A confidence score alone can leak whether a specific piece of text sat in a model's training
set — no gradients, no weights, just how sure the model sounds. Train a tiny in-browser classifier on
synthetic poker hand summaries, then see if you can out-guess the simplest possible attack: a threshold
on confidence.
Grounded in:"Empirical Evaluation of Membership Inference Attacks on NLP Text Classifiers: A
Baseline Study on SST-2" — arXiv:2609.10935
(Novak & Abusaqer, 2026). The paper benchmarks membership inference on GLUE SST-2 sentiment
classification: a fine-tuned DistilBERT reaches 0.9466 dev accuracy (vs 0.8756 for a
TF-IDF + Logistic Regression baseline), yet a dead-simple loss-threshold attack — guess "member" when
the model's loss on an example is low / confidence is high — beats random guessing on both models
(Attack AUC 0.5615 for DistilBERT, 0.5800 for Logistic Regression). This demo replicates that
exact mechanism live in your browser on a toy classifier over synthetic poker hand-history text, so the leak
is bigger and easier to see than the paper's real, subtler numbers — the point still holds: confidence alone
is a side channel.
94.66%
DistilBERT dev accuracy (real paper)
87.56%
TF-IDF+LogReg dev accuracy (real paper)
0.5615
DistilBERT attack AUC (real paper)
0.5800
LogReg attack AUC (real paper)
1 Train the toy leak-prone classifier
A bag-of-words logistic regression trains live, right here, on 60 synthetic "value bet"
vs. "bluff" hand summaries (full-batch gradient descent, real cross-entropy loss, no pre-baked numbers).
Small training set + a vocabulary almost as big as the dataset ⇒ classic overfitting conditions, the same
soil membership inference grows in.
Training-set loss (members)Held-out loss (non-members)
Click "Train Model" to fit the classifier and watch the loss gap open up.
2 Where the confidence gap lives
Every dot is one hand: its position is the model's confidence in the true label.
Top row = hands the model actually trained on (members). Bottom row = fresh hands it never saw
(non-members). Drag the threshold — guess "member" whenever confidence clears it — and watch the simple
attack's accuracy update live.
Threshold confidence: 0.80
Attack accuracy at this threshold: —
3 Beat the algorithm
One hand at a time — was it in the training set, or is it fresh? Guess before you peek at
the model's confidence. Then compare your intuition to the simple threshold attacker's guess, round after
round.