无需重训练即可评估单样本成员推理脆弱性

View PDF

Abstract:Recent work in the privacy literature shows that sample-targeted membership inference attacks (MIAs) significantly outperform untargeted approaches by a wide margin. Motivated by this observation, we address the following question: can the privacy vulnerability of individual training points be assessed without training shadow models? We show that per-sample exposure to MIA is governed not only by a point's loss, but also by a data-dependent geometric measure. In the linear setting, we derive a closed-form decomposition of individual black-box MIA vulnerability into a population leverage score and a residual loss term, making explicit how sample-dependent geometry translates into privacy exposure. Since the final layer of most modern architectures is linear, we extend this framework to deep networks and propose a surrogate score operating on last-layer representations that requires only a single trained model and no shadow models. Empirical evaluations across diverse datasets and architectures show that our score outperforms loss and gradient-norm baselines at identifying the highest-risk points under state-of-the-art attacks, providing a computationally efficient and theoretically grounded tool for per-sample privacy risk assessment.

Subjects:	Machine Learning (stat.ML); Artificial Intelligence (cs.AI); Machine Learning (cs.LG)
Cite as:	arXiv:2602.15919 [stat.ML]
	(or arXiv:2602.15919v3 [stat.ML] for this version)
	https://doi.org/10.48550/arXiv.2602.15919 arXiv-issued DOI via DataCite
Journal reference:	40th Conference on Neural Information Processing Systems (NeurIPS 2026), Dec 2026, Paris, France

Submission history

From: Valentin DORSEUIL [view email] [via CCSD proxy]
[v1] Tue, 17 Feb 2026 07:07:31 UTC (1,151 KB)
[v2] Tue, 26 May 2026 13:43:17 UTC (4,127 KB)
[v3] Thu, 12 Nov 2026 16:49:45 UTC (3,896 KB)