The paper investigates whether inexpensive spectral metrics from the heavy‑tailed self‑regularisation framework can predict membership inference attack (MIA) vulnerability, offering a scalable alternative to costly shadow‑model attacks. Experiments on image and tabular classification tasks show that stable rank correlates positively with overall MIA success, while Log alpha‑Norm correlates negatively with MIA risk in low false‑positive regimes, outperforming conventional generalisation gap measures. These findings suggest that neural network spectra contain privacy leakage signals not captured by traditional overfitting metrics, pointing to spectral analysis as a promising direction for privacy auditing.
arXiv:2410. 06814v2 Announce Type: replace Abstract: Over-parameterized models are typically vulnerable to membership inference attacks, which aim to determine whether a specific sample is included in the training of a given model.
Batch Normalization (BN) is widely used to speed up and stabilize deep neural network training, yet its effect on privacy and memorization has been largely unexplored. This study shows that BN significantly increases the memorization of atypical or outlier samples, as evidenced by unintended memorization, per-sample influence, and heightened susceptibility to membership inference attacks across multiple datasets and architectures. A mechanistic analysis of the BN backward pass reveals that BN amplifies the per‑step margin growth of outlier samples during training, thereby intensifying their influence.
arXiv:2608.28934v1 Announce Type: new Abstract: Differential privacy (DP) has traditionally been used to provide theoretical upper bounds on an algorithm's stability to changing its training data. In...
arXiv:2607. 16620v1 Announce Type: cross Abstract: Differential privacy (DP) is increasingly deployed to limit membership inference risk in machine-learning systems.
arXiv:2605. 27292v2 Announce Type: replace Abstract: Privacy auditing aims to empirically assess privacy leakage in machine learning models using membership inference attacks (MIAs), and to derive lower bounds on differential privacy (DP) parameters.
arXiv:2503. 10945v3 Announce Type: replace-cross Abstract: Current practices for reporting differential privacy (DP) guarantees for machine learning (ML) algorithms such as DP-SGD provide an incomplete and potentially misleading picture.
arXiv:2608. 13773v1 Announce Type: cross Abstract: Neural networks are increasingly deployed in high-stakes applications with growing privacy leakage concerns.
arXiv:2606. 12733v2 Announce Type: replace Abstract: Privacy auditing provides an important safeguard by estimating the actual information leaked by a model, thus ensuring that theoretical privacy guarantees hold in practice.
The paper introduces a shift‑aware score transport method for privacy auditing that does not require retraining the target model. It estimates the in‑distribution non‑member score distribution from out‑of‑distribution data, transports this relationship to the target covariate distribution, and applies a conservative correction to account for potential extrapolation errors. Experiments on multiple datasets with distribution shifts show that the method provides more stable privacy estimates while maintaining tighter lower bounds than existing baselines.
arXiv:2511. 20710v2 Announce Type: replace-cross Abstract: In the age of agentic AI, the growing deployment of multi-modal models (MMs) has introduced new attack vectors that can leak sensitive training data in MMs, causing privacy leakage.
The paper addresses a flaw in differential privacy audits where selection bias in Membership Inference Attacks leads to overestimated lower bounds on privacy leakage. By applying statistical correction methods, the authors demonstrate that uncorrected audits can violate theoretical privacy guarantees up to four times more often than claimed, while corrected audits maintain valid bounds at the nominal confidence level.
The paper introduces IBIS, a framework for designing canaries that are efficient for one‑run privacy auditing. IBIS optimizes each canary’s membership inference attack score while minimizing interference among canaries by encouraging orthogonality in embedding space. The method uses influence‑based greedy initialization and a bilevel optimization algorithm that updates a single model incrementally, achieving better performance‑cost trade‑offs and reducing computational cost by up to two orders of magnitude compared to existing approaches.