stand-ins' assumptions. If the stand-ins over-fit differently from the target — different data volume relative to capacity, different regularisation regime, a different applicant mix — the boundary sits in the wrong place and the transferred rule falls back toward chance.