Generalized Leverage Score for Scalable Assessment of Privacy Vulnerability
Valentin Dorseuil, Jamal Atif, Olivier Cappé
TL;DR
This work addresses the risk of membership inference at the level of individual data points without retraining or shadow-model simulations. It shows that, in Gaussian linear models, the leverage score fully characterizes MIA vulnerability and extends this insight to deep models via the Generalized Leverage Score (GLS) derived through implicit differentiation; GLS includes both regression and classification settings and admits efficient last-layer approximations. Through extensive CIFAR-10 experiments with ResNet-18, GLS demonstrates a strong correlation with LiRA shadow-model attacks and effectively identifies high-risk outliers, while avoiding the computational burden of training multiple shadow models. The approach thus provides a scalable, interpretable auditing tool that complements differential privacy guarantees, highlighting data points that are most susceptible to privacy leakage and guiding targeted risk mitigation.
Abstract
Can the privacy vulnerability of individual data points be assessed without retraining models or explicitly simulating attacks? We answer affirmatively by showing that exposure to membership inference attack (MIA) is fundamentally governed by a data point's influence on the learned model. We formalize this in the linear setting by establishing a theoretical correspondence between individual MIA risk and the leverage score, identifying it as a principled metric for vulnerability. This characterization explains how data-dependent sensitivity translates into exposure, without the computational burden of training shadow models. Building on this, we propose a computationally efficient generalization of the leverage score for deep learning. Empirical evaluations confirm a strong correlation between the proposed score and MIA success, validating this metric as a practical surrogate for individual privacy risk assessment.