Algorithm 2

Likelihood Ratio Attack (LiRA) tests whether a specific target data point m - in our case, a molecular structure x with the corresponding label y - was part of the training data for a target neural network model \(f_{\theta }\). In this attack, shadow models \(s_i, \; i = 1, \dots , N\) are trained on data drawn from a distribution similar to that of \(f_{\theta }\)’s training data (in our case, a similar chemical space). Some shadow models include m in their training data, while others do not. The re-scaled confidence of each shadow model when predicting m is then calculated. These confidences are modeled as two Gaussian distributions: one for the shadow models that included m, and one for those that did not. Finally, we determine whether the confidence of the target model \(f_{\theta }\) is more likely to belong to the distribution of models that included m or the distribution of models that did not. The likelihood ratio between these distributions, combined with a decision threshold t, determines whether m is predicted to have been part of \(f_{\theta }\)’s training data.