analiza aiqbench
This paper tests whether membership inference attacks on image classifiers can exploit how predictions degrade under low-pass filtering. They can't: a single confidence threshold matches or beats every frequency-based score, and the filtering widens the spread between members and non-members faster than it widens their mean gap. For readers working on privacy and defenses, the practical point is that the leakage appears to be a whole-image property, so defenses that target high-frequency reliance are unlikely to help.
Frequency-Domain Membership Inference Does Not Beat Confidence Thresholding: A Band-Resolved Analysis of Why
arXiv:2610.24643v1 Announce Type: new Abstract: A widely repeated account of membership inference holds that models lean on fine-grained detail for samples they have memorized, so degrading an input's resolution should expose membership through how quickly a prediction falls apart. We test that account band by band. A monotone family of zero-phase low-pass filters is applied to each query image, the target's confidence on its original prediction is read at every step, and the resulting decay is scored in a dozen ways. Two federated ResNet-18 targets are studied, one trained normally and one pushed to a 45.1-point generalization gap. The account does not survive. On the normally trained target the best profile score reaches an AUC of 0.513 against 0.537 for a single confidence threshold, and on the overfit target 0.735 against 0.943. A search over 1206 candidate scores, with direction chosen on a held-out half and a fitted combination as an upper bound, produces no score that beats the threshold in either regime. The failure has a mechanism: the mean confidence gap between members and non-members grows as detail is removed, exactly as the hypothesis predicts, but the spread grows faster, so discriminability falls from the first step onward. Decomposing each image into phase and magnitude shows why no band-localized operation can work, since the advantage travels with image structure, surviving at 0.567 when the phase is kept and collapsing to 0.492 when only the magnitude is. Membership is a whole-image identity effect rather than an accumulation of spectral energy in any band, and defenses aimed at high-frequency reliance are aimed at the wrong target.
Abstract:A widely repeated account of membership inference holds that models lean on fine-grained detail for samples they have memorized, so degrading an input's resolution should expose membership through how quickly a prediction falls apart. We test that account band by band. A monotone family of zero-phase low-pass filters is applied to each query image, the target's confidence on its original prediction is read at every step, and the resulting decay is scored in a dozen ways. Two federated ResNet-18 targets are studied, one trained normally and one pushed to a 45.1-point generalization gap. The account does not survive. On the normally trained target the best profile score reaches an AUC of 0.513 against 0.537 for a single confidence threshold, and on the overfit target 0.735 against 0.943. A search over 1206 candidate scores, with direction chosen on a held-out half and a fitted combination as an upper bound, produces no score that beats the threshold in either regime. The failure has a mechanism: the mean confidence gap between members and non-members grows as detail is removed, exactly as the hypothesis predicts, but the spread grows faster, so discriminability falls from the first step onward. Decomposing each image into phase and magnitude shows why no band-localized operation can work, since the advantage travels with image structure, surviving at 0.567 when the phase is kept and collapsing to 0.492 when only the magnitude is. Membership is a whole-image identity effect rather than an accumulation of spectral energy in any band, and defenses aimed at high-frequency reliance are aimed at the wrong target.
Artificial Intelligence (cs.AI)
arXiv:2610.24643 [cs.AI]
(or arXiv:2610.24643v1 [cs.AI] for this version)
https://doi.org/10.48550/arXiv.2610.24643 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Text integral sub licența deschisă a publicației · 352 cuvinte