Membership inference attacks try to tell whether a specific sample was part of a model's training data. A widely repeated account holds that models rely on fine-grained detail for memorized samples, so degrading an input's resolution should make predictions falter and expose membership. A new arXiv paper tests this idea in the frequency domain.
Using a band-resolved analysis, the paper compares frequency-domain membership inference against a simpler baseline: confidence thresholding, which flags samples based on prediction confidence. The title states the result: the frequency-domain method does not beat confidence thresholding.
The finding challenges the assumption that resolution degradation is a reliable signal of memorization. It also reinforces the value of testing intuitive attack mechanisms against strong baselines before assuming they work.