  When an adversary provides poison samples to a machine learning model,
privacy leakage, such as membership inference attacks that infer whether a
sample was included in the training of the model, becomes effective by moving
the sample to an outlier. However, the attacks can be detected because
inference accuracy deteriorates due to poison samples. In this paper, we
discuss a \textit{backdoor-assisted membership inference attack}, a novel
membership inference attack based on backdoors that return the adversary's
expected output for a triggered sample. We found three crucial insights through
experiments with an academic benchmark dataset. We first demonstrate that the
backdoor-assisted membership inference attack is unsuccessful. Second, when we
analyzed loss distributions to understand the reason for the unsuccessful
results, we found that backdoors cannot separate loss distributions of training
and non-training samples. In other words, backdoors cannot affect the
distribution of clean samples. Third, we also show that poison and triggered
samples activate neurons of different distributions. Specifically, backdoors
make any clean sample an inlier, contrary to poisoning samples. As a result, we
confirm that backdoors cannot assist membership inference.
