PaperlayerView exact revision on arXiv

Source-linked AI summary

Revisiting Privacy Risks in Quantized Deep Neural Networks

Jie Fu, Ren Li, Wendy Hui Wang

arXiv:2610.37488v1cs.CR

TL;DR

The paper addresses limited evidence on how quantization affects membership-inference privacy risks. It evaluates attacks, quantization methods, model behaviors, and existing defenses, finding that practical bit-widths largely preserve privacy risks while aggressive quantization and defenses can worsen utility.

  • Problem

    How quantization affects membership privacy remains insufficiently understood across diverse quantization strategies and attack scenarios.

    Source: §I · p. 1

  • Method

    The study evaluates eight MIAs across six quantization techniques and analyzes model behaviors and existing defenses for quantized models.

    Source: §I · pp. 1–2

  • Results

    Practical 4–8-bit quantization largely preserves membership privacy risks, while existing defenses add limited protection and can further amplify utility degradation.

    Source: §I · p. 2

  • Takeaways & Limitations

    Quantization alone should not be treated as a privacy-preserving mechanism, and privacy protection in quantized models requires attention to privacy–utility trade-offs.

    Source: §I · p. 2, §VII · p. 9

Abstract

from arXiv · show

Model quantization has become a fundamental technique for enabling the efficient deployment of large-scale deep neural networks (DNNs) in data-intensive applications by reducing model size. Despite its widespread adoption, the impact of quantization on training data privacy --- particularly vulnerability to membership inference attacks (MIAs) --- remains largely unexplored. In this paper, we present the first comprehensive empirical study of privacy risks in quantized DNNs, evaluating eight state-of-the-art MIA attacks across six representative quantization methods. Our results reveal that practical quantization levels (4-8 bits) have limited impact on membership privacy risks, with quantized models remaining largely as vulnerable as their full-precision counterparts. Although aggressive low-bit quantization (e.g., 2-bit) can provide meaningful privacy gains, these benefits come at the cost of substantial utility degradation. To understand the underlying causes of these observations, we systematically analyze how different quantization strategies affect model behaviors and outputs, and how these changes influence privacy vulnerability. Beyond evaluating attack risks, we further investigate whether existing privacy defenses developed for full-precision DNNs can effectively protect QNNs. Our results show that these defenses provide only limited additional privacy protection when applied to quantized models, while further amplifying utility degradation. Our study provides practical guidance for privacy-aware deployment of quantized DNNs and motivates the development of new attack and defense mechanisms for QNNs. Our code and datasets are publicly available at https://github.com/JeffffffFu/Priv-QDNN.

I. INTRODUCTION

The introduction frames quantization’s effect on membership privacy as an open question and presents a broad empirical study of attacks, quantization methods, and model behaviors. It finds that common deployment precisions largely preserve privacy risks, while aggressive quantization and existing defenses can further reduce utility.

  • Quantization reduces model size and accelerates inference, but its privacy implications remain largely unexplored despite the privacy relevance of changes to model outputs and internal behaviors.Source: §I · p. 1
  • Prior work leaves a broad evidence gap: studies examine only limited quantization methods, attack techniques, or experimental settings.Source: §I · p. 1
  • The study evaluates eight representative MIAs across six state-of-the-art quantization techniques, spanning black- and white-box threats and population- and per-example attacks.Source: §I · p. 1
  • Practical 4–8-bit quantization largely preserves membership privacy risks; meaningful privacy improvements require extreme low-bit quantization that severely compromises utility.Source: §I · p. 2
  • Quantization’s privacy impact varies across model architectures and attack settings, with overfitting and output distributions among the model behaviors analyzed.Source: §I · p. 2
  • Existing full-precision defenses provide only limited additional protection for QNNs, while their perturbations can further amplify quantization’s utility degradation.Source: §I · p. 2

II. BACKGROUND AND RELATED WORK

The background describes quantization as mapping model parameters or activations to lower-bit representations, with bit-width controlling the level of quantization noise. It distinguishes post-training from training-aware approaches and uniform from layer-wise precision choices.

A. Quantized Deep Neural Network

B. Membership Inference Attacks against DNNs

The section outlines MIA threat models and summarizes why prior findings on quantized-model privacy remain incomplete. Existing evaluations vary in their quantizers, attack settings, and precision coverage.

B. Membership Inference Attacks against DNNs

  • Black-box MIAs use model outputs and may operate per-example or at population level, while white-box attacks exploit internal states such as gradients and activations.Source: B. Membership Inference Attacks… · p. 2

C. Membership Privacy of Quantized DNNs

  • Prior work spans restricted quantizers, precision levels, and attack settings, leaving the broader effect of quantization on membership privacy unclear.Kowalski et al. considered one method; Zhang et al. examined fixed-precision PTQ and per-example black-box attacks, while Li et al. evaluated only 8-bit models.Source: C. Membership Privacy of Quantized DNNs · pp. 2–3

III. OUR EVALUATION FRAMEWORK

The evaluation framework studies quantization and membership inference across varied datasets, architectures, quantization designs, and attack types. It covers both image and tabular tasks, several precision configurations, and black- and white-box attacks.

III. OUR EVALUATION FRAMEWORK

  • The evaluation spans diverse datasets, DNN architectures, quantization methods, and MIA techniques to assess quantization’s impact on MIA vulnerability.Source: §III · p. 3

A. Datasets and DNNs

  • The benchmarks include CIFAR100 and CINIC-10 with ResNet-18 and MobileNetV2, plus Location and Texas with a five-layer MLP.Source: A. Datasets and DNNs · p. 3

B. Quantization Methods

  • Six quantization methods cover varied designs, including PTQ and QAT approaches and mixed-precision methods; experiments use 2-, 4-, 6-, and 8-bit widths.Source: B. Quantization Methods · p. 3

C. Membership Inference Attacks

1) Black-box Setting:

The study evaluates black-box and white-box membership inference attacks at population and per-example granularity, using attack accuracy and low-FPR true-positive rate to assess attacks alongside model utility.

1) Black-box Setting:

  • Six black-box attacks include five population-level methods and one per-example method.The population-level methods comprise three training-based attacks and two metric-based attacks; RMIA is used at the per-example level.Source: 1) Black-box Setting · pp. 3–4
  • Training-based C-MIA, ML-Leaks, and SAMIA train a meta-classifier from shadow-model outputs, while Entropy and M-Entropy use output-based thresholds.M-Entropy incorporates the ground-truth label and is described as more sensitive than standard entropy for membership inference.Source: 1) Black-box Setting · pp. 3–4
  • RMIA compares a target sample’s victim-model output against outputs on random population samples using a pairwise likelihood-ratio test.A sample is inferred as a member when it dominates a sufficiently large fraction of population samples.Source: 1) Black-box Setting · p. 4

2) White-box Adversary.:

  • WB-S uses true-class softmax probability and last-layer weight-gradient norm; WB-P uses the same features without training a full shadow model.WB-P derives features using an auxiliary dataset sampled from the target training-data distribution at 20% of its size.Source: 2) White-box Adversary · p. 4

D. Evaluation Metrics

  • Attack accuracy and TPR at a predefined low FPR evaluate attacks, while model utility is the training-set classification accuracy.TPR@1% FPR is one reported low-FPR operating point.Source: D. Evaluation Metrics · p. 4

IV. IMPACT OF QUANTIZATION ON MIA EFFECTIVENESS

Across evaluated settings, practical quantization usually leaves membership inference attacks nearly as effective as on full-precision models; meaningful privacy gains emerge at very low precision, with substantial utility loss.

IV. IMPACT OF QUANTIZATION ON MIA EFFECTIVENESS

  • The study averages experimental results over five trials and reports means and standard deviations.The main text reports attack accuracy; TPR@1% FPR results are in Appendix B.Source: §IV · p. 4

A. MIA Effectiveness

  • 4-bit quantization is a notable exception for MobileNetV2 on CINIC-10, where attack accuracy approaches random guessing in most cases.The reported impact depends on the target model, attack, and quantization method.Source: A. MIA Effectiveness · p. 4
  • 2-bit quantization reduces MIA accuracy to nearly random guessing for most QNNs, but classification accuracy drops by as much as 95% in some settings.Across the tested bit-widths, 8-bit quantization has virtually no effect on MIA performance, while 4-bit improvements are limited and method-dependent.Source: A. MIA Effectiveness · p. 4, Figure 2 · p. 4
  • 4–8-bit quantization has little impact on membership privacy in most evaluated settings, with attacks remaining nearly as effective as against full-precision models.The 4-bit results vary by quantization method, attack, and target model.Source: A. MIA Effectiveness · p. 4, Table III · p. 5

B. Understanding Quantization’s Imact on Privacy

Quantization’s privacy effects do not track predictive accuracy alone: overfitting explains some differences, while shifts in member and non-member output distributions explain the contrasting attack outcomes.

Changes in Model Performance Do Not Explain Quantization’s Privacy Effects

  • Quantization-induced accuracy changes do not consistently correlate with MIA effectiveness across the two evaluated model-and-dataset settings.At 2 bits, QDrop training accuracy falls to approximately 1% for ResNet-18 and HAWQ to approximately 10% for MobileNetV2.Source: B. Understanding Quantization’s Imact… · p. 5, Figure 3 · p. 5

Changes in Model Overfitting Only Partially Explain Quantization’s Privacy Effects

  • 6-bit-and-higher quantization preserves nearly the full-precision overfitting level, while 4-bit quantization reduces MobileNetV2 overfitting but leaves ResNet-18 relatively unchanged.At 2 bits, overfitting is almost eliminated for both models across most methods, with PACT the exception; these changes only partially explain privacy effects.Source: Figure 4 · p. 5, B. Understanding Quantization’s Imact… · p. 6

Changes in Output Distributions Fully Explain Quantization’s Privacy Effects

  • 4-bit quantization leaves ResNet-18 member and non-member uncertainty distributions well separated but shifts MobileNetV2’s distributions toward each other, matching the contrasting attack effects.The authors identify output-distribution changes as the factor governing privacy impact, rather than prediction accuracy alone.Source: B. Understanding Quantization’s Imact… · p. 6, Figure 5 · p. 6

V. DEFENSE EFFECTIVENESS

The paper evaluates dropout, adversarial regularization, and differential privacy as defenses for quantized models, with DP-SGD procedures adapted to post-training and quantization-aware training.

A. Defense Mechanisms

  • The evaluation considers dropout, adversarial regularization, and differential privacy as defenses against membership inference.These mechanisms are described as widely used for protecting full-precision DNNs.Source: A. Defense Mechanisms · p. 7, §V · p. 7
  • Dropout randomly deactivates neurons during training, and the evaluation uses dropout rates of 15% and 20%.The study follows prior work for these settings.Source: A. Defense Mechanisms · p. 7
  • Adversarial regularization adds a training-objective penalty for membership leakage to reduce susceptibility to membership inference.The method is abbreviated AR.Source: A. Defense Mechanisms · p. 7
  • Differential privacy uses DP-SGD with gradient clipping and noise, evaluated at privacy budgets ϵ ∈ {1, 5}.For PTQ, quantization follows DP-SGD training; for QAT, DP-SGD and quantization-aware training are performed jointly.Source: A. Defense Mechanisms · p. 7

B. Impact of Quantization on Defense

Existing defenses provide only limited additional protection when combined with quantization, especially at moderate bit-widths. Lowering precision strengthens privacy effects, but defense and quantization perturbations can compound utility loss.

B. Impact of Quantization on Defense

  • Quantized models provide only marginal additional protection with existing defenses, and 8-bit models have attack performance close to full precision.Across most defenses and attacks, quantized models have slightly lower attack accuracy than corresponding full-precision models.Source: B. Impact of Quantization on Defense · pp. 7–8
  • Reducing precision from 8 to 4 to 2 bits gradually reduces attack accuracy across evaluated quantization methods, including C-MIA and WB-S.The magnitude of improvement varies across defense mechanisms.Source: B. Impact of Quantization on Defense · p. 7
  • Moderate quantization adds limited protection because its perturbation is insufficient to substantially change membership-related behavior.The defenses examined already limit leakage by reducing overfitting or memorization, or by perturbing outputs; stronger low-bit quantization further reduces capacity and membership signals.Source: B. Impact of Quantization on Defense · p. 7
  • Drop15% achieves the most favorable privacy-utility balance among evaluated defenses on full-precision and 4-bit CIFAR-100 ResNet-18 models.It retains the highest training accuracy while its attack accuracy is only slightly higher than stronger privacy-preserving approaches; DP has the most significant training-accuracy degradation.Source: B. Impact of Quantization on Defense · p. 8, Figure 6 · p. 8

VI. FUTURE RESEARCH DIRECTIONS IN BUILDING MIA-RESILIENT QNNS

The paper identifies future directions for MIA-resilient QNNs: attacks that account for quantization-induced behavioral shifts and defenses designed around quantization. Its conclusion presents PrivQNN as a framework for evaluating QNN privacy vulnerabilities and emphasizes the unresolved privacy-utility trade-off.

VI. FUTURE RESEARCH DIRECTIONS IN BUILDING MIA-RESILIENT QNNS

  • Future MIA work could adapt attack features to quantization-induced output shifts, while exploring parameter, representation, or gradient signals when model behavior changes little.The paper notes that 6-bit ResNet-18 preserves traditional MIA signals, leaving limited additional information for quantization-aware attacks based on output distributions.Source: §VI · p. 8
  • Future defenses should leverage quantization characteristics while limiting added utility loss from compounded quantization- and defense-induced perturbations.The paper notes that extreme low-bit quantization can substantially reduce QNN accuracy by limiting representational capacity.Source: §VI · pp. 8–9

VII. CONCLUSION

  • PrivQNN evaluates QNN vulnerabilities to MIAs; the study finds quantization offers limited protection and existing full-precision defenses do not consistently achieve a good privacy-utility trade-off.The conclusion motivates deeper study of trade-offs among privacy, model accuracy, and training efficiency.Source: §VII · p. 9

APPENDIX A DETAILS OF DATASETS AND DNN MODELS

Appendix A points to a table summarizing dataset statistics and describes the evaluated model architectures. Appendix B reports attack TPR@1% FPR results and notes that their trends resemble the attack-accuracy results in Section IV.

APPENDIX A DETAILS OF DATASETS AND DNN MODELS

  • Table VI summarizes statistics for the datasets used in PrivQNN.Source: Appendix A · p. 10
  • The evaluated models include ResNet-18, MobileNetV2, and a five-layer fully connected MLP with Tanh activations.ResNet-18 has 17 convolutional layers and one fully connected layer; MobileNetV2 uses inverted residual blocks, linear bottlenecks, and depthwise separable convolutions.Source: Appendix A · p. 10

APPENDIX B ATTACK TPR@1% FPR RESULTS RESULTS

  • Appendix B reports TPR@1% FPR for membership inference attacks across two dataset-model settings, with trends similar to Section IV attack-accuracy results.Source: Appendix B · p. 10

Related papers

Loading 2610.37488v1…