Neural network spectra predict privacy risks from membership inference attacks
Predicting Privacy Leakage from Weight Spectral Density
Machine LearningCryptography and SecurityNeural and Evolutionary Computing
Summary
Machine learning models can unintentionally reveal information about the data they were trained on, a problem measured by special attacks called membership inference attacks (MIAs). These attacks usually need a lot of extra work to test privacy risks. The authors found that by looking at certain patterns (called spectral metrics) in the model’s weights, they can estimate how vulnerable the model is to these privacy attacks without doing expensive tests. This new approach could help people check the privacy of many models more easily and quickly.
What this means in practice
- •For ml engineers: Assess privacy risks of classification models efficiently by analyzing weight spectral metrics instead of costly shadow models.
- •For data privacy teams: Perform large-scale privacy audits on deployed neural networks using spectral analysis to identify models more vulnerable to membership inference.
Authors
Richard J. Preen, Jim Smith
Abstract
Membership inference attacks (MIAs) are widely used to audit the privacy disclosure risk of machine learning models, however current state-of-the-art attacks require training computationally expensive shadow models, making large-scale privacy evaluation impractical. In this work, we investigate whether inexpensive spectral metrics derived from the heavy-tailed self-regularisation framework can serve as proxies for MIA vulnerability. We evaluate several WeightWatcher spectral metrics on image and tabular classification tasks and compare their relationship with MIA privacy leakage against conventional measures of generalisation. Across datasets, stable rank exhibits a strong positive correlation with overall MIA success, while Log alpha-Norm shows a consistent negative correlation with MIA vulnerability at the low false-positive regime. These associations are observed to be stronger than those obtained using the generalisation gap. The results indicate that neural network spectra may contain information about privacy leakage that is not fully captured by conventional measures of overfitting, motivating spectral analysis as a promising direction for scalable privacy auditing.