Predicting Privacy Leakage from Weight Spectral Density

2026-09-10

AI Summary

研究使用权重谱密度指标作为代理来预测机器学习模型的隐私泄露风险，以替代计算成本高昂的阴影模型方法，提高大规模隐私评估的可行性。

Abstract

Membership inference attacks (MIAs) are widely used to audit the privacy disclosure risk of machine learning models, however current state-of-the-art attacks require training computationally expensive shadow models, making large-scale privacy evaluation impractical. In this work, we investigate whether inexpensive spectral metrics derived from the heavy-tailed self-regularisation framework can serve as proxies for MIA vulnerability. We evaluate several WeightWatcher spectral metrics on image and tabular classification tasks and compare their relationship with MIA privacy leakage against conventional measures of generalisation. Across datasets, stable rank exhibits a strong positive correlation with overall MIA success, while Log alpha-Norm shows a consistent negative correlation with MIA vulnerability at the low false-positive regime. These associations are observed to be stronger than those obtained using the generalisation gap. The results indicate that neural network spectra may contain information about privacy leakage that is not fully captured by conventional measures of overfitting, motivating spectral analysis as a promising direction for scalable privacy auditing.

Problem

• Membership Inference Attacks
• Privacy Leakage
• Spectral Metrics
• Shadow Models

Innovation

• Spectral Metrics
• Membership Inference Attacks
• Privacy Leakage
• Stable Rank
• Log Alpha-Norm