Research map / Adversarial robustness and security / Attacks on text and graphs
On the Ability of Developers' Training Data Preservation of Learnware
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proves theoretically, via geometric analysis on manifolds, that RKME learnware specifications with a sufficiently small number of synthetic points almost surely contain none of the developer's original data and resist linkage and inference attacks without added noise.
Problem
Whether the RKME specification used in learnware systems preserves developers' original training data, given that it is produced by a deterministic, non-convex optimization with no closed form, so differential privacy tools do not apply.
Approach
Models the set of original datasets that could yield a given RKME as a manifold and uses geometric analysis (dimension counting, curvature, isoperimetric-type bounds) to bound the probability that synthetic points coincide with or closely approximate original samples, and bounds linkage and inference risks under brute-force attacks, showing a range of specification sizes m that balances privacy an
Key results
- Theorem 3.4: for continuous distributions and RKME size m < n/2, the consistency risk RC(P) equals 0.
- Theorem 3.5: consistency risk bounded by O((1/e)^(n-2m)), and Corollary 3.6 gives RC(P) < 0.001 for m <= k*sqrt(n) with k >= d.
- Theorems 4.2 and 4.4 bound linkage and inference risks under brute-force attack, and Corollary 4.5 gives risk reduction of at least 0.999 for m <= n/2.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Reduce the number of synthetic points m | Gaussian-kernel RKME · Continuous data distribution | consistency risk: RC(P) < O ((1/e)^(n−2m)) | Helped |
| Reduce the number of synthetic points m | Gaussian-kernel RKME · Linkage privacy game | linkage risk: RL (Z) < O ((2dm)!/(dn − 2dm)!) | Helped |
| Reduce the number of synthetic points m | Gaussian-kernel RKME · Inference privacy game | inference risk: RI(Z) < O ((2m)!/(e(n − 2m − 1)(n − 1)!)) | Helped |
| Increase the number of synthetic points m | Gaussian-kernel RKME · Learnware identification | KME approximation error: ∥˜µ − µ∥H ≤ 2√(2/m) + 2√(1/n) + √(2 log(1/δ)/n) | Helped |
| Replace the Gaussian kernel with the Laplacian kernel (ablation) | RKME · Original-data consistency | consistency risk | Hurt |
| Set specification size to m ≤ k√n, where k ≥ d | Gaussian-kernel RKME · Continuous data distribution | consistency risk: RC(P) < 0.001 | Helped |
| Set specification size to m ≤ n/2 | Gaussian-kernel RKME · Linkage privacy game | reduction in linkage risk: RL(D) − RL(Z) ≥ 0.999 | Helped |
| Set specification size to m ≤ n/2 | Gaussian-kernel RKME · Inference privacy game | reduction in inference risk: RI(D) − RI(Z) ≥ 0.999 | Helped |
Surprising findings
- With the Laplacian kernel instead of the Gaussian kernel, the RKME would provably contain data identical to the original samples.
Limitations
- Upper bounds may be loose due to multiple restrictions and relaxations in the analysis.
- Proofs are given only for the Gaussian kernel; extension to other kernels is discussed but not proven.
- Attack analysis assumes a brute-force adversary with prior knowledge of the data distribution; no empirical attack experiments are reported.
Experimental setup
Metrics: consistency risk linkage risk inference risk
Builds on: reduced kernel mean embedding (RKME) kernel mean embedding membership inference privacy game differential privacy
Closest papers by meaning
- Learnware Specification via Label-Aware Neural Embedding (AAAI 2025 · similarity 0.89)
- Learnware Specification via Dual Alignment (ICML 2025 · similarity 0.84)
- Towards Making Learnware Specification and Market Evolvable (AAAI 2024 · similarity 0.82)
- Handling Learnwares from Heterogeneous Feature Spaces with Explicit Label Exploitation (NeurIPS 2024 · similarity 0.82)
- REEF: Representation Encoding Fingerprints for Large Language Models (ICLR 2025 · similarity 0.82)
- Data-Driven Discovery of Design Specifications (Student Abstract) (AAAI 2024 · similarity 0.81)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.