Newest papers

Shift-aware score transport for privacy auditing without retraining

Yaohong Yang, Gauri Pradhan, Qi Chen, Samuel Kaski A, Antti Honkela · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.31549 · cited by 0 works (OpenAlex) · open-access PDF

Portuguese

A auditoria de privacidade correta avalia empiricamente o vazamento de dados usando ataques de inferência de associação para estabelecer limites mais baixos sobre a perda de privacidade. Consideramos uma configuração de auditoria observacional em que o auditor não pode inserir canários, controlar a inclusão de dados ou retrabalhar o modelo-alvo, e deve, em vez disso, depender de conjuntos fixos de membros conhecidos e não-membros. Esta configuração é relevante para modelos grandes implantados ou quando o retrabalho é restringido por restrições de acesso ou computação. Neste caso, os não-membros disponíveis para auditoria podem diferir em distribuição dos dados de treinamento, causando que as pontuações de referência de membros sejam distorcidas devido à mudança de distribuição. Nós abordamos este problema estimando a distribuição de

Machine translation (Meta M2M100); the English original follows.

Abstract

Privacy auditing empirically assesses privacy leakage by using membership inference attacks to establish lower bounds on privacy loss. We consider an observational auditing setting in which the auditor cannot insert canaries, control data inclusion, or retrain the target model, and must instead rely on fixed sets of known members and non-members. This setting is relevant for large deployed models or when retraining is restricted by computational or access constraints. In this case, non-members available for auditing may differ in distribution from the training data, causing membership-inference scores to be skewed due to the distribution shift. We address this problem by estimating the counterfactual in-distribution non-member score distribution using the available out-of-distribution (OOD) non-members. Our proposed method learns the relationship between data representations and membership-inference scores from OOD non-members and transports it to the target covariate distribution. Because this transport may become unreliable under extrapolation or imperfect conditional invariance, we further introduce a conservative correction calibrated directly to the nominal transported privacy level. We construct controlled calibration tasks from the available non-member data to estimate how representation-space displacement inflates the audit, and use this estimate to correct the transport-induced audit error. Across multiple datasets with distribution shifts, our method yields substantially more stable privacy estimates while retaining tighter lower bounds than baselines.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Audit, Counterfactual thinking, Computer science, Information privacy, Covariate, Retraining

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange