Newest papers

Shift-aware score transport for privacy auditing without retraining

Yaohong Yang, Gauri Pradhan, Qi Chen, Samuel Kaski A, Antti Honkela · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.31549 · cited by 0 works (OpenAlex) · open-access PDF

German

Wir betrachten eine Beobachtungs-Audit-Einstellung, in der der Prüfer keine Kanarien einfügen, die Dateneingliederung kontrollieren oder das Zielmodell neu ausbilden kann und stattdessen auf feste Sätze bekannter Mitglieder und Nichtmitglieder zurückgreifen muss. Diese Einstellung ist für große eingesetzte Modelle relevant oder wenn die Neuausbildung durch berechnende oder Zugriffsbeschränkungen eingeschränkt ist. In diesem Fall können Nichtmitglieder, die für die Prüfung verfügbar sind, sich in der Verteilung von den Trainingsdaten unterscheiden, was dazu führt, dass die Mitgliedschafts-Inferenz-Score aufgrund der Verteilungsschiebung verzerrt werden. Wir lösen dieses Problem, indem wir die faktische Verteilung der nichtmitgliedstaufgaben

Machine translation (Meta M2M100); the English original follows.

Abstract

Privacy auditing empirically assesses privacy leakage by using membership inference attacks to establish lower bounds on privacy loss. We consider an observational auditing setting in which the auditor cannot insert canaries, control data inclusion, or retrain the target model, and must instead rely on fixed sets of known members and non-members. This setting is relevant for large deployed models or when retraining is restricted by computational or access constraints. In this case, non-members available for auditing may differ in distribution from the training data, causing membership-inference scores to be skewed due to the distribution shift. We address this problem by estimating the counterfactual in-distribution non-member score distribution using the available out-of-distribution (OOD) non-members. Our proposed method learns the relationship between data representations and membership-inference scores from OOD non-members and transports it to the target covariate distribution. Because this transport may become unreliable under extrapolation or imperfect conditional invariance, we further introduce a conservative correction calibrated directly to the nominal transported privacy level. We construct controlled calibration tasks from the available non-member data to estimate how representation-space displacement inflates the audit, and use this estimate to correct the transport-induced audit error. Across multiple datasets with distribution shifts, our method yields substantially more stable privacy estimates while retaining tighter lower bounds than baselines.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Audit, Counterfactual thinking, Computer science, Information privacy, Covariate, Retraining

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange