The meta-classifier outputs the probability that each data point is member of the dataset used to generate the synthetic data. Note: the RMIA attack requires the separate training of shadow models.