Shift-aware score transport for privacy auditing without retraining
Authors: Yaohong Yang, Gauri Pradhan, Qi Chen, Samuel Kaski, Antti Honkela
Organizations: ELLIS Institute Finland · Department of Computer Science, Aalto University, Finland · Department of Computer Science, University of Helsinki, Finland · Department of Computer Science, University of Manchester, United Kingdom
Privacy auditing empirically assesses privacy leakage by using membership inference attacks to establish lower bounds on privacy loss. We consider an observational auditing setting in which the auditor cannot insert canaries, control data inclusion, or retrain the target model, and must instead rely on fixed sets of known members and non-members. This setting is relevant for large deployed models or when retraining is restricted by computational or access constraints. In this case, non-members available for auditing may differ in distribution from the training data, causing membership-inference scores to be skewed due to the distribution shift. We address this problem by estimating the counterfactual in-distribution non-member score distribution using the available out-of-distribution (OOD) non-members. Our proposed method learns the relationship between data representations and membership-inference scores from OOD non-members and transports it to the target covariate distribution. Because this transport may become unreliable under extrapolation or imperfect conditional invariance, we further introduce a conservative correction calibrated directly to the nominal transported privacy level. We construct controlled calibration tasks from the available non-member data to estimate how representation-space displacement inflates the audit, and use this estimate to correct the transport-induced audit error. Across multiple datasets with distribution shifts, our method yields substantially more stable privacy estimates while retaining tighter lower bounds than baselines.
Figures & tables
Figure 1: Overview of our shift-aware privacy auditing framework. (a) Counterfactual score transport. We learn the relationship S=R(Z) between data representations Z and non-member MIA scores S from the available OOD non-members QZ , and transport this relationship to the target representation distribution PZ to estimate the unavailable IID non-member score distribution. (b) We construct shift-aware calibration tasks within the OOD non-members by transporting scores from source slabs to target slabs along the QZ→PZ shift direction. Since the target-slab scores are observed, the resulting transport-induced audit error can be measured. (c) The displacement–audit error model measures how the audit error changes with representation displacement, which is evaluated at the QZ→PZ displacement to estimate the transport-induced error used for correction.
Figure 2: Diagnostic assessment of conditional transportability. The dashed diagonal denotes the uniform reference expected under conditional transportability. The OOD non-members are used to construct the reference score distributions, while IID non-member curves below the diagonal indicate larger MIA scores than predicted by the OOD reference distributions.
Figure 3: Comparison of estimated lower bounds across distribution shifts and datasets. At least one of our two transport variants remains stable and produce bounds that stay close to the oracle.
Figure 4: Calibration of audit-error growth versus representation-space displacement across datasets (severity level = 1 on CIFAR-10-C). The fitted upper envelope predicts the target audit error (red cross) at the target displacement and conservatively exceeds the realized audit error (green star).
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 5: Ablation of the conservative correction across datasets. Solid lines are the two proposed methods. Dash lines are the corresponding ablation variants without correction. Nominal transport can still exceed the oracle bound, whereas the conservative correction reduces this overestimation.
Figure 6: Ablation on number of fractions. Privacy lower bounds obtained with residual transport (top) and quantile transport (bottom) for number of fractions ∈{20,50,100} across all datasets. The estimates remain similar across different choices, indicating that our method is robust to the number of fractions used for calibration. Error bars show standard deviation for 5 seeds.
Figure 7: Conditional-invariance diagnostics for CIFAR-10-C (severities 1–4). Empirical CDFs of PIT values for OOD (red) and IID (blue) non-members are compared within estimated domain-propensity bins. Agreement between the curves supports conditional invariance. Dashed lines indicate the uniform reference; gray panels indicate insufficient common support.
Figure 8: Conditional-invariance diagnostics for additional distribution shifts. PIT empirical CDFs for OOD (red) and IID (blue) non-members across CIFAR-10-C severity 5, CINIC-10, DomainNet, and arXiv. Curves are compared within estimated domain-propensity bins; gray panels indicate insufficient common support. Agreement between the two curves indicates greater consistency with conditional invariance, while IID non-member curves below the diagonal indicate larger MIA scores than predicted by the OOD reference distributions.
Figure 9: Domain-propensity distributions across datasets. Distributions of π^(Z)=Pr(D=OOD∣Z,non-member) for IID (blue) and OOD (red) non-members. The dashed line marks equal domain propensity, π^(Z)=0.5 . Separation between the distributions reflects domain distinguishability, while their overlap indicates common support.
Figure 10: Distribution-level realization of the conservative correction. Results are shown for residual transport (left) and quantile transport (right).
Membership inference attacks (MIAs) are the standard tool for auditing the privacy risks of machine learning models. Given a query point, an MIA aims to determine whether that point was used to train the target model. In practice, such inference must rely on the statistical signals exposed by the model's outputs, such as confidence scores, logits, and intermediate feature representations. However, existing methods often fail to efficiently summarize and combine these statistical signals. To address this limitation, we propose Pairwise Likelihood MIA (PL-MIA), a unified method that combines a Gaussian likelihood-ratio (GLR) statistic with population calibration and the Cauchy combination test. We characterize theoretically how the GLR retains variance-contraction signals and establish conditions under which population calibration and Cauchy combination improve attack power. We obtain p-values from pairwise comparisons between the query point and reference points not used for training, and aggregate these continuous signals using the Cauchy combination test. This preserves the evidence strength that is discarded when each pairwise comparison is reduced to a binary vote. Extensive experiments demonstrate that PL-MIA outperforms strong baselines, improving the true positive rate (TPR) by over 25% in the critical low-false-positive regime, corroborating our theoretical findings. These results demonstrate how statistical principles can turn noisy model outputs into more powerful, calibrated, and reproducible evidence for membership privacy auditing.
Shengjie Niu, Zebin Yun, Yeheng Ge +1
The Hong Kong Polytechnic University, Hong Kong, China · Tel Aviv University, Israel
Recent work in the privacy literature shows that sample-targeted membership inference attacks (MIAs) significantly outperform untargeted approaches by a wide margin. Motivated by this observation, we address the following question: can the privacy vulnerability of individual training points be assessed without training shadow models? We show that per-sample exposure to MIA is governed not only by a point's loss, but also by a data-dependent geometric measure. In the linear setting, we derive a closed-form decomposition of individual black-box MIA vulnerability into a population leverage score and a residual loss term, making explicit how sample-dependent geometry translates into privacy exposure. Since the final layer of most modern architectures is linear, we extend this framework to deep networks and propose a surrogate score operating on last-layer representations that requires only a single trained model and no shadow models. Empirical evaluations across diverse datasets and architectures show that our score outperforms loss and gradient-norm baselines at identifying the highest-risk points under state-of-the-art attacks, providing a computationally efficient and theoretically grounded tool for per-sample privacy risk assessment.
Privacy auditing aims to empirically assess privacy leakage in machine learning models using membership inference attacks (MIAs), and to derive lower bounds on differential privacy (DP) parameters. Standard privacy auditing inserts a sensitive sample (a canary) into many (≫100) randomized training runs, requiring the auditor to detect whether it was included in each run. In one-run auditing, many canaries are included in a single training run, avoiding the high computational cost of multi-run approaches. However, recent theory shows that canaries can interfere with one another, reducing per-canary MIA scores and thereby weakening the audit power. We propose IBIS, a framework that optimizes canaries to maximize their own score while minimizing their impact on others. IBIS combines influence-based greedy initialization with bilevel optimization, introducing a novel regularization term that encourages canaries to be orthogonal in embedding space as a proxy for reducing interference. We propose an efficient bilevel algorithm that incrementally updates a single model at each canary update, avoiding the need to retrain the model from scratch after every update. Experiments show that IBIS offers a better performance-cost trade-off than existing canary crafting approaches, improving MIA metrics while reducing computational cost by up to two orders of magnitude.
Mathieu Dagréou, Valentin Dorseuil, Mohammad Yaghini +2
PreMeDICaL team, Inria Idesp, Inserm, Univ. de Montpellier