Subgroup Membership Inference Audits of Differentially Private Synthetic Text
Audits of 32 differentially private synthetic-text releases show subgroup membership leakage is concentrated in few records and systematically underestimated by average-case attacks.
The paper defines a subgroup-targeted membership inference game in which the target pool is an explicit parameter, to audit residual leakage in differentially private synthetic text releases. The audit instantiates 32 proxies across four datasets, three generators (DP-SGD fine-tuning, API-based prompting, and activation steering), and five privacy budgets. DP substantially reduces average leakage at every budget, but remaining leakage is concentrated: roughly a tenth of records carries about 40% of it, and the noise removes more measured leakage from random records than from high-risk ones. Which records leak depends on the release mechanism, so record-level risk cannot be assessed independently of the release.
- Subgroup-targeted MIA audits reveal leakage hidden by average-case risk metrics.
- Under DP, about 10% of records carry roughly 40% of the leakage.
- DP removes more leakage from random records than from high-risk ones.
- Leaking records depend on the release mechanism, not the record alone.
- Products
- DP-SGD
From the original article
1 min read at arxiv.orgSynthetic data releases are increasingly proposed in the literature as a means of sharing realistic data replicas in lieu of sensitive private datasets. Even when the worst-case privacy leakage of such releases is bounded by means of differential privacy (DP), in practice a residual risk remains. Membership inference attack (MIA) audits are conducted to empirically quantify this risk.
By Yidan Sun · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.