arXiv cs.AI· Valentin Dorseuil (DI-ENS), Jamal Atif (CMAP), Olivier Capp{\'e} (DI-ENS)·· 3 小时前AI 评分47
无需重训即可评估单样本成员推理攻击脆弱性
Assessing Per-Sample Membership Inference Vulnerability without Retraining
AI 导读
一项 NeurIPS 2026 研究提出无需训练 shadow 模型就能评估单个训练点对成员推理攻击（MIA）的脆弱性。研究证明单样本 MIA 暴露程度由损失值和数据相关的几何度量共同决定，在线性设定下推导出包含 population leverage score 和残差损失项的闭式分解；由于多数现代架构最后一层是线性的，该方法只需单个已训练模型、基于最后一层表征计算替代分数。
正文 · 原文
Abstract:Recent work in the privacy literature shows that sample-targeted membership inference attacks (MIAs) significantly outperform untargeted approaches by a wide margin. Motivated by this observation, we address the following question: can the privacy vulnerability of individual training points be assessed without training shadow models? We show that per-sample exposure to MIA is governed not only by a point's loss, but also by a data-dependent geometric measure. In the linear setting, we derive a closed-form decomposition of individual black-box MIA vulnerability into a population leverage score and a residual loss term, making explicit how sample-dependent geometry translates into privacy exposure. Since the final layer of most modern architectures is linear, we extend this framework to deep networks and propose a surrogate score operating on last-layer representations that requires only a single trained model and no shadow models. Empirical evaluations across diverse datasets and architectures show that our score outperforms loss and gradient-norm baselines at identifying the highest-risk points under state-of-the-art attacks, providing a computationally efficient and theoretically grounded tool for per-sample privacy risk assessment.
| Subjects: | Machine Learning (stat.ML); Artificial Intelligence (cs.AI); Machine Learning (cs.LG) |
| Cite as: | arXiv:2602.15919 [stat.ML] |
| (or arXiv:2602.15919v3 [stat.ML] for this version) | |
| https://doi.org/10.48550/arXiv.2602.15919 arXiv-issued DOI via DataCite |
|
| Journal reference: | 40th Conference on Neural Information Processing Systems (NeurIPS 2026), Dec 2026, Paris, France |
Submission history
From: Valentin DORSEUIL [view email] [via CCSD proxy]
[v1]
Tue, 17 Feb 2026 07:07:31 UTC (1,151 KB)
[v2]
Tue, 26 May 2026 13:43:17 UTC (4,127 KB)
[v3]
Thu, 12 Nov 2026 16:49:45 UTC (3,896 KB)
来源：arXiv cs.AI · arxiv.org