无需重训练的逐样本成员推断脆弱性评估
Assessing Per-Sample Membership Inference Vulnerability without Retraining
AI总结：
提出一种基于数据依赖几何度量的逐样本成员推断脆弱性评分方法，仅需单个训练模型即可高效识别高风险样本。
摘要：
近期隐私文献表明，针对样本的成员推断攻击（MIA）显著优于非针对性方法。受此启发，我们探讨以下问题：能否在不训练影子模型的情况下评估单个训练点的隐私脆弱性？我们表明，逐样本对MIA的暴露程度不仅受其损失影响，还受数据依赖的几何度量控制。在线性设置中，我们推导出个体黑盒MIA脆弱性的闭式分解，将其分解为总体杠杆得分和残差损失项，明确了样本依赖的几何结构如何转化为隐私暴露。由于大多数现代架构的最后一层是线性的，我们将此框架扩展到深度网络，并提出一种基于最后一层表示的替代评分，仅需单个训练模型且无需影子模型。跨不同数据集和架构的实验表明，我们的评分在识别最先进攻击下的最高风险点时优于损失和梯度范数基线，为逐样本隐私风险评估提供了计算高效且理论基础的工。
英文摘要：
Recent work in the privacy literature shows that sample-targeted membership inference attacks (MIAs) significantly outperform untargeted approaches by a wide margin. Motivated by this observation, we address the following question: can the privacy vulnerability of individual training points be assessed without training shadow models? We show that per-sample exposure to MIA is governed not only by a point's loss, but also by a data-dependent geometric measure. In the linear setting, we derive a closed-form decomposition of individual black-box MIA vulnerability into a population leverage score and a residual loss term, making explicit how sample-dependent geometry translates into privacy exposure. Since the final layer of most modern architectures is linear, we extend this framework to deep networks and propose a surrogate score operating on last-layer representations that requires only a single trained model and no shadow models. Empirical evaluations across diverse datasets and architectures show that our score outperforms loss and gradient-norm baselines at identifying the highest-risk points under state-of-the-art attacks, providing a computationally efficient and theoretically grounded tool for per-sample privacy risk assessment.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
