Learnability and Privacy Vulnerability are Entangled in a Few Critical Weights

Xingli Fang; Jung-Eun Kim

cs.LGMar 13, 2026

Learnability and Privacy Vulnerability are Entangled in a Few Critical Weights

Authors: Xingli Fang, Jung-Eun Kim

Organizations: Department of Computer Science, North Carolina State University, Raleigh, NC 27695, USA

Abstract

Prior approaches for membership privacy preservation usually update or retrain all weights in neural networks, which is costly and can lead to unnecessary utility loss or even more serious misalignment in predictions between training data and non-training data. In this work, we observed three insights: i) privacy vulnerability exists in a very small fraction of weights; ii) however, most of those weights also critically impact utility performance; iii) the importance of weights stems from their locations rather than their values. According to these insights, to preserve privacy, we score critical weights, and instead of discarding those neurons, we rewind only the weights for fine-tuning. We show that, through extensive experiments, this mechanism exhibits outperforming resilience in most cases against Membership Inference Attacks while maintaining utility.

Figures & tables

Panel of Figure 1 — Figure 1: According to TFO, important weights are pruned over different sparsities. The results are shown on ResNet18 and CIFAR-100

Panel of Figure 2 — Figure 2: Our approach takes into account privacy vulnerability for importance estimation, while TFO only measures learnability for accuracy.

Panel of Figure 3 — Figure 3: The visualization of weight-level learnability scores and privacy vulnerability scores. Privacy vulnerability and accuracy are significantly correlated and this correlation varies in different components. Due to the significant scale discrepancy, the ranges of axes of the four charts in ViT are not consistent. (The same data points as Tab. 1 .)

Model	Weight Type	PCC	Proportion
ResNet18	All	0.8329	100.00%
	Conv	0.9410	99.50%
	Linear	0.8096	0.45%
	Norm	0.6776	0.05%
ViT	All	0.7667	100.00%
	Att+MLP	0.9068	99.39%

Table 1: The correlation between privacy vulnerability and learnability in two architectures. PCC denotes Pearson Correlation Coefficient. Att+MLP denotes the weights of the attention layers and MLP layers in transformer blocks. (The same data points as in Fig. 3b )

Figure 4: The performance of M1, M2, & M3 on ResNet18 & CIFAR-100.

Figure 6

Approach	0.1%	1.0%	3.0%	5.0%
A2 - train	1.2268	0.8570	0.4326	0.4619
A2 - test	1.3797	1.2728	0.9288	0.9610
A3 - train	0.1502	0.3376	0.4473	0.4815
A3 - test	0.7720	0.7433	0.8044	0.8330
From scratch - train	0.8087
From scratch - test	1.5398

Table 2: The Cross-entropy loss after fine-tuning with a privacy-preserving approach, according to the portion of rewound weights.

CPU	GPU	RAM	OS	CUDA	Python	PyTorch
AMD Ryzen™ 7 7700X	NVIDIA GeForce RTX 5090	64 GB	Ubuntu 24.04 LTS	12.9	3.12.3	2.80

Table 8

Model	Defense	Test Acc. (%, $\uparrow$ )	LiRA ( $\downarrow$ )			RMIA( $\downarrow$ )
			AUC (%)	TPR(%)@FPR		AUC(%)	TPR(%)@FPR
			AUC (%)	0.1%	0.1‱	AUC(%)	0.1%	0.1‱
ResNet18	No Defense	79.44 (0.23)	85.00 (2.20)	2.18 (0.59)	1.78 (0.34)	74.76 (1.59)	5.88 (0.70)	3.90 (1.31)
	RelaxLoss	77.10 (1.21)	70.51 (2.72)	1.38 (0.42)	0.52 (0.21)	66.60 (1.67)	0.52 (0.34)	0.12 (0.16)
	+ CWRF (Ours)	76.86 (0.29)	68.31 (0.68)	0.03 (0.05)	0.03 (0.05)	68.18 (1.53)	1.22 (0.97)	0.27 (0.19)
	HAMP	77.79 (0.33)	79.71 (0.20)	3.33 (0.73)	1.80 (1.47)	80.07 (0.58)	7.28 (1.64)	1.93 (1.28)

Table 3: The performance of four privacy-preservation approaches with and without CWRF (Ours) on CIFAR-10. Higher is better in test accuracy (

\uparrow

) while lower is better in Privacy (

\downarrow

Panel of Figure 5 — Figure 5: The performance of ResNet18 trained with three privacy-preservation approaches with and without CWRF (Ours). The dotted line represents a baseline performance of a model trained from scratch with regular training approach, Cross-Entropy.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Training	Reference
CIFAR-10	$18,000$	$2,000$
CIFAR-100	$18,000$	$4,000$
CINIC-10	$25,000$	$5,000$

Appendix

Table 4: The number of data points sampled from the entire non-testing set.

Figure 6: The performance against LiRA when

128

shadow models (

64

‘IN’ and

64

‘OUT’ models) are deployed for ResNet18 trained with three privacy-preservation approaches (RelaxLoss, HAMP, and CCL) with and without CWRF (Ours) in CIAFR-100. The dotted line represents a baseline performance of a model trained from scratch with regular training approach, Cross-Entropy.

Figure 7: The performance of transformer trained with three privacy-preservation approaches with and without CWRF (Ours) in DBpedia-14. The dotted line represents a baseline performance of a model trained from scratch with regular training approach, Cross-Entropy.

Panel of Figure 8 — Figure 8: Privacy-utility curve of ResNet18 in CIFAR-100. The bottom right corner (low MIAs yet high test accuracy) is the best performance in terms of privacy-utility.

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 432 papers

Assessing Per-Sample Membership Inference Vulnerability without Retraining
Feb 17, 2026Valentin Dorseuil, Jamal Atif, Olivier CappéMembership Inference Attacks
DI-ENS · DI ENS, École normale supérieure, Université PSL, CNRS · CMAP +1
Mitigating Membership Inference in Intermediate Representations with Differentially Private Training
Feb 26, 2026Jiayang Meng, Tao Huang, Chen Hou +2Differentially Private Stochastic Gradient Descent Membership Inference Attacks
School of Information, Renmin University of China, Beijing, China · School of Computer Science and Big Data, Minjiang University, Fuzhou, Fujian, China
A Critical Review on the Effectiveness and Privacy Threats of Membership Inference Attacks
Mar 24, 2026Najeeb Jebreel, David Sánchez, Josep Domingo-FerrerMembership Inference Attacks Privacy-Preserving ML
Universitat Rovira i Virgili, Department of Computer Engineering and Mathematics, CYBERCAT-Center for Cybersecurity Research of Catalonia, ComSCIAM-Center for Computational Science and Applied Mathematics Av. Països Catalans 26, 43007 Tarragona, Catalonia

Feb 17, 2026J/K move · Enter open · S save

Assessing Per-Sample Membership Inference Vulnerability without Retraining

Valentin Dorseuil, Jamal Atif, Olivier Cappé

DI-ENS · DI ENS, École normale supérieure, Université PSL, CNRS · CMAP+1

Membership Inference Attacks

Open paper AskPDF arXiv

Recent work in the privacy literature shows that sample-targeted membership inference attacks (MIAs) significantly outperform untargeted approaches by a wide margin. Motivated by this observation, we address the following question: can the privacy vulnerability of individual training points be assessed without training shadow models? We show that per-sample exposure to MIA is governed not only by a point's loss, but also by a data-dependent geometric measure. In the linear setting, we derive a closed-form decomposition of individual black-box MIA vulnerability into a population leverage score and a residual loss term, making explicit how sample-dependent geometry translates into privacy exposure. Since the final layer of most modern architectures is linear, we extend this framework to deep networks and propose a surrogate score operating on last-layer representations that requires only a single trained model and no shadow models. Empirical evaluations across diverse datasets and architectures show that our score outperforms loss and gradient-norm baselines at identifying the highest-risk points under state-of-the-art attacks, providing a computationally efficient and theoretically grounded tool for per-sample privacy risk assessment.

Abstract

Privacy-Preserving ML

Explore similar work

Assessing Per-Sample Membership Inference Vulnerability without Retraining

Mitigating Membership Inference in Intermediate Representations with Differentially Private Training

A Critical Review on the Effectiveness and Privacy Threats of Membership Inference Attacks