Research map / Federated learning and privacy / Privacy attacks and secure learning
Impact of Dataset Properties on Membership Inference Vulnerability of Deep Transfer Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Derives and empirically verifies a power law relating membership inference vulnerability (TPR minus FPR for LiRA/RMIA) of fine-tuned ViT and ResNet models to the number of examples per class, and extrapolates the dataset sizes needed for DP-comparable protection.
Problem
How dataset properties (examples per class S and number of classes C) affect membership inference vulnerability of non-DP fine-tuned neural networks, especially at low FPR and for the most vulnerable individual points, and how this relates to DP guarantees.
Approach
A simplified high-dimensional Gaussian model of fine-tuning (class means on a unit sphere, inner-product classifier) where LiRA is optimal yields a closed-form power law log(TPR-FPR) = -0.5 log S + const; this is validated empirically on VTAB few-shot tasks with ViT-B and ResNet-50 heads/FiLM and extrapolated to DP-matching dataset sizes.
Key results
- Regression on ViT-B (Head) LiRA data gives R^2=0.930 at FPR=0.001, with fitted beta_S around -0.5 for larger FPR, matching the theoretical 0.5 exponent.
- Per-example quantiles decay with slope near -0.5 (e.g., -0.5603, -0.5688, -0.4796), while the maximum decays more slowly (-0.2695).
- Extrapolation suggests ~160 shots per class at FPR=0.1 (average case, eps=1) and ~19,000 at FPR=0.001 to match DP bounds with delta=1e-5.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Increase examples per class (shots) | Fine-tuned ViT-B Head attacked with LiRA · Image-classification datasets | TPR at fixed FPR | Helped |
| Increase number of classes | Fine-tuned ViT-B Head attacked with LiRA · Image-classification datasets at S=32 | TPR at fixed FPR | Hurt |
| Use RMIA instead of LiRA | Fine-tuned ViT-B Head · Vulnerability across shots at FPR=0.1 | TPR−FPR | Mixed |
| Increase shots per class | Individual samples in Patch Camelyon · Individual vulnerability quantiles | β_S: -0.5603, -0.5688 and -0.4796 | Helped |
| Increase shots per class | Most vulnerable individual sample in Patch Camelyon · Maximum individual vulnerability | β_S: -0.2695; with S≥32768, -0.3478 | Helped |
| Predict log(TPR−FPR) rather than log(TPR) (ablation) | Dataset-property regression model · Empirical vulnerability prediction | prediction quality | Helped |
| Transfer the fitted regression model from ViT-B Head to R-50 Head | Dataset-property regression model · R-50 Head test data | test R²: test R^2=0.790 | Helped |
| Train target models from scratch rather than fine-tuning | Image-classification target models · From-scratch training | TPR | Hurt |
| Increase shots per class | Simplified membership-inference model · Per-example and average-case LiRA | TPR−FPR: -0.5 | Helped |
Surprising findings
- The maximum individual vulnerability decays much more slowly than quantiles, so the most vulnerable points need very large datasets for protection.
- From-scratch trained models appear more vulnerable than the fitted fine-tuning power law predicts.
Limitations
- Theory relies on a simplified Gaussian model with well-behaved distributions and infinitely many shadow models; the power law may not hold for large networks trained from scratch.
- Evaluation assumes only the target point is known to the adversary; stronger settings may invalidate the power law.
- Extrapolated sample sizes depend on regression fits and translation between TPR/FPR and (epsilon, delta)-DP bounds, and are not formal guarantees.
Experimental setup
Datasets: VTAB Patch Camelyon EuroSAT CIFAR100 ImageNet-21k
Benchmarks: VTAB few-shot subset
Metrics: TPR at fixed FPR TPR minus FPR R^2 of regression
Baselines: LiRA RMIA
Builds on: LiRA RMIA Clopper-Pearson intervals Optuna
Closest papers by meaning
- Assessing Per-Sample Membership Inference Vulnerability without Retraining (NeurIPS 2026 · similarity 0.89)
- Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models (ICML 2025 · similarity 0.88)
- Estimating Model-Level Membership Inference Vulnerability Without Reference Models (NeurIPS 2026 · similarity 0.88)
- Causal Evaluation of Membership Inference Attacks (NeurIPS 2026 · similarity 0.88)
- Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibration (NeurIPS 2024 · similarity 0.87)
- DF-MIA: A Distribution-Free Membership Inference Attack on Fine-Tuned Large Language Models (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.