Membership inference attacks detect data used to train machine learning models