cleverhans-lab/optifluence

OptiFluence is the research code behind an academic paper accepted to a major machine learning conference in 2026, about how to design better privacy tests for machine learning models. The core idea is a privacy canary: a specially chosen or specially crafted example added to a model's training data, used afterward to test whether someone looking at the trained model could tell if that specific example was part of the training set. If an attacker can reliably spot the canary, that suggests the model may be leaking private information about the rest of its training data too. The code trains models on well known image datasets, including MNIST, CIFAR-10, CIFAR-100, and a medical skin image dataset called HAM10000, and compares several ways of choosing or optimizing which examples to use as canaries. It then runs an attack, called a membership inference attack, which tries to guess whether particular images were used in training, and records how successful that attack was. Using the code involves multiple stages: selecting candidate canaries based on how much influence they have on the model, optionally optimizing them further, initializing them, training many target and shadow models on GPU compute clusters managed by Slurm, and finally running the attack and saving the results. The repository also includes extra experiments that reuse canaries from the main runs to study privacy under differential privacy noise settings and to test whether an attack still works when the model architecture changes. This is not a general purpose tool for typical developers. It is meant for machine learning privacy researchers who have access to a computing cluster and want to reproduce or build on this paper's experiments. The code builds on work from a few other open source research projects for its attack methods and training setup, and it is released under the MIT license.