  Membership Inference (MI) poses a substantial privacy threat to the training
data of Automatic Speech Recognition (ASR) systems, while also offering an
opportunity to audit these models with regard to user data. This paper explores
the effectiveness of loss-based features in combination with Gaussian and
adversarial perturbations to perform MI in ASR models. To the best of our
knowledge, this approach has not yet been investigated. We compare our proposed
features with commonly used error-based features and find that the proposed
features greatly enhance performance for sample-level MI. For speaker-level MI,
these features improve results, though by a smaller margin, as error-based
features already obtained a high performance for this task. Our findings
emphasise the importance of considering different feature sets and levels of
access to target models for effective MI in ASR systems, providing valuable
insights for auditing such models.
