Targeted sparsity approach blocks membership inference attacks on machine learning models

Over-parameterized neural networks often leak information about their training data, allowing attackers to infer whether a specific sample was included in training—a privacy risk known as membership inference. Existing defenses using weight penalties like L1 regularization apply the same constraint uniformly across all parameters, creating an awkward tradeoff between model accuracy and privacy protection.

The Privacy Vulnerability#

Large models with many parameters are particularly susceptible to membership inference attacks because subtle patterns in the network can reveal training data membership. Standard regularization approaches don't account for the fact that different parameters vary significantly in how much they contribute to this privacy leakage.

How PAST Works#

Researchers at arXiv have introduced Privacy-aware Sparsity Tuning (PAST), which takes a more surgical approach to defense. Rather than penalizing all parameters equally, PAST applies adaptive penalties tailored to each parameter's privacy sensitivity. The method:

• Measures privacy impact by calculating how each parameter influences the loss gap between training members and non-members
• Targets vulnerable parameters by applying stronger sparsity constraints to those that leak the most membership information
• Preserves utility by leaving less privacy-critical parameters largely untouched

This selective pruning encourages the network to suppress parameters that expose membership patterns while maintaining overall model performance.

Results and Implications#

Experimental evaluations show that PAST achieves superior performance in balancing privacy protection and model utility compared to existing defenses. By shrinking the loss gap between members and non-members, the approach makes it substantially harder for attackers to distinguish whether any given sample was part of the training set, while keeping the model's predictive power intact.