Generalized Leverage Score for Scalable Assessment of Privacy Vulnerability

2026-02-19 · Source: stat.ML updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

A new method assesses the privacy vulnerability of individual data points in machine learning models without requiring model retraining or explicit attack simulations. Researchers from DI-ENS and CMAP demonstrate that exposure to membership inference attacks (MIA) is directly linked to a data point's influence on the learned model. In linear models, this vulnerability is theoretically tied to the leverage score, which serves as a principled metric. This approach avoids the computational cost of training shadow models. For deep learning, the authors propose a computationally efficient generalization of the leverage score. Empirical evaluations confirm a strong correlation between this generalized score and MIA success, validating its use as a practical surrogate for individual privacy risk assessment.

Key takeaway

For data scientists and privacy engineers concerned with model security, this research introduces a computationally efficient way to quantify individual data point privacy risk. You can use the generalized leverage score to identify and mitigate highly vulnerable data points without the extensive overhead of retraining models or simulating attacks, thereby streamlining privacy assessments in deep learning deployments.

Key insights

Individual data point privacy vulnerability correlates with its influence on a model, quantifiable via a generalized leverage score.

Principles

• MIA risk is governed by data point influence.
• Leverage score indicates individual privacy vulnerability.

Method

The method involves calculating a generalized leverage score for deep learning models to assess individual data point privacy risk, bypassing shadow model training.

In practice

• Assess individual data privacy risk efficiently.
• Identify high-vulnerability data points.

Topics

• Membership Inference Attacks
• Leverage Score
• Data Privacy Assessment
• Deep Learning

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Researcher, AI Scientist, Machine Learning Engineer

Related on AIssential

• Your Synthetic Data Passed Every Test and Still Broke Your Model — Standard synthetic data metrics often miss critical issues like feature correlations, tail performance, and attribute inference risks.
• Predictability as a Fine-Grained Measure for Privacy — Privacy via predictability offers a fine-grained privacy metric by quantifying an attacker's incremental prediction gain based on specific knowledge and queries.
• POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agents — POLAR-Bench diagnoses LLM agent privacy-utility trade-offs, showing frontier models significantly outperform smaller, on-device counterparts.
• Detecting Data Contamination in Large Language Models — Black-box MIAs are currently ineffective at reliably detecting data contamination in LLM training corpora.
• Let's Ask Gauss: Improved One-Run Privacy Auditing — A Gaussian distribution perspective on canary signals yields tighter privacy bounds in one-run DP auditing.
• Phantoms and Disclosures: a Causal Framework for Auditing Synthetic Data — The framework distinguishes true from phantom data disclosures in synthetic data using statistical testing, requiring no model access.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by stat.ML updates on arXiv.org.