Set-Membership Inference Attacks using Data Watermarking