The Hidden Cost of Modeling P(X): Vulnerability to Membership Inference Attacks in Generative Text Classifiers

TL;DR

This work addresses membership inference risks in text classification by contrasting discriminative, generative, and pseudo-generative paradigms within a single-shadow black-box framework. It derives a two-term leakage decomposition tied to $D_{KL}(P_X\|Q_X)$ and $D_{KL}(P(Y|X)\|Q(Y|X))$, and validates the theory with toy experiments and large-scale transformer-based evaluations across nine datasets. The key finding is that fully generative models that model $P(X,Y)$ leak more, particularly when logits exposing $P(X,Y)$ are available, while pseudo-generative approaches offer stronger privacy protection with competitive utility. The results yield practical guidance on API exposure (favoring probabilities over logits), model choice, and training practices, and motivate future work on privacy-preserving generative classifiers that retain utility while mitigating leakage.

Abstract

Membership Inference Attacks (MIAs) pose a critical privacy threat by enabling adversaries to determine whether a specific sample was included in a model's training dataset. Despite extensive research on MIAs, systematic comparisons between generative and discriminative classifiers remain limited. This work addresses this gap by first providing theoretical motivation for why generative classifiers exhibit heightened susceptibility to MIAs, then validating these insights through comprehensive empirical evaluation. Our study encompasses discriminative, generative, and pseudo-generative text classifiers across varying training data volumes, evaluated on nine benchmark datasets. Employing a diverse array of MIA strategies, we consistently demonstrate that fully generative classifiers which explicitly model the joint likelihood $P(X,Y)$ are most vulnerable to membership leakage. Furthermore, we observe that the canonical inference approach commonly used in generative classifiers significantly amplifies this privacy risk. These findings reveal a fundamental utility-privacy trade-off inherent in classifier design, underscoring the critical need for caution when deploying generative classifiers in privacy-sensitive applications. Our results motivate future research directions in developing privacy-preserving generative classifiers that can maintain utility while mitigating membership inference vulnerabilities.

Figures (30)

• Figure 1: Membership inference vulnerability increases with model confidence and dimensionality. Top row: test accuracy vs. core separation $\mu$. Bottom row: membership inference advantage (AUROC) vs. $\mu$. Columns correspond to $d\in\{16,64,256\}$. Colors denote model types and inference methods: Logistic Regression max-probability (blue), LDA max-probability (orange), LDA log-joint (green). Markers indicate training size $n_{\text{train}}\in\{50,200,2000\}$. Results averaged over 5 seeds with $\pm 1.96 \times$ SEM bands.
• Figure 2: [Best viewed in color] MIA success rate (AUROC) compared across full-size model architectures with varying training dataset sizes. We evaluate fully generative classifiers (GEN, DIFF), a discriminative classifier (DISC), and pseudo-generative models (MLM). The top row displays attack performance using model logits, while the bottom row shows results using output probabilities. Higher AUROC values indicate increased privacy vulnerability. Results averaged across 5 random seeds.
• Figure 3: Membership inference attack susceptibility for BERT. The solid line corresponds to the majority class, while the dashed line corresponds to the minority class. The x-axis indicates the number of training samples used.
• Figure 4: Membership inference attack susceptibility for MLM. The solid line corresponds to the majority class, while the dashed line corresponds to the minority class. The x-axis indicates the number of training samples used.
• Figure 5: Membership inference attack susceptibility for AR. The solid line corresponds to the majority class, while the dashed line corresponds to the minority class. The x-axis indicates the number of training samples used.

Theorems & Definitions (8)

• Lemma 3.1: Two-way decomposition: upper and lower bounds
• Lemma 3.2: Joint $\succeq$ Conditional under full-vector exposure
• Theorem 3.3: Scalar joint can dominate conditional under systematic marginal skew
• proof : Proof of Lemma \ref{['lem:joint-ge-cond']}
• proof : Proof of Theorem \ref{['thm:scalar-joint-dominates']}
• Lemma C.1: One-parameter Gibbs/Chernoff lower bound
• Lemma C.2: Change-of-measure (bounded likelihood ratio)
• Lemma C.3: Hölder/log-sum convexity split