Empirical Evaluation of Membership Inference Attacks on NLP Text Classifiers: A Baseline Study on SST-2

William Novak; Muhammad Abusaqer

Source-linked AI summary

Empirical Evaluation of Membership Inference Attacks on NLP Text Classifiers: A Baseline Study on SST-2

William Novak, Muhammad Abusaqer

arXiv:2609.10935v1Sep 10, 2026cs.CRcs.CLcs.LG

TL;DR

Membership inference can expose whether sensitive NLP text was used to train a model, but comparative evidence across text classifiers is limited. This paper benchmarks TF-IDF + Logistic Regression and DistilBERT on SST-2 with a loss-threshold attack and utility metrics. DistilBERT delivered higher utility, both models retained measurable membership signal, and lightweight training adjustments reduced leakage with different utility costs.

Problem
Membership inference threatens privacy in NLP because sensitive user text may be included in training data, while privacy is less often evaluated alongside classification utility.
Method
The study compares TF-IDF + Logistic Regression and fine-tuned DistilBERT on SST-2 using a loss-threshold membership inference attack, utility metrics, and simple mitigation settings.
Results
DistilBERT reached 0.9466 development accuracy and 0.9460 macro F1 versus 0.8756 and 0.8727 for Logistic Regression, while Attack AUC was 0.5800 and 0.5615, respectively.
Takeaways & Limitations
Reducing DistilBERT training from 3 to 2 epochs produced the most favorable tested privacy-utility trade-off, while stronger Logistic Regression regularization reduced leakage with a utility cost.
Takeaways & Limitations
The findings are limited to one dataset, one attack family, and a small set of mitigation settings, so they are a compact baseline rather than a universal claim about NLP privacy leakage.

Abstract

from arXiv · show

Membership inference attacks (MIAs) try to determine whether a specific record was used to train a model, a privacy risk that matters in natural language processing (NLP), where training data can contain sensitive user text. This paper presents a controlled benchmark of membership inference vulnerability for text classification on the GLUE SST-2 sentiment dataset. A TF-IDF + Logistic Regression pipeline and a fine-tuned DistilBERT classifier are compared under a loss-threshold MIA, with utility measured by development accuracy and macro F1. DistilBERT reached 0.9466 accuracy and 0.9460 macro F1 against 0.8756 and 0.8727 for Logistic Regression, yet both models leaked membership signal (Attack AUC 0.5615 and 0.5800, respectively). Two mitigations were tested. Stronger regularization reduced leakage for Logistic Regression at a visible utility cost, whereas fine-tuning DistilBERT for 2 epochs instead of 3 reduced leakage with negligible accuracy loss. Lightweight training adjustments can improve the privacy-utility trade-off without complex defenses.

1. Introduction

The study frames membership inference as a privacy risk for sensitive NLP text and benchmarks that risk alongside classification utility. It compares TF-IDF + Logistic Regression with DistilBERT under a common SST-2 evaluation design and tests simple leakage mitigations.

Motivation: Membership inference can reveal whether an individual’s record was used for training, creating privacy concerns for sensitive personal, medical, financial, or behavioral data.The risk can arise from model behavior even when attackers see only prediction outputs.
Motivation: NLP privacy evaluation matters because text datasets often contain sensitive user-generated content while prediction systems are increasingly deployed through APIs and cloud services.The paper identifies a gap between strong predictive utility and first-class privacy assessment.
Benchmark focus: The benchmark compares TF-IDF + Logistic Regression and fine-tuned DistilBERT on SST-2 under a shared privacy evaluation framework.The pairing extends traditional-versus-transformer utility comparisons to membership leakage.
Research questions: The study asks how membership leakage compares across model types, how it relates to overfitting-related behavior, and whether simple mitigations preserve utility.It evaluates a loss-threshold attack and tests stronger Logistic Regression regularization and fewer DistilBERT fine-tuning epochs.

2. Related Work

Prior work established membership inference attacks, linked leakage to overfitting, and broadened evaluation across defenses, access settings, and subgroup effects. This study addresses a remaining comparison gap by evaluating traditional and transformer NLP classifiers together on privacy as well as utility.

Foundations: Foundational work showed that black-box prediction outputs can carry membership signal and connected leakage to lower training loss caused by overfitting.These findings established core attack and explanatory intuitions for later MIA research.
Defenses and scope: Surveys organized MIA risks and defenses by model, access assumptions, and design choices, while noting that defenses can introduce performance trade-offs.Regularization, distillation, and differential privacy were identified as common defense families.
Broader evaluation: Research on subgroup effects showed that aggregate attack performance may conceal uneven privacy leakage across populations.This motivates considering fairness-related dimensions in privacy evaluation.
NLP-specific work: NLP-specific studies found that user-level vulnerability depends partly on contribution structure and how model behavior changes across data regimes.These studies used Reddit- and Amazon-based classification scenarios.
Research gap: The study fills a gap by comparing traditional and transformer-based NLP classifiers directly on membership leakage rather than utility alone.Its comparative design follows side-by-side benchmarking logic while extending the target outcome to privacy.

3. Methodology and Experimental Setup

The methodology uses SST-2 with matched TF-IDF + Logistic Regression and DistilBERT pipelines, evaluates utility and loss-based membership leakage, and compares members with validation non-members. The workflow also includes reproducible data partitioning, implementation, and saved intermediate outputs.

Experimental design: The benchmark evaluates TF-IDF + Logistic Regression and DistilBERT on SST-2 under the same dataset, attack design, and evaluation criteria.The goal is to measure both classification utility and privacy leakage while testing simple mitigation settings.
Data: The official SST-2 training split was stratified into target-train and target-dev subsets using an 80%/20% split with random seed 42, while validation supplied clean non-members.SST-2 is a standardized binary text-classification task from GLUE.
Membership inference attack: The loss-threshold attack uses per-example negative loglikelihood, assigning higher membership scores to examples with lower loss.The attack is motivated by the tendency of overfitting models to assign lower loss to training members.
Membership inference attack: The balanced attack set samples equal numbers of members from target-train and non-members from the official validation split.This creates the member-versus-non-member comparison used for privacy evaluation.
Metrics: Utility is measured with development accuracy and macro F1, while privacy is measured with Attack AUC and Attack Advantage.Mean per-example losses characterize fit and generalization, and attack accuracy at the best threshold is supplementary.
Implementation: The Python workflow uses scikit-learn for the traditional pipeline and Hugging Face Transformers with PyTorch for DistilBERT, saving probabilities, losses, attack summaries, and comparison tables.Saved intermediate outputs support reproducibility and later analysis.

4. Results

DistilBERT substantially outperformed TF-IDF + Logistic Regression on utility, but both models leaked membership signal; mitigation reduced leakage with different utility costs.

Baseline Model Comparison: 0.9466 development accuracy and 0.9460 macro F1 for DistilBERT exceeded 0.8756 and 0.8727 for Logistic Regression.
Baseline Model Comparison: 0.5800 Attack AUC for DistilBERT exceeded 0.5615 for Logistic Regression, while Logistic Regression had higher Attack Advantage.
Effect of Mitigation Settings: 0.0187 lower development accuracy and 0.0202 lower macro F1 accompanied Logistic Regression’s Attack AUC reduction from 0.5615 to 0.5385.
Effect of Mitigation Settings: 0.0146 lower Attack AUC for DistilBERT followed training reduction from 3 to 2 epochs, while development accuracy changed from 0.9466 to 0.9465.
Summary of Observed Trade-offs: DistilBERT with 2 epochs yielded the most favorable privacy-utility trade-off among the evaluated settings.

5. Discussion

DistilBERT delivered substantially higher utility than Logistic Regression, but both models retained measurable membership signal under the loss-threshold attack. Mitigation effects differed by model: regularization reduced Logistic Regression leakage at a utility cost, whereas fewer DistilBERT epochs preserved utility more effectively.

5.1. Baseline Comparison: 0.9466 versus 0.8756 development accuracy and 0.9460 versus 0.8727 macro F1 show substantially stronger utility for DistilBERT than Logistic Regression, while both models remained vulnerable to membership inference.Attack AUC was 0.5800 for DistilBERT and 0.5615 for Logistic Regression, both above random guessing.
5.1. Baseline Comparison: Lower member loss supported the loss-threshold attack, with Logistic Regression losses of 0.3105 on training data versus 0.3501 on development data and 0.4553 on validation data.DistilBERT showed the same direction, with mean losses of 0.0510, 0.2341, and 0.4471 across the corresponding splits.
5.2. Effect of the Mitigation Settings: C = 0.3 regularization reduced Logistic Regression Attack AUC from 0.5615 to 0.5385 and Attack Advantage from 0.1697 to 0.1330, while development accuracy fell by 0.0187.The privacy improvement therefore came with a visible utility penalty.
5.2. Effect of the Mitigation Settings: Reducing DistilBERT fine-tuning from 3 to 2 epochs lowered Attack AUC from 0.5800 to 0.5654 while preserving development accuracy at 0.9465 versus 0.9466.Attack Advantage also fell from 0.1365 to 0.1170, and macro F1 remained nearly identical.
5.3. Practical Interpretation: Attack AUC values of 0.5615 for Logistic Regression and 0.5800 for DistilBERT indicate measurable but moderate membership leakage in this benchmark.The observed signal was stronger than random guessing but far from highly reliable membership extraction.
5.4. Scope of the Findings: The benchmark used one dataset, one attack family, and few mitigation settings, so its findings are a compact empirical baseline rather than a universal claim.The reported trends remain meaningful within that scope.

6. Future Work

Future work should broaden the benchmark beyond SST-2 and the current loss-threshold attack. Expanded experiments should preserve the reproducible workflow while testing more model, regularization, and privacy-metric configurations.

6. Future Work: Future experiments should evaluate additional datasets to test whether the observed trends remain stable across domains, class distributions, and task difficulty.This would assess generality beyond SST-2.
6. Future Work: The attack space should expand beyond loss-threshold inference to shadow-model-based and confidence-based attacks for broader privacy-risk evaluation.Alternative attack assumptions could reveal whether the current findings persist across attack designs.
6. Future Work: A larger reproducible benchmark could compare more transformer settings, regularization choices, and privacy metrics in one experimental matrix.This would test whether the favorable fewer-epochs DistilBERT behavior generalizes beyond the current setup.

7. Conclusion

This study establishes a compact SST-2 benchmark showing that stronger classification utility can coexist with measurable membership leakage. Simple mitigations reduced leakage, with fewer DistilBERT epochs providing the most favorable tested privacy-utility trade-off.

7. Conclusion: 0.9466 development accuracy and 0.9460 macro F1 for DistilBERT exceeded Logistic Regression's 0.8756 and 0.8727, respectively, while both models showed measurable membership leakage.Attack AUC was 0.5615 for Logistic Regression and 0.5800 for DistilBERT.
7. Conclusion: Reducing DistilBERT training from 3 to 2 epochs lowered Attack AUC from 0.5800 to 0.5654 and Attack Advantage from 0.1365 to 0.1170 with accuracy essentially unchanged at 0.9466 versus 0.9465.This was the most favorable privacy-utility trade-off among the tested mitigation settings.
7. Conclusion: Stronger Logistic Regression regularization lowered Attack AUC from 0.5615 to 0.5385 but decreased development accuracy by 0.0187.The model-family comparison shows that mitigation benefits differed across the two pipelines.
7. Conclusion: The benchmark supports three conclusions: utility does not eliminate privacy risk, leakage was measurable but moderate, and lightweight choices can reduce leakage without severe accuracy loss.The study therefore provides a reproducible baseline for examining privacy-utility relationships in text classifiers.