Research map / Adversarial robustness and security / Attacks on text and graphs

Assessing Per-Sample Membership Inference Vulnerability without Retraining

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: Membership inference and inversion · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a retraining-free per-sample membership inference vulnerability score based on leverage and influence/Newton-step approximations, restricted to the last layer, validated against LiRA rankings.

Problem

Assessing which individual training points are most vulnerable to membership inference without training the many shadow models that state-of-the-art per-sample attacks like LiRA require.

Approach

Closed-form decomposition of the leave-one-out loss gap in Gaussian linear regression into a population leverage score and a structural error; extended to deep networks via influence-function and Newton-step estimators restricted to the last layer, giving leverage-based scores computed from a single trained model.

Key results

• Across eight dataset/architecture settings, the Newton-step and influence surrogates recover LiRA's top-1% most vulnerable points, e.g. 62.8% recall on CIFAR-10 CNN vs 53.7% for loss and 36.8% vs 23.5% on CIFAR-100 ResNet-20.
• Surrogates beat the loss baseline on seven of eight settings; the exception is the BERT linear probe (loss 10.7% vs NS 8.2%).
• Scoring is reported as roughly 1,000x to 10,000x faster than training 200 LiRA shadow models.

Surprising findings

• Leverage-based surrogates recover RMIA and classifier-based (Shokri) rankings worse than the loss baseline in some cases, though RMIA still beats loss, by a narrower margin.
• The Spearman correlation was judged less informative than top-k recall because of density of points near 50% ASR.

Limitations

• Closed-form theory is exact only for linear regression.
• Last-layer restriction ignores earlier feature learning.
• Surrogates track LiRA better than RMIA or classifier-based attacks.

Experimental setup

Datasets: CIFAR-10 CIFAR-100 BloodMNIST SST-2 California Housing UCI Energy

Benchmarks: CIFAR-10 CIFAR-100 BloodMNIST SST-2 California Housing UCI Energy

Metrics: recall of LiRA top-1% at top-5% Spearman rank correlation

Baselines: LiRA training loss gradient norm RMIA

Builds on: LiRA influence functions approximate leave-one-out

Closest papers by meaning

• Causal Evaluation of Membership Inference Attacks (NeurIPS 2026 · similarity 0.90)
• Impact of Dataset Properties on Membership Inference Vulnerability of Deep Transfer Learning (NeurIPS 2025 · similarity 0.89)
• Mitigating Privacy Risk in Membership Inference by Convex-Concave Loss (ICML 2024 · similarity 0.89)
• Estimating Model-Level Membership Inference Vulnerability Without Reference Models (NeurIPS 2026 · similarity 0.88)
• A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.88)
• A Unified Framework for Adversary-Aware Differential Privacy Bounds (NeurIPS 2026 · similarity 0.88)