arXiv Machine Learning
Jun 15
Private Prediction via PAC Privacy
arXiv:2601. 14033v2 Announce Type: replace Abstract: Machine learning models are increasingly served behind APIs.
PAC-Private Autoregressive Generation: Calibrating Noise to Ensemble Disagreement
The paper introduces PAC‑Private Autoregressive Generation, a method that calibrates noise based on ensemble disagreement across overlapping ‘worlds’ of a private corpus, thereby extending PAC privacy from classification to text generation. By training adapters on a frozen public model and using posterior‑weighted disagreement to add noise only when predictions vary, the approach achieves strong privacy guarantees while preserving most of the fine‑tuning benefit. Experiments on WikiText‑103 with GPT‑2‑small show 74 % of the fine‑tuning gain retained with a per‑token budget of 2⁻³², and membership‑inference success bounded to 51.08 % after one million tokens, outperforming PMixED under matched conditions.
Related stories
arXiv Machine Learning
Aug 28
Privacy Without Regret: Differentially Private Inference-Time Alignment
The paper introduces Private Best-of-N (PrivBoN), a method that adds calibrated Gumbel noise to reward scores during inference-time alignment, achieving both ε-differential privacy and KL-regularized alignment. When the privacy budget exceeds a critical threshold ε*, the noise becomes regret-optimal, matching the theoretical alignment skyline. The authors also propose Private Inference-Time Pessimism (PrivITP), which uses χ^2-regularized rejection sampling and a two-phase Gaussian mechanism to provide ex-post (ε,δ)-DP with a privacy cost independent of the number of responses, and demonstrate that both methods outperform standard Best-of-N across multiple models and datasets.
arXiv AI
Jun 11
Robust Privacy: Inference-Stage Privacy through Certified Robustness
arXiv:2601. 17360v2 Announce Type: replace-cross Abstract: An adversary observing a model's released prediction can infer sensitive attributes of the queried input, or even reconstruct representatives of the model's training data.
arXiv Machine Learning
Aug 20
Topology-Aware Differential Privacy in Hierarchical Federated Learning
The paper introduces Fulcrum, a topology‑aware differential privacy scheme for hierarchical federated learning that allocates noise based on the size and exposure of regional aggregation groups. By deriving a closed‑form exposure dispersion metric from region structure and weights, the method optimally balances privacy and utility, achieving up to 14.84% accuracy gains on image tasks and 12.16% on text tasks at ε = 0.99 compared to uniform noise allocation. The approach ensures each participant receives noise commensurate with its actual exposure, eliminating unnecessary privacy overhead.
arXiv Machine Learning
Aug 11
Fundamental Limitations of Favorable Privacy-Utility Guarantees for DP-SGD
arXiv:2601. 10237v3 Announce Type: replace Abstract: Differentially Private Stochastic Gradient Descent (DP-SGD) is the dominant paradigm for private training, but its fundamental limitations under worst-case adversarial privacy definitions remain poorly understood.
arXiv AI
Jun 10
Advancing the State-of-the-Art in Empirical Privacy Auditing
arXiv:2606. 10481v1 Announce Type: cross Abstract: Parameter-efficient fine-tuning of large language models (LLMs) can exhibit problematic memorization of individual training examples.
arXiv Machine Learning
Jun 2
Canonicalized Stable-List Replay for Private Federated Continual Learning over Language-Model Embeddings
arXiv:2606. 00426v1 Announce Type: new Abstract: Federated continual learning (FCL) lets distributed clients adapt language-model heads to evolving NLP tasks without sharing raw text.
arXiv Machine Learning
Aug 31
Memorization Is Not Extraction: Tight Differential-Privacy Bounds and Audit Blind Spots
arXiv:2608.27782v1 Announce Type: cross Abstract: Memorization in large language models is measured through a zoo of definitions whose formal relations are unknown, and differential privacy (DP) is t...
arXiv Machine Learning
Jun 2
IntraShuffler: A Privacy Preserving Framework for Heterogeneous DP Federated Learning
arXiv:2606. 02563v1 Announce Type: new Abstract: Heterogeneous Differential Privacy (HDP) in Federated Learning (FL) allows clients to select individual privacy budgets ($\varepsilon_i$) according to institutional policies and data sensitivity.
arXiv AI
Jun 2
Fair Finetuning Mitigates Distribution Inference Attacks
arXiv:2606. 01719v1 Announce Type: cross Abstract: Machine learning models trained on sensitive data can inadvertently leak population-level information about their training distributions -- a threat known as distribution inference attack (DIA).
arXiv Machine Learning
Jun 3
Unlearning with Asymmetric Sources: Improved Unlearning-Utility Trade-off with Public Data
arXiv:2605. 11170v2 Announce Type: replace Abstract: Noise-based certified machine unlearning currently faces a hard ceiling: the noise magnitude required to certify unlearning typically destroys model utility, particularly for large-scale deletion requests.
arXiv Machine Learning
Aug 4
Leak It: A Probabilistic Approach to Training-Data Extraction from Black-Box Language Models
arXiv:2608. 00144v1 Announce Type: new Abstract: Membership inference (MIA) on language models is usually summarised by an aggregate ROC-AUC, but such evaluations are confounded: model-free blind baselines separate members from non-members from surface text alone.