Résultats de recherche pour « Membership Inference »

Membership inference asks whether a candidate example participated in a model's training set and provides an important tool for empirical privacy auditing. Many strong attacks rely on statistics observed only at the final model checkpoint, potentially discarding information contained in how a candidate's behavior evolves during optimization. We introduce MA-LiRA, a checkpoint-aware membership-inference attack that exploits this training history. For each labeled candidate, MA-LiRA constructs a compact five-dimensional representation from its checkpoint-wise loss trajectory, capturing endpoint fit, overall learning progress, local trajectory irregularity, and temporally weighted changes. Each feature is calibrated using candidate-specific member and non-member shadow distributions, and the resulting likelihood-ratio coordinates are combined by a fusion model trained exclusively from shadow-derived pseudo-target examples, without using target membership labels for fitting or threshold selection. We evaluate MA-LiRA on CIFAR-10, CIFAR-100, and SVHN against a broad set of score-based, calibrated, likelihood-ratio, and trajectory-based membership-inference baselines. Across the evaluated datasets, MA-LiRA consistently improves overall membership discrimination and low-falsepositive-rate detection under the stated checkpoint-aware access model. These results indicate that training-history information can provide membership evidence beyond that available from a final-checkpoint statistic alone.

We study causal inference for spatial aggregates when treatment changes not only outcomes within places but also who belongs where. A valid experimental or quasi-experimental design may identify the treatment-specific distribution of spatial membership while leaving latent the joint counterfactual coupling that links each individual's location across regimes. This distinction matters for geographic scale: a move between fine locations inside the same coarse area is visible at the fine scale but disappears after coarsening. We represent all couplings consistent with the identified margins by a transportation polytope and derive sharp bounds for fine-level, cross-boundary, and within-block reallocation. Although fine reallocation decomposes into cross-boundary and within-block movement for any fixed coupling, the separately optimized sharp endpoints need not decompose; we derive a closed-form lower bound for the within-block component. The endpoint map is piecewise linear and can be non-smooth at equal-margin and multiple-optimum configurations, so we establish directional differentiability and feasible multiplier inference based on estimated directional derivatives. Monte Carlo experiments show that ordinary bootstrap inference works in regular interiors but can severely under-cover at nonregular boundaries, whereas the directional procedure maintains high coverage. In the randomized seasonal-migration experiment of Bryan et al. (2014), the complete-case destination margins under incentive assignment imply a fine-destination reallocation identified set of [0.222, 0.933], showing that experimentally generated spatial margins can remain sharply informative without identifying household-level cross-regime matching. In a separate randomized destination assignment, the Bogra-Tangail contrast has a fine lower bound of 0.274 and a coarse migrate/stay lower bound of 0.019, an attenuation of 0.255; its simultaneous directional interval is [0.133, 0.377], and the observed contrast is also extreme under the strictest restricted familywise randomization reference used in the analysis.

Membership inference asks whether a candidate example participated in a model's training set and provides an important tool for empirical privacy auditing. Many strong attacks rely on statistics observed only at the final model checkpoint, potentially discarding information contained in how a candidate's behavior evolves during optimization. We introduce MA-LiRA, a checkpoint-aware membership-inference attack that exploits this training history. For each labeled candidate, MA-LiRA constructs a compact five-dimensional representation from its checkpoint-wise loss trajectory, capturing endpoint fit, overall learning progress, local trajectory irregularity, and temporally weighted changes. Each feature is calibrated using candidate-specific member and non-member shadow distributions, and the resulting likelihood-ratio coordinates are combined by a fusion model trained exclusively from shadow-derived pseudo-target examples, without using target membership labels for fitting or threshold selection. We evaluate MA-LiRA on CIFAR-10, CIFAR-100, and SVHN against a broad set of score-based, calibrated, likelihood-ratio, and trajectory-based membership-inference baselines. Across the evaluated datasets, MA-LiRA consistently improves overall membership discrimination and low-falsepositive-rate detection under the stated checkpoint-aware access model. These results indicate that training-history information can provide membership evidence beyond that available from a final-checkpoint statistic alone.

Generative artificial intelligence has transformed the generation of synthetic data, providing innovative solutions to challenges like data scarcity and privacy, which are particularly critical in fields such as medicine. However, the effective use of this synthetic data to train high-performance models remains a significant challenge. This paper addresses this issue by introducing Knowledge Recycling (KR), a pipeline designed to optimise the generation and use of synthetic data for training downstream classifiers. At the heart of this pipeline is Generative Knowledge Distillation, the proposed technique that significantly improves the quality and usefulness of the information provided to classifiers through a synthetic dataset regeneration and soft labelling mechanism. The KR pipeline has been tested on a variety of datasets, with a focus on six highly heterogeneous medical image datasets, ranging from retinal images to organ scans. The results show a significant reduction in the performance gap between models trained on real and synthetic data, with models based on synthetic data outperforming those trained on real data in some cases. Furthermore, the resulting models show almost complete immunity to Membership Inference Attacks, manifesting privacy properties missing in models trained with conventional techniques.

Machine learning models face increasing threats from membership inference attacks, which aim to infer sample membership. Sample membership represents whether or not a particular data sample is included in the training set of a given model and is considered a fundamental form of privacy leakage. Recent research has focused on the likelihood ratio attack, a membership inference attack that aggregates membership-relevant features through difficulty calibration and infers sample membership through hypothesis testing. However, difficulty calibration approaches typically require large amounts of labeled data to train shadow models, limiting their general applicability. Moreover, hypothesis testing often fails to identify training samples with low self-influence, resulting in suboptimal attack performance. To address these shortcomings, we propose Distilled Shadow Model and Inference Model to perform Membership Inference Attack (DSMIM-MIA) a novel membership inference attack that reduces the reliance on ground-truth labels through knowledge distillation and mitigates the bias against low self-influence samples using an inference model. Specifically, we distill the target model to train shadow models, which not only remove the dependence on labeled data but also transfer potential membership-relevant information to improve feature aggregation. In place of hypothesis testing, we train a neural network, referred to as the inference model, to predict sample membership. By learning membership decision functions directly from data, without relying on predefined statistical assumptions, our method achieves more accurate and generalizable predictions, especially for samples with low self-influence. Extensive experiments across three datasets and four model architectures demonstrate that DSMIM-MIA consistently outperforms existing state-of-the-art attacks under various evaluation metrics.

The widespread adoption of open-source large language models (LLMs) for domain-specific fine-tuning on sensitive corpora introduces a class of privacy vulnerabilities that remain inadequately characterised in the existing literature. This paper presents a multi-model empirical audit of five open-source LLMs, namely llama3.2:3b, phi4-mini, qwen3 (8.2B), ministral-3:3b, and deepseek-r1:1.5b, using a greedy-match proxy membership inference attack (MIA) and a verbatim extraction probe methodology. All five evaluated models exhibit statistically significant membership leakage above the random baseline (AUC-ROC > 0.75, p < 0.05 under one-sided Mann-Whitney U testing). Two models achieve a perfect AUC-ROC of 1.0000, with score gaps of 0.167 to 0.210 between member and non-member distributions. Verbatim extraction rates range from 8.3 per cent to 66.7 per cent, with llama3.2:3b reproducing eight of twelve wellknown training sequences from prefix alone. A novel finding is that chain-of-thought reasoning architectures suppress verbatim extraction rates whilst leaving membership inference advantage statistically intact, a distinction with direct implications for deployments relying upon RLHF-trained models. Formal proof sketches are provided for the Yeom generalisation-gap bound and the differential privacy upper bound on MIA advantage, and stateof-the-art mitigation strategies are examined. The empirical results constitute a conservative lower bound on the leakage achievable against models fine-tuned on higher-density proprietary corpora.  <div> Impact Statement-Large language models are increasingly fine-tuned on sensitive data in healthcare, legal, and financial settings where data privacy is both a legal obligation and an ethical imperative. This paper demonstrates, through direct empirical testing of five widely deployed open-source models, that such models systematically expose training data through two distinct mechanisms: statistical membership inference and verbatim text reproduction. Two models reproduce training sequences verbatim at rates exceeding 50 per cent. A finding of particular practical significance is that chain-of-thought reasoning, a property of RLHF-trained models, suppresses surface-level text reproduction whilst leaving membership leakage statistically intact. Organisations deploying fine-tuned open-source models on proprietary or regulated data should not regard current RLHF or instruction-tuning practices as privacy safeguards. The audit toolkit produced in this work is openly available to support responsible deployment practice. </div>

The widespread adoption o open-source Large Language Models (LLMs) for domain-specific fine-tuning on sensitive corpora introduces a class of privacy vulnerabilities that remain inadequately characterised in the existing literature. This paper presents a multi-model empirical audit of five open-source LLMs, namely llama3.2:3b, phi4-mini, qwen3(8.2B), ministral-3:3b, and deepseek-r1:1.5b, using a greedy-match proxy membership leakage above the random baseline (AUC-ROC > 0.75, p < 0.05 under one-sided Mann-Whitney U testing). Two models achieve a perfect AUC-ROC of 1.0000, with score gaps of 0.167 to 0.210 between member and non-member distributions. Verbatim extraction rates range from 8.3 per cent to 66.7 per cent, with llama3.2:3b reproducing eight of twelve well-known training sequences from prefix alone. A novel finding is that chain-of-thought reasoning architectures suppress verbatim extraction rates whilst leaving membership inference advantage statistically intact, a distinction with direct implications for deployments relying upon RLHF-trained models. Established theoretical bounds from the differential privacy and membership inference literature are applied as interpretive frameworks for the empirical findings, and state-of-the-art mitigation strategies are examined. The empirical results constitute a conservative lower bound on the leakage achievable against models fine-tuned on higher-density proprietary corpora.