Training data membership inference via Gaussian process meta-modeling: a post-hoc analysis approach

2025-10-22

AI Summary

Membership inference attacks (MIAs) threaten the privacy of model training data, yet existing approaches rely heavily on shadow models or extensive query budgets, limiting practical applicability. This paper proposes an efficient and interpretable MIA framework based on Gaussian process meta-modeling: it requires only a single set of posterior metrics from the target model—such as prediction accuracy, entropy, gradient norm, and dataset-level statistical features—to construct a calibrated, uncertainty-aware binary classifier, eliminating the need for shadow training or repeated queries. Our core innovation lies in formulating membership inference as an uncertainty-quantified meta-learning task, enabling high attack accuracy, strong generalization across diverse domains, and intrinsic interpretability. We validate the method on synthetic data, fraud detection benchmarks, CIFAR-10, and WikiText-2, demonstrating consistent performance gains and significantly improved practicality and deployment feasibility.

Technology Category

Machine Learning: Calibration & Uncertainty QuantificationCognitive Modeling & Cognitive Systems: Conceptual Inference and ReasoningReasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty

Application Category

User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systemsSearch and Retrieval-Augmented AI: Web evaluation methodologies and metricsSecurity and Privacy: Large-scale security measurements

Abstract

Membership inference attacks (MIAs) test whether a data point was part of a model's training set, posing serious privacy risks. Existing methods often depend on shadow models or heavy query access, which limits their practicality. We propose GP-MIA, an efficient and interpretable approach based on Gaussian process (GP) meta-modeling. Using post-hoc metrics such as accuracy, entropy, dataset statistics, and optional sensitivity features (e.g. gradients, NTK measures) from a single trained model, GP-MIA trains a GP classifier to distinguish members from non-members while providing calibrated uncertainty estimates. Experiments on synthetic data, real-world fraud detection data, CIFAR-10, and WikiText-2 show that GP-MIA achieves high accuracy and generalizability, offering a practical alternative to existing MIAs.

Problem

• Detecting training data membership via interpretable Gaussian process meta-modeling
• Addressing privacy risks from membership inference attacks without shadow models
• Providing calibrated uncertainty estimates for membership classification across datasets

Innovation

• Uses Gaussian process meta-modeling for membership inference
• Leverages post-hoc metrics from single trained model
• Provides calibrated uncertainty estimates for predictions