Shift-aware score transport for privacy auditing without retraining
Privacy auditing without retraining is essential for auditing deployed or third-party models, but available non-members often come from a different distribution than the training data, causing standard membership-inference attacks to conflate membership with domain shift and severely overestimate leakage. This paper proposes shift-aware score transport: the auditor learns how membership-inference scores depend on pretrained data representations from the available out-of-distribution non-members, transports that conditional relationship to the in-distribution covariate space implied by known members, and then corrects the estimate via controlled internal calibration tasks. The core contribution is a practical way to recover stable, relatively tight empirical lower bounds on $\mu$-GDP when the auditor cannot retrain, insert canaries, or control data inclusion.
The paper makes a solid empirical contribution by combining counterfactual score transport with an internal, displacement-based calibration procedure, yielding tighter bounds than prior global or propensity-based corrections across image and language benchmarks. However, its formal guarantee in Theorem 1 only ensures the corrected estimate does not exceed the oracle IID audit—not the true privacy parameter—and the authors explicitly disclaim conservativeness when the target extrapolation distance $d^*$ exceeds the calibration range, which is exactly the regime where a rigorous guarantee would be most valuable.
The experimental design and results strongly support the central empirical claim. Across CIFAR-10-C brightness corruptions, CINIC-10, DomainNet, and a temporal arXiv language shift, at least one of the two transport variants tracks the oracle IID-bound closely, while uncorrected OOD audits explode and competing global/conditional corrections collapse toward zero. 'At least one of our two transport variants remains stable across datasets and shift scenarios and produces bounds that stay close to the oracle IID audit.' The PIT-based diagnostic (Figure 2) is also a nice transparency mechanism: it flags when conditional invariance fails and justifies the need for correction.
The theoretical edifice rests on four layered assumptions that are impossible to verify without the very in-distribution non-members the method is meant to replace. Assumption 2 posits that the real OOD-to-IID transport error is stochastically no larger than the within-OOD slab-extrapolation error: 'A sufficient condition is one-sided stochastic domination: $F_{e_{\text{real}}}(t \mid d^{*}) \geq F_{e_{f}|\Delta=d^{*}}(t)$, i.e., at the same displacement, the $Q_Z \to P_Z$ error is stochastically no larger than the within-$Q_Z$ error.' More damaging is Corollary 1, which states: 'we do not claim the conservativeness guarantee of Theorem 1 when $d^* > \Delta_{\max}$.' Because the most severe distribution shifts induce the largest displacements, the method explicitly abandons its validity guarantee precisely where it is needed most. Additionally, the conservative correction is a pointwise upper-tail prediction from quantile regression on a modest number of slab pairs; if the error growth is non-linear outside the observed range, the envelope can fail.
The evidence supports the method's practical utility, though it leaves some analytical gaps. The ablation in Appendix C confirms that score transport alone is insufficient: 'Nominal transport alone can debias the shift to a certain level, but still may produce privacy lower bounds above the oracle, showing that score transport by itself does not ensure validity.' This validates the necessity of the conservative correction. Comparisons to Cebere et al. are fair and show the proposed approach dominates global and conditional adjustment. However, the paper omits empirical head-to-head comparisons with recent generative baselines such as Kazmi et al. (2024), and oracle bounds for the most extreme corruption levels (e.g., CIFAR-10-C severity 5) are implied rather than explicitly reported, making tightness harder to assess at the strongest shifts.
The authors provide pseudocode (Algorithm 1), detailed architecture and training hyperparameters in Appendix B, and explicit bootstrap and slab-fraction procedures. All datasets are publicly available. 'We provide pseudocode for the complete method and describe the score transport, calibration, and auditing procedures in the main text.' Nevertheless, the code has not been released: 'We plan to release the code upon publication,' which currently blocks independent reproduction. Several implementation details necessary for exact reproduction—such as the precise formula for the loss-based MIA score and the handling of random seeds for the $B=100$ member-anchor replicates—are under-specified in the main text, and the 200-bootstrap correction adds non-trivial computational overhead.
Privacy auditing empirically assesses privacy leakage by using membership inference attacks to establish lower bounds on privacy loss. We consider an observational auditing setting in which the auditor cannot insert canaries, control data inclusion, or retrain the target model, and must instead rely on fixed sets of known members and non-members. This setting is relevant for large deployed models or when retraining is restricted by computational or access constraints. In this case, non-members available for auditing may differ in distribution from the training data, causing membership-inference scores to be skewed due to the distribution shift. We address this problem by estimating the counterfactual in-distribution non-member score distribution using the available out-of-distribution (OOD) non-members. Our proposed method learns the relationship between data representations and membership-inference scores from OOD non-members and transports it to the target covariate distribution. Because this transport may become unreliable under extrapolation or imperfect conditional invariance, we further introduce a conservative correction calibrated directly to the nominal transported privacy level. We construct controlled calibration tasks from the available non-member data to estimate how representation-space displacement inflates the audit, and use this estimate to correct the transport-induced audit error. Across multiple datasets with distribution shifts, our method yields substantially more stable privacy estimates while retaining tighter lower bounds than baselines.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.