Predicting Privacy Leakage from Weight Spectral Density
Study shows WeightWatcher spectral metrics like stable rank correlate with membership inference vulnerability, enabling cheaper ML privacy auditing.
The paper tests whether spectral metrics from the heavy-tailed self-regularisation framework can proxy membership inference attack (MIA) vulnerability without training expensive shadow models. On image and tabular classification tasks, stable rank correlates positively with overall MIA success, while Log alpha-Norm correlates negatively at the low false-positive regime. These correlations are stronger than those obtained from the generalisation gap, suggesting weight spectra capture leakage information overfitting measures miss. The authors propose spectral analysis as a scalable direction for privacy auditing.
- Stable rank strongly correlates with overall MIA success
- Log alpha-Norm correlates with vulnerability at low false-positive regime
- Spectral signals outperform the generalisation gap as leakage proxies
- Could reduce reliance on costly shadow-model privacy audits
Full article156 words · extracted from arxiv.org · click to collapse
Membership inference attacks (MIAs) are widely used to audit the privacy disclosure risk of machine learning models, however current state-of-the-art attacks require training computationally expensive shadow models, making large-scale privacy evaluation impractical. In this work, we investigate whether inexpensive spectral metrics derived from the heavy-tailed self-regularisation framework can serve as proxies for MIA vulnerability. We evaluate several WeightWatcher spectral metrics on image and tabular classification tasks and compare their relationship with MIA privacy leakage against conventional measures of generalisation. Across datasets, stable rank exhibits a strong positive correlation with overall MIA success, while Log alpha-Norm shows a consistent negative correlation with MIA vulnerability at the low false-positive regime. These associations are observed to be stronger than those obtained using the generalisation gap. The results indicate that neural network spectra may contain information about privacy leakage that is not fully captured by conventional measures of overfitting, motivating spectral analysis as a promising direction for scalable privacy auditing.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.11780