An evaluation program comprising instructions which, when the evaluation program is executed by a computer, cause the computer to execute processing, the processing comprising: acquiring, for each of a plurality of machine learning models, an attack result of a membership inference attack performed on the each of plurality of machine learning models, the acquiring of the attack result for a respective machine learning model being performed by using the respective machine learning model and a plurality of pieces of data to be attacked by the membership inference attack, each of the plurality of machine learning models being a machine learning model trained by using synthetic data that simulates training data, an amount of the synthetic data used for each of the plurality of machine learning models being different from each other; specifying, based on the acquired attack result for each of the plurality of machine learning models, specific data from among the plurality of pieces of data by specifying data with a different attack result of the attack results from among the plurality of pieces of data as the specific data; performing the membership inference attack by using the specific data for a target machine learning model, the target machine learning model being a machine learning model for which an amount of the synthetic data is between amounts of the synthetic data used for training of any two machine learning models of the plurality of learning models; and evaluating, based on an attack result for the specific data and the attack result acquired for each of the plurality of machine learning models, a resistance to the membership inference attack for the target machine learning model. acquiring, for each of a plurality of machine learning models, an attack result of a membership inference attack performed on the each of plurality of machine learning models, the acquiring of the attack result for a respective machine learning model being performed by using the respective machine learning model and a plurality of pieces of data to be attacked by the membership inference attack, each of the plurality of machine learning models being a machine learning model trained by using synthetic data that simulates training data, an amount of the synthetic data used for each of the plurality of machine learning models being different from each other; specifying, based on the acquired attack result for each of the plurality of machine learning models, specific data from among the plurality of pieces of data by specifying data with a different attack result of the attack results from among the plurality of pieces of data as the specific data; performing the membership inference attack by using the specific data for a target machine learning model, the target machine learning model being a machine learning model for which an amount of the synthetic data is between amounts of the synthetic data used for training of any two machine learning models of the plurality of learning models; and evaluating, based on an attack result for the specific data and the attack result acquired for each of the plurality of machine learning models, a resistance to the membership inference attack for the target machine learning model.