Membership Inference Risks in Quantized Models: A Theoretical and Empirical Study

2025-02-10

AI Summary

This work investigates the impact of model quantization on vulnerability to membership inference attacks (MIAs), establishing the first asymptotic theoretical framework for analyzing membership inference security (MIS) of quantized models. We propose a privacy–utility joint evaluation paradigm that integrates information-theoretic bounds with asymptotic statistical inference, yielding an empirically grounded, rankable quantitative MIS assessment method. The approach is validated on synthetic data and systematically applied to eight mainstream quantization schemes in a real-world molecular modeling task, characterizing their privacy–accuracy Pareto frontiers. Contrary to common assumptions, our empirical findings reveal that low-bit quantization does not necessarily exacerbate privacy leakage. Key contributions include: (i) the first theoretical characterization of MIA security for quantized models; (ii) the first privacy–utility co-evaluation framework tailored to quantization strategies; and (iii) an empirically grounded, counterintuitive insight into the quantization–privacy trade-off.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Adversarial Attacks & Robustness
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics

Abstract

Quantizing machine learning models has demonstrated its effectiveness in lowering memory and inference costs while maintaining performance levels comparable to the original models. In this work, we investigate the impact of quantization procedures on the privacy of data-driven models, specifically focusing on their vulnerability to membership inference attacks. We derive an asymptotic theoretical analysis of Membership Inference Security (MIS), characterizing the privacy implications of quantized algorithm weights against the most powerful (and possibly unknown) attacks. Building on these theoretical insights, we propose a novel methodology to empirically assess and rank the privacy levels of various quantization procedures. Using synthetic datasets, we demonstrate the effectiveness of our approach in assessing the MIS of different quantizers. Furthermore, we explore the trade-off between privacy and performance using real-world data and models in the context of molecular modeling.

Problem

• Quantization impact on data privacy
• Membership inference attacks vulnerability
• Trade-off between privacy and performance

Innovation

• Quantization impact on privacy
• Theoretical analysis of Membership Inference
• Empirical assessment of quantization privacy