Batch Normalization (BN) is widely used to speed up and stabilize deep neural network training, yet its effect on privacy and memorization has been largely unexplored. This study shows that BN significantly increases the memorization of atypical or outlier samples, as evidenced by unintended memorization, per-sample influence, and heightened susceptibility to membership inference attacks across multiple datasets and architectures. A mechanistic analysis of the BN backward pass reveals that BN amplifies the per‑step margin growth of outlier samples during training, thereby intensifying their influence.
By Ngoc Phu Doan, Chongyan Gu, Ihsen Alouani
Adaptive Diffusion Freezing (ADF) is a new privacy‑preserving framework for diffusion models that protects against membership inference attacks (MIAs). It uses cross‑timestep adaptive freezing training, where a mask matrix controls which data subsets participate at each diffusion timestep, reducing over‑memorization and aligning model behavior for member and non‑member samples. A pretraining‑based risk‑aware freezing policy estimates MIA risk and suppresses high‑risk subset‑timestep pairs, achieving a superior privacy‑utility‑efficiency trade‑off across multiple datasets.
By Jialu Guo, Xiao Han, Junjie Wu
arXiv:2608.30141v1 Announce Type: cross
Abstract: Preference optimization is widely used to align large language models with human preferences, but preference-data composition may also influence priv...
By Dishu Yang, Jingjing Liu, Jize Li
arXiv:2310. 16152v5 Announce Type: replace-cross Abstract: Federated learning (FL) has become a key component in various language modeling applications such as machine translation, next-word prediction, and medical record analysis.
By Md Rafi Ur Rashid, Vishnu Asutosh Dasu, Kang Gu, Najrin Sultana, Shagufta Mehnaz
arXiv:2602. 02819v4 Announce Type: replace Abstract: Membership Inference Attacks (MIAs) aim to distinguish training points (members) from unseen data (non-members), and are widely used to quantify memorization and assess privacy risks.
By Mathieu Even, Cl\'ement Berenfeld, Linus Bleistein, Tudor Cebere, Julie Josse, Aur\'elien Bellet
arXiv:2606. 17464v1 Announce Type: new Abstract: Membership inference attacks (MIAs) are a canonical way to assess a machine learning model's privacy properties.
By Jeffrey G. Wang, Jason Wang, Marvin Li, Seth Neel
The paper introduces Word-level Probability MIA (WPMIA), a black-box membership inference attack that estimates word-level generation probabilities via Monte Carlo sampling and local kernel smoothing, then aggregates them into a sequence-level likelihood estimator. By conditioning on different prefixes, WPMIA amplifies distributional differences between member and non-member texts, outperforming existing black-box baselines on open-source LLMs and achieving an average TPR@5%FPR of 42.0 on proprietary models such as GPT‑5‑Chat, Gemini‑2.5‑Flash, and Claude‑4.5‑Haiku.
By Shengjie Niu, Yeheng Ge, Jian Huang
arXiv:2608. 02052v1 Announce Type: new Abstract: Human mobility prediction models, which forecast the next location in a user's trajectory, are increasingly deployed in urban analytics, navigation, and personalized services.
By Anne Josiane Kouam, Hristo Boyadzhiev, Konrad Rieck
Large Language Models (LLMs) raise growing concerns about privacy leakage and copyright compliance. Membership inference is a key tool for assessing such risks, but existing studies mainly focus on whether specific samples or sample-based data units are used for training.
arXiv:2410. 06814v2 Announce Type: replace Abstract: Over-parameterized models are typically vulnerable to membership inference attacks, which aim to determine whether a specific sample is included in the training of a given model.
By Hengxiang Zhang, Qiang Hu, Hongxin Wei
arXiv:2509. 25003v3 Announce Type: replace Abstract: Membership inference attacks (MIAs) against Diffusion Models (DMs) raise pressing privacy concerns by revealing whether a sample was part of the training set.
By Mingxing Rao, Bowen Qu, Daniel Moyer
The paper investigates a privacy‑hallucination tradeoff in differentially private (DP) language models. It shows that DP pre‑training or fine‑tuning increases hallucinations compared to non‑DP models, especially as the privacy budget becomes stricter. The authors attribute this to DP mechanisms flattening output distributions, and demonstrate that controlling the frequency of facts in training data can mitigate hallucination risks.
By Krithika Ramesh, Krishna Pillutla, Danish Pruthi, Anjalie Field