Differentially private mechanisms restrict the membership inference capabilities of powerful (optimal) adversaries against machine learning models. Such adversaries are rarely encountered in practice. In this work, we examine a common threat model relaxation, where (sub-optimal) adversaries lack access to the exact model training database, but may possess related or partial data. We then derive a full formal characterisation of adversarial membership inference capabilities in this setting in ter…