Training data membership inference via Gaussian process meta-modeling: a post-hoc analysis approach
Yongchao Huang, Pengfei Zhang, Shahzad Mumtaz
TL;DR
This work tackles privacy risks from membership inference by introducing GP-MIA, a post-hoc, model-agnostic framework that uses a Gaussian process classifier trained on simple, model-output-based features from a single trained model. By combining common metrics (accuracy, entropy, input statistics) with optional sensitivity signals (gradients, NTK-derived metrics), GP-MIA delivers calibrated membership probabilities without shadow models or repeated queries. Across synthetic data, real-world fraud detection, CIFAR-10, and WikiText-2, GP-MIA demonstrates strong discriminative power and uncertainty quantification, highlighting its practicality for privacy auditing and model monitoring in diverse domains. The approach also points to broader uses in detecting distributional shifts and generalization gaps, while outlining avenues for scaling and defense integrations in future work.
Abstract
Membership inference attacks (MIAs) test whether a data point was part of a model's training set, posing serious privacy risks. Existing methods often depend on shadow models or heavy query access, which limits their practicality. We propose GP-MIA, an efficient and interpretable approach based on Gaussian process (GP) meta-modeling. Using post-hoc metrics such as accuracy, entropy, dataset statistics, and optional sensitivity features (e.g. gradients, NTK measures) from a single trained model, GP-MIA trains a GP classifier to distinguish members from non-members while providing calibrated uncertainty estimates. Experiments on synthetic data, real-world fraud detection data, CIFAR-10, and WikiText-2 show that GP-MIA achieves high accuracy and generalizability, offering a practical alternative to existing MIAs.