  The wide adoption and application of Masked language models~(MLMs) on
sensitive data (from legal to medical) necessitates a thorough quantitative
investigation into their privacy vulnerabilities -- to what extent do MLMs leak
information about their training data? Prior attempts at measuring leakage of
MLMs via membership inference attacks have been inconclusive, implying the
potential robustness of MLMs to privacy attacks. In this work, we posit that
prior attempts were inconclusive because they based their attack solely on the
MLM's model score. We devise a stronger membership inference attack based on
likelihood ratio hypothesis testing that involves an additional reference MLM
to more accurately quantify the privacy risks of memorization in MLMs. We show
that masked language models are extremely susceptible to likelihood ratio
membership inference attacks: Our empirical results, on models trained on
medical notes, show that our attack improves the AUC of prior membership
inference attacks from 0.66 to an alarmingly high 0.90 level, with a
significant improvement in the low-error region: at 1% false positive rate, our
attack is 51X more powerful than prior work.
