Membership Inference Attacks Beyond Overfitting