Shift-aware score transport for privacy auditing without retraining
Authors: Yaohong Yang, Gauri Pradhan, Qi Chen, Samuel Kaski, Antti Honkela
Organizations: ELLIS Institute Finland · Department of Computer Science, Aalto University, Finland · Department of Computer Science, University of Helsinki, Finland · Department of Computer Science, University of Manchester, United Kingdom
Privacy auditing empirically assesses privacy leakage by using membership inference attacks to establish lower bounds on privacy loss. We consider an observational auditing setting in which the auditor cannot insert canaries, control data inclusion, or retrain the target model, and must instead rely on fixed sets of known members and non-members. This setting is relevant for large deployed models or when retraining is restricted by computational or access constraints. In this case, non-members available for auditing may differ in distribution from the training data, causing membership-inference scores to be skewed due to the distribution shift. We address this problem by estimating the counterfactual in-distribution non-member score distribution using the available out-of-distribution (OOD) non-members. Our proposed method learns the relationship between data representations and membership-inference scores from OOD non-members and transports it to the target covariate distribution. Because this transport may become unreliable under extrapolation or imperfect conditional invariance, we further introduce a conservative correction calibrated directly to the nominal transported privacy level. We construct controlled calibration tasks from the available non-member data to estimate how representation-space displacement inflates the audit, and use this estimate to correct the transport-induced audit error. Across multiple datasets with distribution shifts, our method yields substantially more stable privacy estimates while retaining tighter lower bounds than baselines.
Figures & tables
Figure 1: Overview of our shift-aware privacy auditing framework. (a) Counterfactual score transport. We learn the relationship S=R(Z) between data representations Z and non-member MIA scores S from the available OOD non-members QZ , and transport this relationship to the target representation distribution PZ to estimate the unavailable IID non-member score distribution. (b) We construct shift-aware calibration tasks within the OOD non-members by transporting scores from source slabs to target slabs along the QZ→PZ shift direction. Since the target-slab scores are observed, the resulting transport-induced audit error can be measured. (c) The displacement–audit error model measures how the audit error changes with representation displacement, which is evaluated at the QZ→PZ displacement to estimate the transport-induced error used for correction.
Figure 2: Diagnostic assessment of conditional transportability. The dashed diagonal denotes the uniform reference expected under conditional transportability. The OOD non-members are used to construct the reference score distributions, while IID non-member curves below the diagonal indicate larger MIA scores than predicted by the OOD reference distributions.
Figure 3: Comparison of estimated lower bounds across distribution shifts and datasets. At least one of our two transport variants remains stable and produce bounds that stay close to the oracle.
Figure 4: Calibration of audit-error growth versus representation-space displacement across datasets (severity level = 1 on CIFAR-10-C). The fitted upper envelope predicts the target audit error (red cross) at the target displacement and conservatively exceeds the realized audit error (green star).
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 5: Ablation of the conservative correction across datasets. Solid lines are the two proposed methods. Dash lines are the corresponding ablation variants without correction. Nominal transport can still exceed the oracle bound, whereas the conservative correction reduces this overestimation.
Figure 6: Ablation on number of fractions. Privacy lower bounds obtained with residual transport (top) and quantile transport (bottom) for number of fractions ∈{20,50,100} across all datasets. The estimates remain similar across different choices, indicating that our method is robust to the number of fractions used for calibration. Error bars show standard deviation for 5 seeds.
Figure 7: Conditional-invariance diagnostics for CIFAR-10-C (severities 1–4). Empirical CDFs of PIT values for OOD (red) and IID (blue) non-members are compared within estimated domain-propensity bins. Agreement between the curves supports conditional invariance. Dashed lines indicate the uniform reference; gray panels indicate insufficient common support.
Figure 8: Conditional-invariance diagnostics for additional distribution shifts. PIT empirical CDFs for OOD (red) and IID (blue) non-members across CIFAR-10-C severity 5, CINIC-10, DomainNet, and arXiv. Curves are compared within estimated domain-propensity bins; gray panels indicate insufficient common support. Agreement between the two curves indicates greater consistency with conditional invariance, while IID non-member curves below the diagonal indicate larger MIA scores than predicted by the OOD reference distributions.
Figure 9: Domain-propensity distributions across datasets. Distributions of π^(Z)=Pr(D=OOD∣Z,non-member) for IID (blue) and OOD (red) non-members. The dashed line marks equal domain propensity, π^(Z)=0.5 . Separation between the distributions reflects domain distinguishability, while their overlap indicates common support.
Figure 10: Distribution-level realization of the conservative correction. Results are shown for residual transport (left) and quantile transport (right).