Quantifying Membership Inference Vulnerability via Generalization Gap
  and Other Model Metrics
  We demonstrate how a target model's generalization gap leads directly to an
effective deterministic black box membership inference attack (MIA). This
provides an upper bound on how secure a model can be to MIA based on a simple
metric. Moreover, this attack is shown to be optimal in the expected sense
given access to only certain likely obtainable metrics regarding the network's
training and performance. Experimentally, this attack is shown to be comparable
in accuracy to state-of-art MIAs in many cases.
