CoLA: A Choice Leakage Attack Framework to Expose Privacy Risks in Subset Training

Qi Li; Cheng-Long Wang; Yinzhi Cao; Di Wang

cs.CRApr 14, 2026

CoLA: A Choice Leakage Attack Framework to Expose Privacy Risks in Subset Training

Authors: Qi Li, Cheng-Long Wang, Yinzhi Cao, Di Wang

Organizations: King Abdullah University of Science and Technology · Provable Responsible AI and Data Analytics Lab · National University of Singapore · Johns Hopkins University

Abstract

Training models on a carefully chosen portion of data rather than the full dataset is now a standard preprocess for modern ML. From vision coreset selection to large-scale filtering in language models, it enables scalability with minimal utility loss. A common intuition is that training on fewer samples should also reduce privacy risks. In this paper, we challenge this assumption. We show that subset training is not privacy free: the very choices of which data are included or excluded can introduce new privacy surface and leak more sensitive information. Such information can be captured by adversaries either through side-channel metadata from the subset selection process or via the outputs of the target model. To systematically study this phenomenon, we propose CoLA (Choice Leakage Attack), a unified framework for analyzing privacy leakage in subset selection. In CoLA, depending on the adversary's knowledge of the side-channel information, we define two practical attack scenarios: Subset-aware Side-channel Attacks and Black-box Attacks. Under both scenarios, we investigate two privacy surfaces unique to subset training: (1) Training-membership MIA (TM-MIA), which concerns only the privacy of training data membership, and (2) Selection-participation MIA (SP-MIA), which concerns the privacy of all samples that participated in the subset selection process. Notably, SP-MIA enlarges the notion of membership from model training to the entire data-model supply chain. Experiments on vision and language models show that existing threat models underestimate subset-training privacy risks: the expanded privacy surface leaks both training and selection membership, extending risks from individual models to the broader ML ecosystem.

Figures & tables

Figure 1: Privacy surfaces under subset training.

Figure 2: Signal distributions under subset training.

Intensity	Setting	NN		NN_top3		NN_cls		LiRA		CoLA
Intensity	Setting	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR
Light	SP-MIA	51.23 $\pm$ 2.56	5.83 $\pm$ 1.34	51.77 $\pm$ 3.02	3.34 $\pm$ 4.45	51.59 $\pm$ 2.66	6.37 $\pm$ 2.22	51.26 $\pm$ 4.85	6.43 $\pm$ 3.70	61.39 $\pm$ 2.48	14.24 $\pm$ 2.02
Light	TM-MIA	64.00 $\pm$ 12.15	12.13 $\pm$ 5.96	61.57 $\pm$ 15.05	8.93 $\pm$ 13.52	67.24 $\pm$ 16.18	19.30 $\pm$ 17.14	69.86 $\pm$ 22.08	15.74 $\pm$ 18.19	83.77 $\pm$ 2.44	42.19 $\pm$ 4.51
Medium	SP-MIA	52.33 $\pm$ 3.56	6.31 $\pm$ 1.48	53.59 $\pm$ 4.30	3.56 $\pm$ 2.28	54.51 $\pm$ 4.51	6.64 $\pm$ 1.58	54.99 $\pm$ 4.69	5.31 $\pm$ 0.42	81.93 $\pm$ 3.50	42.66 $\pm$ 5.81
Medium	TM-MIA	59.84 $\pm$ 12.84	10.80 $\pm$ 4.97	60.37 $\pm$ 10.53	2.91 $\pm$ 3.32	66.84 $\pm$ 11.79	12.51 $\pm$ 5.85	62.96 $\pm$ 13.69	4.61 $\pm$ 2.52	88.53 $\pm$ 2.55	60.10 $\pm$ 7.62
Heavy	SP-MIA	52.21 $\pm$ 3.83	12.20 $\pm$ 15.48	53.20 $\pm$ 4.85	2.80 $\pm$ 2.43	53.53 $\pm$ 5.94	12.37 $\pm$ 15.44	53.69 $\pm$ 5.68	4.26 $\pm$ 1.77	96.86 $\pm$ 2.60	88.60 $\pm$ 5.51

Table 1: Results for vision models under the subset-aware side-channel attack setting. Results are averaged over 9 coreset selection methods. Intensity denotes the selection ratio

r

(Light:

r=0.2

, Medium:

r=0.4

, Heavy:

r=0.6

, Extensive:

r=0.8

). Best results per row are in bold.

Panel of Figure 3 — Figure 3: The MIA performance of different attack surface on vision models under black-box setting.

Panel of Figure 4 — Figure 4: Ablation studies on (left) the window size and (right) the embedding model for MIA performance.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Choice Leakage Attack ( CoLA ) across the data–model supply chain. CoLA augments conventional MIA by exploiting subset selection metadata leaked along the data–model supply chain. By identifying which samples are more likely to pass selection, it not only strengthens membership inference but also enables adversaries to craft tailored threats.

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 433 papers

VLALeaks: Membership Inference Attacks against Vision-Language-Action Models
Jun 13, 2026Xukun Luan, Jinyan Liu, Xuesong Li +4Membership Inference Attacks Privacy Leakage in Language Models
School of Computer Science and Technology, Beijing Institute of Technology · School of Computer Science and Engineering, Northeastern University · PRADA Lab, King Abdullah University of Science and Technology
Assessing Per-Sample Membership Inference Vulnerability without Retraining
Feb 17, 2026Valentin Dorseuil, Jamal Atif, Olivier CappéMembership Inference Attacks
DI-ENS · DI ENS, École normale supérieure, Université PSL, CNRS · CMAP +1
Loss Landscape Poisoning: Targeted Extraction of Unseen Training Data from LLMs
Jun 15, 2026Md Abdullah Al Mamun, Ngoc Phu Doan, Pedram Zaree +2Privacy Leakage in Language Models LLM Security
UC Riverside · Riverside, California, USA · Queen’s University Belfast +2

Jun 13, 2026J/K move · Enter open · S save

VLALeaks: Membership Inference Attacks against Vision-Language-Action Models

Xukun Luan, Jinyan Liu, Xuesong Li, Yuanguo Bi+3

School of Computer Science and Technology, Beijing Institute of Technology · School of Computer Science and Engineering, Northeastern University · PRADA Lab, King Abdullah University of Science and Technology

Membership Inference Attacks Privacy Leakage in Language Models Vision-Language-Action Models

Open paper AskPDF arXiv

Vision-Language-Action (VLA) models enable end-to-end robot control and have garnered widespread attention. However, the memorization of training data inherent to VLA, coupled with the high cost of robotic data acquisition, raises serious concerns regarding data privacy leakage and intellectual property infringement. Membership inference attacks (MIAs) aim to determine whether a given sample belongs to the training set. While representing a significant privacy threat, this attack remains underexplored in the context of VLA models. To bridge this gap, we propose VLALeaks, which is based on attention discrepancies in VLA models. We reveal, for the first time, the privacy vulnerabilities of VLA models. Specifically, it comprises a two-stage process: (1) membership feature extraction, and (2) attack model construction. Experimental results across multiple VLA benchmarks demonstrate that VLALeaks readily reveals membership information and achieves optimal attack AUC and TPR@1%FPR, highlighting the privacy vulnerabilities in current VLA model deployments. Our work is the first systematic study of MIAs on VLA models, aiming to provide insights for secure and trustworthy VLA models.

Abstract

Privacy-Preserving ML

Explore similar work

VLALeaks: Membership Inference Attacks against Vision-Language-Action Models

Assessing Per-Sample Membership Inference Vulnerability without Retraining

Loss Landscape Poisoning: Targeted Extraction of Unseen Training Data from LLMs