PaperlayerView exact revision on arXiv

Source-linked AI summary

Shift-aware score transport for privacy auditing without retraining

Yaohong Yang, Gauri Pradhan, Qi Chen, Samuel Kaski, Antti Honkela

arXiv:2610.31549v1cs.LG

TL;DR

When fixed-model privacy audits must use available non-members that may differ from training data, MIA scores can be skewed by distribution shift. The paper transports the OOD score–representation relationship to the target covariate distribution and calibrates transport error using controlled shifts. Across multiple shifts, the approach yields more stable privacy estimates while retaining tighter lower bounds than baselines.

  • Problem

    In observational auditing, available non-members may differ from training data, so MIA scores can reflect distribution shift as well as membership and overestimate privacy leakage.

    Source: §1 · p. 1, §3 · p. 3

  • Method

    The method transports the score–representation relationship learned from OOD non-members to the target distribution, then uses controlled calibration tasks to estimate and correct transport-induced audit error.

    Source: §1 · p. 2

  • Results

    Across image and language benchmarks with synthetic and natural shifts, the methods stabilize audits under substantial extrapolation or imperfect conditional invariance while retaining tighter privacy lower bounds than baselines.

    Source: §1 · p. 3

  • Takeaways & Limitations

    At least one transport variant provides tighter privacy lower bounds than existing baselines across multiple distribution shifts.

    Source: §6 · p. 9

    Linear residual transport primarily corrects conditional score-location changes and may fail when shift changes conditional variance, skewness, or tail behavior.

    Source: §4.1.1 · p. 5

Abstract

from arXiv · show

Privacy auditing empirically assesses privacy leakage by using membership inference attacks to establish lower bounds on privacy loss. We consider an observational auditing setting in which the auditor cannot insert canaries, control data inclusion, or retrain the target model, and must instead rely on fixed sets of known members and non-members. This setting is relevant for large deployed models or when retraining is restricted by computational or access constraints. In this case, non-members available for auditing may differ in distribution from the training data, causing membership-inference scores to be skewed due to the distribution shift. We address this problem by estimating the counterfactual in-distribution non-member score distribution using the available out-of-distribution (OOD) non-members. Our proposed method learns the relationship between data representations and membership-inference scores from OOD non-members and transports it to the target covariate distribution. Because this transport may become unreliable under extrapolation or imperfect conditional invariance, we further introduce a conservative correction calibrated directly to the nominal transported privacy level. We construct controlled calibration tasks from the available non-member data to estimate how representation-space displacement inflates the audit, and use this estimate to correct the transport-induced audit error. Across multiple datasets with distribution shifts, our method yields substantially more stable privacy estimates while retaining tighter lower bounds than baselines.

1 INTRODUCTION

When available non-members differ from training data, membership scores can conflate distribution shift with membership and overestimate privacy leakage. The paper transports scores from OOD non-members toward the target distribution and calibrates transport error using controlled shifts.

1 INTRODUCTION

  • Available non-members may differ from the training distribution, causing MIA scores to capture distribution differences as well as membership and potentially overestimate privacy leakage.This is consequential because privacy audits use MIAs to establish empirical lower bounds on privacy loss, while common alternatives may require retraining, controlled inclusion, or canaries.Source: §1 · pp. 1–2
  • The method estimates the missing IID non-member score distribution by transporting the score–representation relationship learned from OOD non-members to the target representation distribution.This nominal transport relies on conditional score invariance; extrapolation into poorly represented regions and imperfect invariance can make it unreliable.Source: §1 · p. 2
  • Controlled calibration tasks measure how representation-space displacement affects transport-induced audit error, and the estimated error is used to correct the transported audit.The tasks use source and target slabs within observed OOD non-members, where target-slab scores remain available for comparison.Source: §1 · p. 2
  • Across image and language benchmarks with synthetic and natural shifts, corrected transport stabilizes audits and retains tighter privacy lower bounds than baselines.The paper reports that at least one transport variant remains stable when extrapolation is substantial or conditional invariance is imperfect.Source: §1 · p. 3

2 BACKGROUND AND RELATED WORK

This section situates privacy auditing among methods that test privacy hypotheses using membership outcomes and reviews approaches to auditing when non-member data are distribution-shifted.

2 BACKGROUND AND RELATED WORK

  • A privacy audit tests whether a learning algorithm's observed behavior satisfies a privacy hypothesis, using known membership labels and MIA outcomes to evaluate the hypothesis.An audit is p-valid when the probability of rejecting a true hypothesis is at most p; empirical privacy parameters can be obtained from the strongest hypothesis confidently rejected.Source: §2 · p. 3
  • Earlier audits may retrain models, while one-run approaches reduce that cost but still intervene in training by controlling candidate-example inclusion.These approaches rely on independent membership indicators.Source: §2 · p. 3
  • Prior shift-aware auditing approaches include generated non-members, global or propensity-based corrections, and methods exploiting naturally occurring data variation.Cebere et al. (2026) rely on distributional overlap and accurate propensity estimation, and may become overly conservative under severe shift; the paper distinguishes its covariate-shift setting from class-support shift.Source: §2 · p. 3
  • The paper quantifies empirical privacy leakage on the µ-GDP scale and obtains a lower confidence bound by comparing membership-guessing performance with that allowed by a candidate guarantee.The µ-GDP scale characterizes distinguishability through a hypothesis-testing trade-off between neighboring datasets.Source: §2 · p. 3

3 PROBLEM FORMULATION

The problem formulation considers post-hoc auditing of a fixed model using known members and OOD non-members, with the IID non-member score distribution unavailable. The goal is to correct the resulting privacy lower bound so it remains valid while staying as tight as possible to the IID-reference audit.

3 PROBLEM FORMULATION

  • The target is a fixed model audited post hoc without retraining or controlled data inclusion, and the auditor has black-box access to its outputs.The score is oriented so larger values indicate stronger evidence of membership.Source: §3 · p. 3
  • The algorithm forms source and target slabs of OOD non-members along the QZ-to-PZ shift direction, predicts target-slab scores, and measures transport-induced audit error across displacements.It fits quantile regression to displacement–error pairs; the corrected bound subtracts an estimated error from the transported bound, floored at zero.Source: §3 · p. 4
  • Training data follow PX, while available non-members come from the OOD population QX; the desired reference is the unavailable IID non-member score distribution under PX.The formulation distinguishes the available OOD non-member scores from the in-distribution reference scores needed for auditing.Source: §3 · p. 4
  • The auditing procedure uses known membership labels and score-based guesses to produce a lower confidence bound on the µ-GDP parameter.The bound is denoted µL(c, k, n), where c is the number of membership guesses and k the number correct.Source: §3 · p. 4
  • The objective is to correct the OOD-based privacy lower bound so it remains valid and as tight as possible to the bound obtained using IID non-members.Source: §3 · p. 4

4 METHODOLOGY

The method transports non-member membership-inference scores from the available OOD population to target covariates, then calibrates transport error using controlled shifts within the observed non-members. It diagnoses conditions that can make nominal transport unreliable and gives a corrected privacy lower bound under an explicit error-bound condition.

4.1 COUNTERFACTUAL SCORE TRANSPORT

  • A fixed pretrained representation lets the method learn the OOD non-member score relationship and evaluate it under target covariates, assuming conditional score invariance and sufficient support overlap.The methodology reserves auditing data for the final audit and uses reference data to learn how to mitigate distribution shift.Source: §4 · p. 4, §4.1 · p. 5

4.1.1 LINEAR RESIDUAL TRANSPORT

  • Linear residual transport changes conditional score location at target covariates while preserving residuals, but may miss shifts in conditional variance, skewness, or tails.It assumes an additive score model with residual distribution invariant across covariates and domains.Source: §4.1.1 · p. 5

4.1.2 CONDITIONAL QUANTILE TRANSPORT

  • Conditional quantile transport models the full conditional score distribution and averages replicate empirical CDFs to reduce sample variance.Quantile models are fitted over a grid of quantile levels using pinball loss.Source: §4.1.2 · pp. 5–6

4.2 WHEN IS NOMINAL TRANSPORT UNRELIABLE?

  • Nominal transport requires both conditional score invariance and support overlap; either failure can make it unreliable, with non-overlap requiring extrapolation and invariance violations causing bias even on overlap.The diagnostic compares IID non-member probability integral transform values with a uniform reference; below-diagonal curves indicate larger scores than OOD references predict and can yield anticonservative bounds.Source: §4.2 · p. 6, Figure 2 · p. 7

4.3 SHIFT-AWARE CONSERVATIVE CORRECTION

  • Calibration partitions OOD non-members into source-to-target slabs, measures audit error at different representation-space displacements, and uses an upper error-growth estimate to correct the transported bound.The correction subtracts the estimated error from the transported privacy lower bound and truncates at zero.Source: §4.3 · pp. 6–7
  • The corrected lower bound is valid relative to the oracle audit when real transport-induced audit error is bounded by the calibrated error envelope.The oracle uses unavailable IID non-member scores; the theorem does not directly compare the correction with the training algorithm’s true µ-GDP parameter.Source: §4.3 · p. 8

5 EXPERIMENTS

The experiments test privacy auditing across image and language benchmarks under synthetic and natural shifts. At least one transport variant stays stable and close to the IID oracle, while the calibrated error estimate upper-bounds realized audit error.

Experimental setup

  • Experiments cover CIFAR-10-C brightness corruption, CINIC-10, DomainNet, and a temporal arXiv shift; audits use five seeds and 200 bootstrap resamples.The comparison includes uncorrected OOD auditing, an IID oracle, and global and conditional correction baselines.Source: §5 · pp. 8–9

Results

  • At least one transport variant remains stable and close to the IID oracle across datasets and shift scenarios, with tighter bounds than the baselines.For strongest CIFAR-10-C corruption, corrected quantile transport yields µ = 0.42 versus 1.51 uncorrected; on DomainNet, corrected residual transport yields 0.31 versus an IID bound of 0.49.Source: Figure 3 · p. 9, §5 · p. 9
  • The fitted error estimate upper-bounds realized audit error across evaluated settings, supporting conservative corrected privacy lower bounds.The paper also reports ablations on the correction and calibration fraction count to assess overestimation prevention and hyperparameter robustness.Source: §5 · p. 9

6 DISCUSSION

The discussion recommends reporting the larger corrected lower bound from the two transport variants. It also notes that formal validity guarantees are not provided under realistically verifiable assumptions.

Discussion

  • In practice, report the larger corrected lower bound produced by the two transport variants.Across multiple shifts, at least one variant provides tighter lower bounds than existing baselines.Source: §6 · p. 9
  • The method does not provide formal validity guarantees under realistically verifiable assumptions.The paper notes that establishing such guarantees under distribution shift remains challenging for existing observational auditing approaches as well.Source: §6 · p. 9
  • Figure 4 relates representation-space displacement to audit-error growth and depicts the target displacement alongside predicted and realized errors.Its caption describes the fitted upper envelope as exceeding the realized audit error in the illustrated calibration.Source: Figure 4 · p. 10

GENERATIVE AI USE

The authors used LLMs as supporting tools for language polishing, literature discovery, code development, and figure generation.

Generative AI use

  • LLMs assisted with language polishing, literature discovery, code development, and figure generation.They helped improve grammar, phrasing, and notation consistency, identify potentially relevant related work, and write or refactor code.Source: GENERATIVE AI USE · p. 10
  • The authors checked suggested references against original sources and reviewed, tested, and modified AI-assisted code.Source: GENERATIVE AI USE · p. 10
  • The authors state that the research ideas, experimental design, hypotheses, and scientific claims were developed and written by them.They take responsibility for the final submission.Source: GENERATIVE AI USE · p. 10

A THEORETICAL RESULTS

The proof fragment invokes assumptions and a union bound, while Corollary 1 specifies where the calibrated error envelope remains conservative.

Theoretical results

  • The proof begins with an event defined by the error envelope exceeding qτ(∆), then invokes Assumption 4 and a union bound.The supplied proof passages do not state the intervening inequalities in full.Source: A THEORETICAL RESULTS · p. 14
  • The proof identifies d̄ with d* when d* lies within the calibrated displacement range and invokes monotonicity from Assumption 3.Source: A THEORETICAL RESULTS · p. 14
  • When d* exceeds ∆max, the calibrated envelope cannot generally upper-bound target error without an additional extrapolation assumption, so the theorem’s conservativeness guarantee is not claimed.For d* below ∆min, evaluating at ∆min remains conservative under Assumption 3.Source: A THEORETICAL RESULTS · p. 14

B EXPERIMENTS CONFIGURATION

The experiments use disjoint audit and reference sets, frozen pretrained representations, and residual-backbone score-transport models. Calibration uses separated non-member slabs, with bootstrap resampling to produce corrected privacy lower bounds.

B EXPERIMENTS CONFIGURATION

  • The membership-inference attacker ranks scores, guesses the highest and lowest score tails as members and non-members, and abstains on the rest; the audit reports the best valid lower bound across configured guess counts.Guess-count grids vary by dataset.Source: B EXPERIMENTS CONFIGURATION · pp. 14–15
  • Image audits use frozen DINOv2-B/14 class-token features, while arXiv uses frozen GPT-2 features pooled from 64-token chunks; neither representation model is fine-tuned.Both representation types yield 768-dimensional features.Source: B EXPERIMENTS CONFIGURATION · p. 14
  • Audit and reference sets are balanced and disjoint, with 5,000 examples per membership class for CIFAR-10-C and CINIC-10, 20,000 for DomainNet, and 3,000 for arXiv.Each set therefore contains 10,000, 40,000, or 6,000 examples, respectively.Source: B EXPERIMENTS CONFIGURATION · p. 15
  • Linear and quantile transport share a residual MLP backbone; image experiments condition on class, whereas the arXiv model does not.The linear model estimates conditional mean scores, while the quantile model predicts conditional score quantiles.Source: B EXPERIMENTS CONFIGURATION · p. 15
  • Calibration uses source and target slabs formed from the bottom and top fractions of reference non-members along the estimated shift direction; smaller fractions separate the slabs further.The displacement-error pairs estimate transport error at the observed audit displacement.Source: B EXPERIMENTS CONFIGURATION · p. 15
  • Each bootstrap replicate resamples reference members and non-members, reruns transport and calibration, and contributes to the corrected lower bound reported as a lower bootstrap quantile.The algorithm is identified as the same bootstrap procedure as Cebere et al. (2026).Source: B EXPERIMENTS CONFIGURATION · p. 15

C ABLATION RESULTS

The conservative correction reduces privacy-bound overestimation from nominal score transport, and the estimates are broadly stable across tested calibration-fraction counts.

C ABLATION RESULTS

  • Nominal transport alone can debias distribution shift to some extent but does not ensure a valid bound, since it may exceed the oracle.This is why the ablation compares corrected methods with uncorrected variants and the oracle.Source: C ABLATION RESULTS · p. 16, Figure 5 · p. 16
  • The conservative correction substantially reduces nominal transport’s overestimation of the oracle privacy bound by estimating an upper envelope of transport-induced audit error.Nominal transport can still produce bounds above the oracle.Source: Figure 5 · p. 16, C ABLATION RESULTS · p. 16
  • Across datasets, residual- and quantile-transport estimates remain similar for 20, 50, and 100 calibration fractions, with only minor variation relative to estimate uncertainty.Error bars show standard deviation across five seeds.Source: C ABLATION RESULTS · p. 16, Figure 6 · p. 17

D ADDITIONAL DIAGNOSTICS FOR CONDITIONAL TRANSPORTABILITY

PIT-based diagnostics compare IID and OOD non-members within estimated domain-propensity bins to assess conditional transportability. They reveal both assumption violations and regions where limited overlap makes transport depend on extrapolation.

D ADDITIONAL DIAGNOSTICS FOR CONDITIONAL TRANSPORTABILITY

  • PIT diagnostics indicate violations of conditional invariance for CINIC-10 and DomainNet; IID curves below the diagonal indicate larger MIA scores than predicted from OOD references.The comparisons use empirical CDFs within estimated domain-propensity bins.Source: D ADDITIONAL DIAGNOSTICS FOR… · p. 17
  • For CIFAR-10-C and arXiv, some propensity bins have insufficient common support, suggesting that transport there may require extrapolation.Gray panels mark bins without reliable comparisons.Source: D ADDITIONAL DIAGNOSTICS FOR… · p. 17
  • Domain-propensity distributions indicate that separation generally increases with CIFAR-10-C corruption severity, while DomainNet has considerably weaker overlap.Overlap marks representation-space regions where conditional comparisons are better supported.Source: D ADDITIONAL DIAGNOSTICS FOR… · p. 17

E RECOVERING A CONSERVATIVE TRANSPORTED SCORE DISTRIBUTION

The optional distribution-level correction realizes the scalar conservative correction by retreating the nominal transported non-member distribution toward the member-score distribution. Its relative performance depends on score-shift shape and support overlap.

E RECOVERING A CONSERVATIVE TRANSPORTED SCORE DISTRIBUTION

  • In quantile space, γ controls retreat from the nominal distribution at γ = 0 to the member distribution at γ = 1; the method chooses the smallest retreat whose bound does not exceed the calibrated target.A finite search grid means the resulting bound need not equal the target exactly, but cannot exceed it.Source: E RECOVERING A CONSERVATIVE… · p. 20
  • Figure 10 visualizes how the nominal transported distribution retreats toward the member distribution until its induced privacy lower bound reaches the calibrated target.The figure shows this optional distribution-level correction for residual and quantile transport on arXiv.Source: Figure 10 · p. 21, E RECOVERING A CONSERVATIVE… · p. 21
  • The distribution-level correction shrinks nominal transported scores toward the empirical member-score distribution until the induced privacy bound meets the calibrated conservative target.When non-member and member score distributions coincide, the privacy lower bound is zero.Source: E RECOVERING A CONSERVATIVE… · pp. 17, 21
  • On arXiv, similar variances and a largely location-based score shift support good performance by both transport variants, while sparse DomainNet support makes corrected quantile transport less reliable than residual transport.Conditional tail estimation is especially sensitive to extrapolation when source support is sparse.Source: E RECOVERING A CONSERVATIVE… · p. 21
Loading 2610.31549v1…