What does a shadow-model membership attack lose if the API returns only a top-1 label?

## What the vantage change actually removes The stand-in family fits a decision rule over the *response*. With a full probability vector across the decision classes, the response is rich: the mass on the top class, the margin over the runner-up, the spread across the remaining classes, and which class won. Those are the properties that differ between a record the model fitted and one it did not. Cut the endpoint back to a top-1 decision and every one of those disappears at once. What remains, per query, is a single categorical outcome. Its only membership-relevant reading is whether it *matches the record's true class* — which means the adversary must already hold the record's ground-truth label, an extra precondition the score-based version did not need. ## Why the build degrades rather than dies The machinery is unchanged in shape. The adversary still trains stand-ins on same-distribution data, still knows which records each stand-in saw, and still fits a rule — but now on label-only evidence. The evidence available is thinner and noisier: correctness on the record, and how stable that correctness is when the record is presented in slightly varied but semantically equivalent forms. A model tends to be right, and consistently right, on records it fitted; it is more often wrong and less stable on records it did not. That is a far weaker per-observation signal than a peaked probability vector, so the achievable advantage over the base rate is lower and the number of observations per candidate is higher. The cost moves from the offline build onto the online interaction with the target. ## The direction of the claim This is the part interviewers press on, because the intuitive conclusion is backwards. Membership leakage is a consequence of **imperfect generalization** — the model fits what it saw more tightly than what it did not. That gap is a property of the trained weights. The output format decides how cheaply an outsider can *read* the gap; it does not decide whether the gap exists. So the honest statement is: reducing what the endpoint returns raises the adversary's bill and removes the richest signal family. It is a cost control. It is not a boundary, and it does not license the sentence "membership inference is no longer possible against this endpoint." The same reasoning applies to the partial versions of the change. Rounding scores to two decimals, returning only the top class's probability, or truncating the vector to the top few classes all sit on the same spectrum: each removes some of the response's shape, each raises the observation count needed, and none touches the underlying fit. A red-teamer asked to assess such a change should report it in those terms — an estimate of how much more expensive the attack became — rather than as a yes/no. ## What else shifts under the reduced vantage - **The precondition set grows.** Needing the candidate record's true class narrows which candidates can be tested at all. - **Per-class calibration gets harder.** With a vector, the rule could be fitted separately per predicted class because the confidence regimes differ. With a bare label there is much less to split on. - **Noise dominates on easy records.** A model is right about a common, well-separated record whether or not it trained on it, so label-only evidence carries almost nothing there. The signal concentrates on the borderline and atypical records — which, for a privacy finding, is often exactly where the interesting records are anyway. - **The stand-in cost does not fall.** The offline half of the build is unchanged; you still need the same-distribution sample and several training runs. The reduced vantage only makes the online half more expensive, so the total goes up. ## The one-line answer A top-1 label strips the confidence shape the rule was fitted on, so the attack keeps its structure but loses most of its signal per query and pays for it in observations and preconditions. The leak is in the fit, not in the format.