Newest papers

Shift-aware score transport for privacy auditing without retraining

Yaohong Yang, Gauri Pradhan, Qi Chen, Samuel Kaski A, Antti Honkela · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.31549 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

La auditoría de privacidad correcta evalúa empíricamente la fuga de datos utilizando ataques de inferencia de afiliación para establecer límites inferiores a la pérdida de privacidad. Consideramos una configuración de auditoría observacional en la que el auditor no puede insertar canarios, controlar la inclusión de datos, o retraer el modelo objetivo, y debe depender en su lugar de conjuntos fijos de miembros conocidos y no miembros. Esta configuración es relevante para los grandes modelos desplegados o cuando la redistribución está restringida por restricciones de acceso o computación. En este caso, los no miembros disponibles para la auditoría pueden diferir en distribución de los datos de formación, causando que las puntuaciones de referencia de afiliación se distorsionen debido al cambio de distribución. Resolvemos este problema estimando la puntuación de error de transporte en la distribución

Machine translation (Meta M2M100); the English original follows.

Abstract

Privacy auditing empirically assesses privacy leakage by using membership inference attacks to establish lower bounds on privacy loss. We consider an observational auditing setting in which the auditor cannot insert canaries, control data inclusion, or retrain the target model, and must instead rely on fixed sets of known members and non-members. This setting is relevant for large deployed models or when retraining is restricted by computational or access constraints. In this case, non-members available for auditing may differ in distribution from the training data, causing membership-inference scores to be skewed due to the distribution shift. We address this problem by estimating the counterfactual in-distribution non-member score distribution using the available out-of-distribution (OOD) non-members. Our proposed method learns the relationship between data representations and membership-inference scores from OOD non-members and transports it to the target covariate distribution. Because this transport may become unreliable under extrapolation or imperfect conditional invariance, we further introduce a conservative correction calibrated directly to the nominal transported privacy level. We construct controlled calibration tasks from the available non-member data to estimate how representation-space displacement inflates the audit, and use this estimate to correct the transport-induced audit error. Across multiple datasets with distribution shifts, our method yields substantially more stable privacy estimates while retaining tighter lower bounds than baselines.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Audit, Counterfactual thinking, Computer science, Information privacy, Covariate, Retraining

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange