Defending Membership Inference Attacks via Privacy-aware Sparsity Tuning

## Abstract

Abstract Over-parameterized models are typically vulnerable to membership inference attacks, which aim to determine whether a specific sample is included in the training of a given model. Previous Weight regularizations (e.g., ℓ 1 subscript ℓ 1 \ell_{1} roman_ℓ start_POSTSUBSCRIPT 1 end_POSTSUBSCRIPT regularization) typically impose uniform penalties on all parameters, leading to a suboptimal tradeoff between model utility and privacy. In this work, we first show that only a small fraction of parameters substantially impact the privacy risk. In light of this, we propose Privacy-aware Sparsity Tuning ( PAST )—a simple fix to the ℓ ⁢ 1 ℓ 1 \ell 1 roman_ℓ 1 Regularization—by employing adaptive penalties to different parameters. Our key idea behind PAST is to promote sparsity in parameters that significantly contribute to privacy leakage.
In particular, we construct the adaptive weight for each parameter based on its privacy sensitivity, i.e., the gradient of the loss gap with respect to the parameter.
Using PAST, the network shrinks the loss gap between members and non-members, leading to strong resistance to privacy attacks. Extensive experiments demonstrate the superiority of PAST, achieving a state-of-the-art balance in the privacy-utility trade-off.

## 1 Introduction

Modern neural networks are trained in an over-parameterized regime where the parameters of the model exceed the size of the training set (Zhang et al., ). While the huge amount of parameters empowers the models to achieve impressive performance across various tasks, the strong capacity also makes them particularly vulnerable to membership inference attacks (MIAs) (Shokri et al., ). In MIAs, attackers aim to detect if a sample is utilized in the training of a target model. Membership inference can cause security and privacy concerns in cases where the target model is trained on sensitive information, like health care (Paul et al., ), financial service (Mahalle et al., ), and DNA sequence analysis (Arshad et al., ). Therefore, it is of great importance to design robust training algorithms for over-parameterized models to defend against MIAs.

The main challenge of protecting against MIAs stems from the extensive number of model parameters, allowing to easily disclose the information of training data (Tan et al., ).
Therefore, previous works reduce the over-complexity of neural networks by weight regularization, like $\ell_{1}$ or $\ell_{2}$ regularization.
These regularization techniques impose uniform penalties on all parameters with large values, reducing the overfitting to the training data.
However, if not all parameters contribute equally to the risk of leaking sensitive information, the uniform penalties can lead to a suboptimal tradeoff between model utility and privacy.
The question is:

Are all parameters equally important in terms of privacy risk?

In this work, we answer this question by an empirical analysis of parameter sensitivity in terms of privacy risk. In particular, we take the loss gap between member and non-member examples as a proxy for privacy risk and compute its gradient with respect to each model parameter. We find that only a small fraction of parameters substantially impact the privacy risk, whereas the majority have little effect. Thus, applying uniform penalties to all parameters is inefficient to defend against MIAs and may unnecessarily restrict the model’s capacity.

To address this issue, we propose Privacy-Aware Sparsity Tuning (PAST), a simple fix to $\ell_{1}$ regularization that employs adaptive penalties to different parameters in a deep neural network. The key idea behind PAST is to promote sparsity in parameters that significantly contribute to privacy leakage. In particular, we modulate the intensity of $\ell_{1}$ regularization for model parameters based on their privacy sensitivity, i.e., the gradient of the loss gap with respect to the parameters. In effect, our method not only stringently regularizes sensitive parameters, but also maintains the model utility by sparing less sensitive parameters from excessive regularization. Trained with the proposed regularization, the network shrinks the loss gap between members and non-members, leading to strong resistance to privacy attacks.

To verify the effectiveness of our method, we conduct extensive evaluations on five datasets, including Texas100  (Texas Department of State Health Services, ), Purchase100 (Kaggle, ), CIFAR-10/100 (Krizhevsky et al., ), and ImageNet (Russakovsky et al., ) datasets. The results demonstrate our methods can improve utility-privacy trade-offs across a variety of attacks based on neural networks, metrics, and data augmentation. For example, our method significantly diminishes the attack advantage of loss attack from 14.8% to 5.2% - a relative reduction of 64.9% in privacy risk, whilst preserving the test accuracy.

Our contributions are summarized as follows:

- •
We empirically analyze the importance of model parameters in privacy risk. We show that only a few parameters substantially impact the privacy risk, whereas the majority have little effect. This suggests that the MIA defense can focus on a few important parameters.
- •
We introduce PAST – a simple and effective regularization method, which promotes sparsity in parameters that significantly contribute to privacy leakage. We show that PAST can effectively improve the utility-privacy trade-offs across a variety of attacks.
- •
We perform ablation studies that lead to an improved understanding of our method. In particular, we contrast with alternative methods (e.g., $\ell 1$ or $\ell 2$ regularization) and demonstrate the advantages of PAST. We hope that our insights inspire future research to further explore weight regularization for MIA defense.

## 2 Preliminaries

### 2.1 Background

#### Setup

In this paper, we study the problem of membership inference attacks in $K$-class classification tasks. Let the feature space be $\mathcal{X}\subset\mathbb{R}^{d}$ and the label space be $\mathcal{Y}=\{1,\dots,K\}$.
Let us denote by $(\bm{x},y)\in(\mathcal{X}\times\mathcal{Y})$ an example containing an instance $\bm{x}$ and a real-valued label $y$.
Given a training dataset $\mathcal{S}=\{(\bm{x_{n}},y_{n})\}_{i=1}^{N}$ i.i.d. sampled from the data distribution $\mathcal{P}$, our goal is to learn a model $h_{\theta}$ with trainable parameters $\theta\in\mathbb{R}^{p}$, that minimizes the following expected risk:

$$ $\displaystyle\mathbb{R}(h_{\theta})=\mathbb{E}_{(\bm{x},y)\sim\mathcal{P}}[ \mathcal{L}(h_{\theta}(\bm{x}),y)]$ (1) $$

where $\mathbb{E}_{(\bm{x},y)\sim\mathcal{P}}$ denotes the expectation over the data distribution $\mathcal{P}$ and $\mathcal{L}$ is a conventional loss function (such as cross-entropy loss) for classification. In modern deep learning, the neural network $h_{\theta}$ is typically over-parameterized, allowing to easily disclose the information of training data (Tan et al., ).

#### Membership Inference Attacks

Given a data point $(\bm{x},y)$ and a trained target model $h_{\mathcal{S}}$, attackers aim to identify if $(\bm{x},y)$ is one of the members in the training set $\mathcal{S}$, which is called membership inference attacks (MIAs)  (Shokri et al., ; Yeom et al., ; Salem et al., ). In MIAs, it is generally assumed that attackers can query the model predictions $h_{\theta}(\bm{x})$ for any instance $\bm{x}$. Here, we focus on standard black-box attacks (Irolla & Châtel, ), where attackers can access the knowledge of model architecture and the data distribution $\mathcal{P}$.

In the process of attack, the attacker has access to a query set $Q=\{(\bm{z}_{i},m_{i})\}_{i=1}^{J}$, where $\bm{z}_{i}$ denotes the $i$-th data point $(\bm{x}_{i},y_{i})$ and $m_{i}$ is the membership attribute of the given data point $(\bm{x}_{i},y_{i})$ in the training dataset $\mathcal{S}$, i.e., $m_{i}=\mathbb{I}[(\bm{x}_{i},y_{i})\in\mathcal{S}]$. In particular, the query set $Q$ contains both member (training) and non-member samples, drawn from the data distribution $\mathcal{P}$. Then, the attacker $\mathcal{A}$ can be formulated as a binary classifier, which predicts $m_{i}\in\{0,1\}$ for a given example $(\bm{x}_{i},y_{i})$ and a target model $h_{\theta}$: $\mathcal{A}(\bm{x}_{i},y_{i};h_{\theta})\rightarrow\{0,1\}$.

#### Weight regularization

The privacy risk of deep neural networks is often associated with their over-parameterized nature.
Intuitively, the huge amount of parameters enables the model to encapsulate extensive information of the training data, potentially leading to unintended privacy leakages.
Previous work shows theoretically that increasing the number of model parameters renders them more vulnerable to membership inference attacks (Tan et al., ).
To address this issue, weight regularization is typically employed to alleviate the membership inference, such as $\ell_{1}$ and $\ell_{2}$ regularizations (Hoerl & Kennard, ; Tibshirani, ; Schmidt et al., ). Formally, the weight regularization can be formalized as:

$$ $\displaystyle\mathbb{R}_{\mathrm{reg}}(h_{\theta})=\mathbb{E}_{(\bm{x},y)\sim \mathcal{P}}[\mathcal{L}(h_{\theta}(\bm{x}),y)]+\lambda R(h_{\theta})$ (2) $$

where $\mathcal{L}(\cdot)$ denotes the classification loss, $\lambda$ is the hyperparameter that controls the importance of the regularization term, and $R(\theta)$ is typically chosen to impose a penalty on the complexity of $h_{\theta}$.
For example, $\ell_{1}$ and $\ell_{2}$ regularizations penalize the norm of model parameters as follows: $R(h_{\theta})=\|\theta\|^{r}_{r}$, where $r$ denotes the order of the norm.

Previous work (Tan et al., ) shows that one can reduce vulnerability to MIAs by reducing the number of effective parameters, such as utilizing the sparsification effect of $\ell_{1}$ regularization. However, this comes at the cost of inferior generalization performance (utility) due to the “double descent” effect (Belkin et al., ; ; Dar et al., ), wherein generalization error decreases with increased overparameterization. This challenge stems from the uniform penalty applied to all parameters, ignoring their potentially varying importance in terms of privacy leakage.

Figure: (a) Loss gap & privacy
Refer to caption: x1.png

## 3 Method: Privacy-Aware Sparsity Tuning

In this section, we start by analyzing the privacy sensitivity of model parameters and find that most parameters contribute only marginally to the privacy risk. Subsequently, we design a weighted $\ell_{1}$ regularization that takes into account the privacy sensitivity of each parameter.

### 3.1 Motivation

In this part, we aim to figure out whether the model parameters are equally important in terms of privacy risk. In particular, we perform standard training with ResNet-18 (He et al., ) on CIFAR-10 (Krizhevsky et al., ). We train the models using SGD with a momentum of 0.9, a weight decay of 0.0005, and a batch size of 128. We set the initial learning rate to 0.01 and decrease it using a cosine scheduler (Loshchilov & Hutter, ) throughout the training. In the analysis, we construct the datasets of members $\mathcal{S}_{m}$ and nonmembers $\mathcal{S}_{n}$ by randomly sampling two subsets with 10000 examples each from the training set and the test set, respectively.

#### Loss gaps as proxy of privacy risk

In this study, we use the loss gap between member and non-member examples as a proxy for privacy risk: $\mathcal{G}(\mathcal{S}_{m},\mathcal{S}_{n};h_{\theta})=\left|\frac{1}{|
\mathcal{S}_{m}|}\sum_{(\bm{x},y)\in\mathcal{S}_{m}}\mathcal{L}(h_{\theta}(\bm
{x}),y)-\frac{1}{|\mathcal{S}_{n}|}\sum_{(\bm{x},y)\in\mathcal{S}_{n}}\mathcal
{L}(h_{\theta}(\bm{x}),y)\right|$. Specifically, we calculate the difference between the average losses of members and non-members. A larger loss gap indicates a higher privacy risk, as it suggests the model is more susceptible to membership inference attacks (MIAs). It has been shown that the loss function can determine the optimal attacks in membership inference  (Sablayrolles et al., ). As demonstrated in Figure 1(a), the model training increases both the attack advantage (See the definition in Section 4.1) and the loss gap simultaneously, supporting the use of the loss gap as a proxy for the privacy risk.

#### Most parameters contribute only marginally to the privacy risk

We measure the privacy sensitivity of a parameter $\theta_{i}$ by the gradient of the loss gap with respect to the parameter: $\nabla_{\theta_{i}}(\mathcal{G}(\mathcal{S}_{m},\mathcal{S}_{n};h_{\theta}))$.
Figure 1(b) illustrates the privacy sensitivity distribution of model parameters.
The results show that only a small fraction of parameters substantially impact the privacy risk, whereas the majority have little effect.
For example, 97$\%$ of the parameters have privacy sensitivities lower than 0.1.
The cumulative sensitivity in the top 20% parameters exceeds 89.27% of the total.
These findings suggest that applying uniform penalties to all parameters is inefficient to defend against MIAs and may unnecessarily restrict the model’s capacity.
Instead, the weight regularization can be more efficiently applied by focusing on the most sensitive parameters rather than the entire parameter set.
We proceed by introducing our method, targeting this problem.

### 3.2 Method

In the previous analysis, we demonstrate that the privacy risk can be alleviated by reducing the number of effective parameters with weight regularization techniques. Moreover, we show that most parameters contribute only marginally to the privacy risk, suggesting that the weight regularization can be focused on the most sensitive parameters. Thus, our key idea is to promote sparsity specifically within the subset of parameters that significantly contribute to privacy leakage.

#### Privacy-Aware Sparsity Tuning

In this work, we introduce Privacy-Aware Sparsity Tuning (dubbed PAST), a simple fix to $\ell_{1}$ regularization that employs adaptive penalties to different parameters in a deep neural network. Formally, the objective function of PAST is given by:

$$ $\displaystyle\mathbb{R}_{\mathrm{PAST}}(h_{\theta})$ $\displaystyle=\mathbb{E}_{(\bm{x},y)\sim\mathcal{P}}[\mathcal{L}(h_{\theta}( \bm{x}),y)]+\lambda R(h_{\theta})$ (3) $\displaystyle=\mathbb{E}_{(\bm{x},y)\sim\mathcal{P}}[\mathcal{L}(h_{\theta}( \bm{x}),y)]+\lambda\sum_{i}\gamma_{i}|\theta_{i}|$ $$

where $\lambda$ is the hyperparameter that controls the importance of the regularization term and $\gamma_{i}$ denotes the adaptive weight of the parameter $\theta_{i}$. We expect larger weights for those parameters with higher privacy sensitivity, and smaller weights for those with lower sensitivity. Using the $\ell_{1}$ norm, the regularization can encourage those sensitive parameters to be zero, thereby improving the defense performance against MIAs.

In particular, we modulate the intensity of $\ell_{1}$ regularization for model parameters based on their privacy sensitivity, i.e., the gradient of the loss gap with respect to the parameters.
Let $\mathcal{S}_{m}$ and $\mathcal{S}_{n}$ denote the subsets of members and non-members, respectively.
For notation shorthand, we use $\mathcal{G}_{\theta}$ to denote the loss gap $\mathcal{G}(\mathcal{S}_{m},\mathcal{S}_{n};h_{\theta})$ of the model $h_{\theta}$ on $\mathcal{S}_{m}$ and $\mathcal{S}_{n}$.
Then, we compute the normalized privacy sensitivity of each parameter $\theta_{i}$ in its associated module (e.g., linear layer):

$$ $\gamma_{i}=\frac{|\mathcal{M}(\theta_{i})|\nabla_{\theta_{i}}\widetilde{ \mathcal{G}}_{\theta}}{\sum_{\theta_{j}\in\mathcal{M}(\theta_{i})}\nabla_{ \theta_{j}}\widetilde{\mathcal{G}}_{\theta}},$ $$

where $\mathcal{M}(\theta_{i})$ denotes the associated module of the parameter $\theta_{i}$.
Equipped with the adaptive weight, the final regularization of PAST is :

$$ $R(h_{\theta})=\sum_{i}\gamma_{i}^{\alpha}|\theta_{i}|,$ (4) $$

where $\alpha$ is the focusing parameter that adjusts the rate at which sensitive parameters are up-weighted. When $\alpha=0$, the regularization is equivalent to the standard $\ell_{1}$ regularization. As $\alpha$ increases, the regularization puts more focus on the few parameters with high privacy sensitivity. The adaptive weight enables to relax the penalties for insensitive parameters while imposing stricter penalties on sensitive parameters. Note that the $\gamma_{i}$ does not require a gradient in backpropagation, so it is detached from the computational graph, leading to efficient implementation of PAST.

#### Implementation of tuning

Standard $\ell_{1}$ regularization is usually employed from the beginning of model training to alleviate the overfitting. This makes it challenging to achieve a good tradeoff between privacy and utility, as a strict regularization degrades the model’s capacity for generalization. Instead, we propose to employ the regularization after the model convergence in the training with the classification loss. In particular, we first train the model using the loss (Equation (3)) with $\lambda=0$ until convergence. Then, we increase the value of $\lambda$ to tune the model with the regularized loss. The tuning mechanism allows our method to be compatible with trained models, instead of requiring retraining from scratch.

By applying our method during tuning, we not only stringently regularize sensitive parameters but also preserve model utility by sparing less sensitive parameters from excessive regularization. Specifically, Figures 2(a) and 2(b) confirm the effectiveness of our method in mitigating over-parameterization both intuitively and quantitatively: after PAST tuning, more parameters are concentrated around 0 in the weight distribution, and the Gini index—a measure of sparsity—also significantly decreases. Figure 2(c) further illustrates the impact of our tuning on the loss gap, which sharply declines after the beginning of tuning at epoch 100, demonstrating the method’s ability to quickly reduce the loss gap and enhance resistance to privacy attacks.

Figure: (a) Weight Distribution
Refer to caption: x3.png

## 4 Experiments

### 4.1 Setup

#### Datasets

In our evaluation, we employ five datasets: Texas100 (Texas Department of State Health Services, ), Purchase100 (Kaggle, ), CIFAR-10, CIFAR-100 (Krizhevsky et al., ), and ImageNet (Russakovsky et al., ). We split each dataset into six subsets, with each subset alternately serving as the training, testing, or inference set for the target and shadow models. The inference set was used by our method and adversarial training algorithms that incorporate adversary loss—such as Mixup+MMD (Li et al., ) and adversarial regularization (Nasr et al., ). In our method, the inference set was used to obtain the comparison information between members and non-members. For other methods, the inference set is specifically utilized to generate adversary loss.

#### Training details

We train the models using SGD with a momentum of 0.9, a weight decay of 0.0005, and a batch size of 128. We set the initial learning rate to 0.01 and drop it using a cosine scheduler (Loshchilov & Hutter, ) with $T_{max}=epochs$. For CIFAR-10, we conduct training using an 18-layer ResNet (He et al., ), with 100 epochs of standard training and 50 epochs of sparse tuning. In the case of ImageNet and CIFAR-100, we employ a 121-layer DenseNet (Huang et al., ) with 100 epochs of standard training and 20 epochs of sparse tuning. For Texas100 and Purchase100, training is performed using MLPs as described in previous studies (Nasr et al., ; Jia et al., ), with 100 epochs of standard training and 20 epochs of sparse tuning.

#### Hyperparameter Tuning

In our approach to hyperparameter tuning, we align with the protocols established by previous work (Chen et al., ). In particular, we employ hyperparameter tuning focused on a single hyperparameter, $\alpha$ defined in Equation (4). Through a detailed grid search on a validation set, we adjust $\alpha$ to achieve an optimal balance. This process involves evaluating the privacy-utility implications at various levels of $\alpha$ and then selecting the value that aligns with our specific privacy/utility objectives, thereby enabling precise management of the model’s privacy and utility. For the overall regularization strength $\lambda$ in Equation (3), we fix it to different values based on the dataset. Specifically, for CIFAR-10, the scale factor is 0.001; for CIFAR-100, it is 0.0001. For other datasets, we set it as 1e-05.

Figure: Figure 3: Comparisons of five defense mechanisms on CIFAR-10 dataset utilizing Resnet18 architecture. Each subplot is allocated to a distinct attack method, wherein individual curves represent the performance of a defense mechanism under different hyperparameter settings. The horizontal axis represents the target models’ test accuracy (the higher the better), and the vertical axis represents the corresponding attack advantage (defined in Definition 4.1, the lower the better). To underscore the disparity between the defense methods and the vanilla (undefended model), we plot the dotted line originating from the vanilla results.
Refer to caption: x6.png

#### Attack models

In our study, we experiment with three classes of MIA: (1) Neural Network-based Attack (NN) (Shokri et al., ; Hu et al., ), which leverages the full logits prediction as input for attacking the neural network model. (2) Metric-based Attack, employing specific metric computations followed by a comparison with a preset threshold to ascertain the data record’s membership. The metrics we chose for our experiments include Correctness (Correct), Loss (Yeom et al., ), Confidence, Entropy (Salem et al., ), and Modified-Entropy (M-entropy) (Song & Mittal, ). (3) Augmentation-based Attack (Choquette-Choo et al., ), utilizing prediction data derived through data augmentation techniques as inputs for a binary classifier model. In this category, we specifically implemented rotation and translation augmentations.

For the details of the attack, we assume the most powerful black-box adaptive attack scenario: the adversary has complete knowledge of our defense mechanism and selected hyperparameters. To implement this, we train shadow models with the same settings used for our target models.

#### Defense baselines

We compare PAST with eight defense methods: RelaxLoss (Chen et al., ), Mixup+MMD (Li et al., ), Adversarial Regularization (AdvReg) (Nasr et al., ), Dropout Srivastava et al. (), Label Smoothing Guo et al. (), Confidence Penalty Pereyra et al. (), $\ell 1$ regularization and $\ell 2$ regularization (Shokri et al., ), .

#### Evaluation metrics

To comprehensively assess our method’s impact on privacy and utility, we employ three evaluation metrics that encapsulate utility, privacy, and the balance between the two. Utility is gauged by the test accuracy of the target model. Privacy is measured through the attack advantage (Yeom et al., ):

$$ $\displaystyle\mathit{Adv}(\mathcal{A})$ $\displaystyle:=\operatorname{Pr}(\mathcal{A}(h_{\mathcal{S}}(\bm{x}),y)=1|m=1)$ $\displaystyle\quad-\operatorname{Pr}(\mathcal{A}(h_{\mathcal{S}}(\bm{x}),y)=1| m=0)$ (5) $\displaystyle=2\operatorname{Pr}(\mathcal{A}(h_{\mathcal{S}}(\bm{x}),y)=m)-1$ $$

where the notations are defined in Section 2.1.
To assess the trade-off between utility and privacy, we utilize the $P_{1}$ score (Paul et al., ), which is defined as:

$$ $\displaystyle P_{1}=2\times\frac{\text{Acc}\times(1-\text{Adv})}{\text{Acc}+(1 -\text{Adv})}$ (6) $$

where Acc denotes test accuracy and Adv denotes attack advantage on the target model.

### 4.2 Results

Figure: Figure 4: Comparisons of seven defense mechanisms on CIFAR-100 dataset utilizing Densenet121 architecture. Each subplot is allocated to a distinct attack method, wherein individual curves represent the performance of a defense mechanism under different hyperparameter settings. The horizontal axis represents the target models’ test accuracy (the higher the better), and the vertical axis represents the corresponding attack advantage (defined in Definition 4.1, the lower the better). To underscore the disparity between the defense methods and the vanilla (undefended model), we plot the dotted line originating from the vanilla results.
Refer to caption: x7.png

#### Can PAST improve privacy-utility trade-off ?

In Figure 3 and Figure 4, we plot privacy-utility curves to show the privacy-utility trade-off. The horizontal axis represents the performance of the target model, and the vertical axis represents the attack advantage defined in Equation (4.1).
A salient observation is that our method drastically improves the privacy-utility trade-off. In particular, for these points that perform better than vanilla for utility (the area to the right of the dotted line), the privacy-utility curves of our methods are always below those of others. This means we can always obtain the highest privacy for any utility requirement higher than the undefended model.
For example, on the CIFAR10, we focus on the hyperparameter $\alpha$ corresponding to the model with the lowest attack advantage with the constrain condition that test accuracy is better than vanilla, then our method with adaptive regularization can decrease the attack advantage of loss-metric-based from 14.8% to 5.2% compared with MixupMMD (the most powerful defense under our condition above).

#### Is PAST effective with different datasets?

To ascertain the efficacy of our proposed method across heterogeneous data, we have executed a series of experiments on a diverse array of datasets, encompassing tabular and image datasets. For results shown in Table 1, we have set the adjustment $\alpha$ of PAST to a constant value, specifically $\alpha=2.5$. To assess the privacy-utility balanced performance, we use the highest attack advantage of all attack methods to calculate the P1 score
From the results, we observe that both of our methods yield a consistent improvement in the P1 score.

#### How does α 𝛼 \alpha italic_α affect utility and privacy?

In Figure 6(a), we conduct an ablation study to examine the impact of the coefficient $\alpha$ in our method on both utility and privacy (and the effect on loss gap is reported and analyzed in Appendix C). The analysis is based on CIFAR-100. As is shown in Figure 6(a), our findings are in alignment with the insights provided in Section 3.2. As the $\alpha$ decreases, the effect of the loss gap becomes less significant, leading to a gradual decrease in adaptation strength. On the other hand, a smaller $\alpha$ value brings our loss function closer to the conventional regularization, thereby increasing the privacy risk. Conversely, A larger $\alpha$ leads to stronger regularization on sensitive parameters, culminating in underfitting, which consequently diminishes accuracy.

#### What’s the difference between PAST and ℓ ⁢ 1 / ℓ ⁢ 2 ℓ 1 ℓ 2 \ell 1/\ell 2 roman_ℓ 1 / roman_ℓ 2 regularization?

We compare our method with $\ell 1/\ell 2$ regularization on CIFAR-100 (by fixing the adaptive weight $\gamma_{i}$ in Equation (3) to a constant ), and present the results in Figure 5(a). Specifically, we used four combinations during tuning: $\ell 1$ regularization (L1), $\ell 1$ regularization + adaptive weight (L1+Ours), $\ell 2$ regularization (L2), and $\ell 2$ regularization + adaptive weight (L2+Ours). For the $\ell 1/\ell 2$ regularization, we adjust the regularization weight $\lambda$ to achieve the desired utility-privacy trade-off. Dots of each color in Figure 5(a) represent the performance of a tuning mechanism under different hyperparameter settings. As observed, PAST (L1+Ours) outperformed the others. This demonstrates the importance of incorporating adaptive regularization weights in achieving robust defense against MIAs.

**Table 1: P1 score (Equation (6)) evaluated on target models trained on different datasets. The bold indicates the best results. Here, “w/o” denotes undefended models.**
| Datasets | Texas | Purchase | CIFAR-10 | CIFAR-100 | ImageNet |
| --- | --- | --- | --- | --- | --- |
| PAST | 0.572 | 0.812 | 0.784 | 0.575 | 0.438 |
| w/o | 0.557 | 0.792 | 0.638 | 0.360 | 0.350 |

Figure: (a) Ablation from $\ell 1/\ell 2$
Refer to caption: x8.png

#### How does λ 𝜆 \lambda italic_λ affect PAST?

$\lambda$ in Equation (4) represents a base level of regularization applied to all weights, similar to the influence in $\ell 1$ regularization. We fixed $\lambda$ at different values ({0.0001, 0.0005, 0.001, 0.002}) on CIFAR-10 and adjusted alpha to plot a utility-privacy curve for each $\lambda$ (In Figure 5(b)). Within a certain range ($\lambda=0.0005,0.001$ here), the trade-off curve remains stable; however, when $\lambda$ is too large, the trade-off cannot achieve high utility (e.g., $\lambda=0.002$ here). On the other hand, when $\lambda$ is too small, the overall regularization strength is too weak, resulting in an effect closer to the base, which leads to higher privacy leakage (e.g., $\lambda=0.0001$ here)

#### How does the number of tuning epochs affect PAST?

We evaluated the impact of different sparse training epochs on the utility-privacy trade-off (the effect on loss gap is reported and analyzed in Appendix C). Specifically, we conducted experiments on CIFAR-10, varying the number of epochs across $\{5,10,\cdots,75\}$. The curves of test accuracy and attack advantage over epochs are plotted in Figure 6(b), with the dotted line representing attack advantage and the solid line representing test accuracy. As the number of epochs increases, the advantage stabilizes at an optimal level after 20 epochs, and the classification accuracy gradually improves, peaking at around 50 epochs. Overall, it shows that few epochs are sufficient to achieve reasonable performance, and more epochs lead to more stable outcomes.

**Table 2: P1 score (defined in Equation (6)) evaluated on target models tuned on defended models. The bold indicates the best results. Here, “w/o” denotes the original defended model by other methods. PAST consistently achieves higher P1 scores compared to the original defended methods**
| Pretrain Defense | AdvReg | CCL | LabelSmoothing | MixupMMD | RelaxLoss |
| --- | --- | --- | --- | --- | --- |
| PAST | 0.784 | 0.806 | 0.808 | 0.825 | 0.808 |
| w/o PAST | 0.720 | 0.657 | 0.674 | 0.755 | 0.744 |

Figure: (a) Ablation on $\alpha$
Refer to caption: x10.png

#### Combined with other defenses

As mentioned in Section 3.2, our method is applied during the fine-tuning phase, as the loss gap can more accurately reflect member information in a roughly converged model. Due to this characteristic, our approach is independent of other defense methods applied during the pre-training phase and can be used on top of existing defenses. We conducted experiments with various defense methods on CIFAR-10 using ResNet18 (50 epochs sparse training with $\alpha=1.5$). As shown in Table 2, after PAST, the model consistently achieves higher P1 scores compared to the original defense methods.

#### Time consumption

The time consumption of PAST is comparable to standard training, since it introduces no additional processes (it only requires an extra gradient backpropagation during each tuning epoch to obtain the gradients for non-members). We report the time consumption of various defense methods in Figure 6(c) (time was recorded for DenseNet121 on CIFAR-100 using a single RTX 4090 GPU.), where our method takes $1374$ seconds, and the standard training (base) takes $1245$ seconds. Our approach increases the time consumption of standard training by only 10.4%.

## 5 Related work

#### Overparameterization in generalization and privacy

Overparameterization, where models have significantly more parameters than training examples, has been shown to have a complex relationship with generalization and privacy. While traditional theories suggest that overparameterization increases overfitting and generalization error, recent research reveals that it can sometimes reduce error under certain conditions, such as in high-dimensional ridgeless least squares problems (Belkin et al., ). This phenomenon, known as “double descent”, suggests that beyond a critical point, increasing model complexity may lead to better generalization (Belkin et al., ; Dar et al., ; Hastie et al., ). However, from a privacy perspective, overparameterization has been empirically proven to increase vulnerability to membership inference attacks (MIAs) (Leemann et al., ; Dionysiou & Athanasopoulos, ). Large language models, in particular, are susceptible to these attacks, with attackers able to extract sensitive training data (Carlini et al., ; Mireshghallah et al., ). Theoretical evidence also indicates that there is a clear parameter-privacy trade-off, where an increase in the number of parameters amplifies the privacy risks by enhancing model memorization (Yeom et al., ; Tan et al., ). Consequently, while overparameterization can sometimes improve generalization, its impact on privacy remains a significant concern, especially in the context of MIAs.

#### Overparameterization in MIA defenses

To mitigate the privacy risks associated with overparameterization, several defense mechanisms have been proposed. One effective approach is network pruning, where unnecessary parameters are removed to reduce model complexity. Research shows that pruning not only preserves utility but also significantly reduces the risk of privacy leakage, in scenarios including MIA (Huang et al., ; Wang et al., ) and Unlearning (Hooker et al., ; Wang et al., ; Ye et al., ; Liu et al., ). Additionally, techniques combining pruning with federated unlearning have demonstrated effectiveness in protecting privacy by selectively forgetting specific data during the training process (Wang et al., ). Regularization methods, such as $\ell 2$ regularization (Kaya et al., ), sparsification (Bagmar et al., ) and dropout (Galinkin, ), also play a critical role in defending against MIAs by discouraging the model from overfitting to training data. Interestingly, while overparameterization generally increases privacy risks, when paired with appropriate regularization, it can maintain both utility and privacy (Tan et al., ). Furthermore, studies indicate that initialization strategies and ensemble methods can further alleviate privacy risks on over-parameterized model (Rezaei et al., ; Ye et al., ). These techniques illustrate that even in overparameterized models, privacy risks can be mitigated through careful design, preserving the balance between utility and privacy.

## 6 Conclusion

In this paper, we introduce Privacy-aware Sparsity Tuning (PAST), a novel approach to mitigating membership inference attacks (MIAs) by adaptively regularizing model parameters based on the loss gap between member and non-member data. By promoting sparsity in parameters with large privacy sensitivity, the model shrinks the loss gap between members and non-members, leading to strong resistance to privacy attacks. Extensive experiments demonstrate that PAST effectively balances privacy and utility, providing state-of-the-art performance in the privacy-utility trade-off. This method is straightforward to implement with existing deep learning frameworks and requires minimal modifications to the training scheme. We hope that our insights into Privacy-aware regularization inspire further research to explore parameter regularization techniques for enhancing privacy in machine learning models.

#### Limitations

In this work, we focus on the popular black-box setting, where attackers can access the model outputs. So, the effectiveness of our method in defending against other types of MIAs (such as label-only attacks, white-box attacks) remains unexplored. Moreover, while our method can improve the MIA defense with high predictive performance, our method cannot fully break the trade-off between utility and MIA defense, which might be a potential direction for future work.

## Appendix A Full Ablation Result for PAST

Here in Figure 7, we present the detailed results of ablation study (fixed/ours adaptive weights and $\ell 1/\ell 2$ regularizations). under different attack methods on CIFAR-100 (in the main text, only the average performance across various attack methods is shown due to layout constraints). It can be observed that the performance varies under different attack methods, but the overall utility-privacy trade-off of PAST evidently surpasses others.

Figure: Figure 7: Utility-privacy trade-offs of different epochs on CIFAR-10. Each subplot is allocated to a distinct attack method, wherein individual curves represent the performance of a defense mechanism under different hyperparameter settings. The horizontal axis represents the target models’ test accuracy (the higher the better), and the vertical axis represents the corresponding attack advantage (defined in Definition 4.1, the lower the better). To underscore the disparity between the defense methods and the vanilla (undefended model), we plot the dotted line originating from the vanilla results.
Refer to caption: x13.png

## Appendix B Difference from optimizing to loss gap

Figure: Figure 8: The utility-privacy trade-offs of Ours and LossGap (directly optimizing member-nonmember loss gap), “infer” refer to the privacy leakage of inference set
Refer to caption: x14.png

In this section, we compare the differences between PAST and directly optimizing the loss gap. We use the loss gap between members and non-members directly as a regularization term and add it to the loss function. The utility-privacy trade-off curves are shown in Figure 8, where our method (Ours) clearly outperforms the direct optimization of the loss gap (LossGap). Additionally, we point out that directly optimizing the loss gap leads to privacy leakage in the inference set (as shown by LossGap (infer) in the figure), whereas our method does not (as shown by Ours (infer) in the figure).

## Appendix C Loss Gap for different Epochs/Alphas

In the main text, the ablation on tuning the epoch and alpha only reports the changes in utility (test accuracy) and privacy (attack advantage). Here, we supplement with the changes in the privacy proxy loss gap as alpha (in Figure 10(a)) and epoch (in Figure 10(b)) varies, showing that the results here are consistent with the insights provided in Section 3.2.

Figure: Figure 9: Variation of privacy sensitivity for each module in PAST
Refer to caption: x15.png

Figure: (a) Loss gap vs. alpha
Refer to caption: x16.png

## Appendix D For which layers and modules are more effective?

As an example, we illustrate the average grad-gap dynamics during the PAST process across different modules of the ResNet18 model in Figure 9. It can be observed that the deeper layers are more effective than the earlier ones, and batch normalization (BN) and linear layers contribute more significantly than convolutional layers. Notably, the loss gap of all convolutional layers in the third and fourth blocks almost stabilizes at zero.

## Peer Reviews

confidence: 4
contribution: 4
initial_rating: 8
presentation: 4
questions: * How does privacy sensitivity distribution (Fig. 1b) changes throughout PAST training? Similar to the privacy onion effect ([Carlini et al., 2022](https://arxiv.org/abs/2206.10469)), do you think the privacy could "migrate" from parameters you heavily regularize to other parameters?
* Can you clarify the computational aspects of the regularization process?
	* How do you compute $\gamma_i$ in (3)? Do you run an additional forward pass for non-members $\mathcal{S}_n$? If so, an increase of only 10% on the training time is a bit surprising, since you're effectively doubling the size of a batch, and run both forward and backward pass on it.
	* In the equations for $\gamma_i$ does $\nabla_{\theta_i} \tilde{\mathcal{G}_\theta}$ refer to the gradient norm?
* To clarify the experimental setup (4.1, Datasets). Do you use different non-member sets for PAST training and MIA evaluations?
soundness: 3
strengths: I believe it is a very strong paper. It combines an interesting and novel observation (privacy sensitivity is distributed unevenly across model parameters) with a simple yet effective method to utilise this observation to solve a concrete and well-known problem of defending against MIAs. The empirical evidence is also thorough and convincing.

* The paper uses clever technique - computing gradient of the loss gap - to estimate each individual parameter's contribution to the privacy risk. It yields an interesting and novel quantification of per-parameter risk, and shows that only a few parameters need to be regularized to mitigate a privacy risk
* The proposed method (PAST) is a simple yet effective adaptation of L1 regularization, making it easy to implement in practice. Additionally, authors shown computational overhead of adopting PAST to be low compared to the overall training cost.
* The evaluation setup is appropriate and convincing. Specifically, Figures 3 and 4 show the trade-off between attack advantage and model accuracy - which is probably the best way to assess and visualise risks associated with an MIA. Evaluations cover a wide range of MIAs and MIA defences.
* The results show PAST method to be strictly better than other MIA defences and regularization methods in improving privacy-utility trade-off.
summary: The paper introduces Privacy-aware Sparsity Tuning (PAST), a defense mechanism against membership inference attacks (MIAs). The method relies on a key observation that only a small fraction of model parameters significantly contribute to privacy risk, measured by the loss gap between member and non-member data. PAST modifies traditional L1 regularization by applying adaptive penalties to different parameters based on their *privacy sensitivity* - how much they contribute to the member/non-member loss gap. Parameters with higher privacy sensitivity receive stronger regularization, while less sensitive parameters are spared to maintain model utility. The method is implemented as a simple fine-tuning phase after regular training. Authors perform extensive experiments on multiple datasets (Texas100, Purchase100, CIFAR-10/100, ImageNet) and various attack methods. PAST demonstrates superior privacy-utility trade-offs compared to existing defenses, while preserving accuracy. The method is also compatible with and can enhance other existing MIA defenses.
weaknesses: As far as I can see, authors do not consider SOTA shadow-model based attacks like LiRA ([Carlini et al., 2022](https://arxiv.org/abs/2112.03570)) and Attack R ([Ye et al., 2022](https://arxiv.org/abs/2111.09679)). It would be important to understand whether their findings hold for a strong MIA adversary capable of trainings shadow models.

---

confidence: 5
contribution: 1
initial_rating: 3
presentation: 3
questions: How would you expect the trade-off between privacy and utility after adopting new evaluation metric and MIAs?
soundness: 2
strengths: The authors perform a through analysis on the distribution of model parameters and its effects on privacy attacks. It is expected to see that only a small portion of parameters contribute to the privacy  leakage. The following sparsity technique also makes sense.
summary: This paper aims to defend against membership inference attack using sparsity tuning.

The basis intuition is that not all model parameters are equally sensitive in terms of privacy, by empirical analysis the authors found that only a small fraction of parameters are responsible for privacy leakage.   The main idea of mitigation strategy is to prompt sparsity in the model parameter, with the aim of balancing both utility and privacy. Consequently, the sparsity regularization encourages the sensitive parameters to become small, thereby decreasing vulnerability to MIAs.
weaknesses: While I agree that in general the average loss of members and non-members are different, shrinking  this gap with  the proposed sparsity technique can be effective to those loss-based (or related) MIAs. But it may not be able to defense against  other more advanced state of the art MIAs. Here are my two main concerns:

1. The evaluation metric for privacy is out of dated, this metric has been criticized in many recent MIAs 
[R1] D. Hintersdorf, L. Struppek, and K. Kersting, “To trust or not to trust prediction scores for membership inference attacks,” in IJCAI, 2022
[R2] S. Rezaei and X. Liu, “On the difficulty of membership inference attacks,” in IEEE Conf. Comput. Vis. Pattern Recog. (CVPR), 2021
[R3] N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and  F. Tram `er, “Membership inference attacks from first principles,” in IEEE Symposium on Security and Privacy (S&P). IEEE, 2022

I suggest the authors to test the performance using TPR at low FPR rates for assessing the privacy risks.

2. The evaluated MIAs are also out of dated, most of them are metric based MIAs. Their performances are very close to each other and more importantly, these attacks often produce misleading results, which have been extensively explored in 
[R4] Li, Xiao, et al. "On the privacy effect of data enhancement via the lens of memorization." IEEE Transactions on Information Forensics and Security (2024).
[R5] Aerni, Michael, Jie Zhang, and Florian Tramèr. "Evaluations of Machine Learning Privacy Defenses are Misleading." arXiv preprint arXiv:2404.17399 (2024).

I suggest the authors to adopt more state of the art MIAs for example LiRA [R6]  and 
RMIA [R7] because there are shown to be effective in the TPR at low FPR regions. More importantly, the results of these attacks, particularly LiRA, align consistently with the definition of privacy risk, as well as with the concepts of differential privacy and memorization degree [R4, R5]. This contrasts with the deployed metric-based MIAs, which often yield misleading results by acting as strong non-member detectors. The reason for this discrepancy is that metric-based MIAs typically exploit the fact that models are more confident in members than non-members. However,  this confidence does not hold at a more nuanced level; members with high privacy risk are often difficult and atypical samples, which tend to have low confidence and are therefore frequently misclassified as non-members.  
[R6] Carlini, Nicholas, et al. "Membership inference attacks from first principles." 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022.
[R7] Sajjad Zarifzadeh, Philippe Liu, and Reza Shokri. Low-cost high-power membership
inference attacks, 2024. URL https://arxiv.org/abs/2312.03262

---

confidence: 4
contribution: 2
initial_rating: 3
presentation: 4
questions: See Weakness.
soundness: 2
strengths: This paper acknowledges the different impacts of parameters on privacy leakage and proposes an adaptive approach to promote privacy-aware weight specifications for each parameter. This is an important consideration for privacy protection. In addition, the paper involves extensive numerical experiments to show the superiority of the proposed PAST.
summary: This paper proposes an approach called PAST. Instead of using uniform penalties, the PAST identifies and raises sparsity in parameters, which significantly contributes to privacy leakages. The paper uses the loss gap as the functional proxy of the privacy loss captured by the attack advantage. The weight for each parameter is set adaptively based on its privacy sensitivity defined as the gradient of the loss gap with respect to the parameter.
weaknesses: There are flaws and issues in the motivation of considering the loss gap, the consistency between the attacker advantage and the loss gap as the functional proxy of privacy risk, the experimental setup, and the characterizations related to the privacy-utility tradeoff. 

I would be open to increasing the score if the authors can adequately address my concerns during the rebuttal.

Comment 1:

The rationale for using the loss gap as a proxy risk for privacy is unclear. Specifically, the referenced paper (Sablayrolles et al., 2019) considers a specific case in which the posterior in Eq. (1) is modeled as a Boltzmann distribution, creating a direct link between the loss function and the posterior distribution. Generally, the posterior distribution is crucial in characterizing privacy risk. The work by Sablayrolles et al. (2019) assumes a direct connection between the loss function and privacy risk, with all results depending on this assumption, which does not extend to general loss functions. Therefore, using the statement, “It has been shown that the loss function can determine the optimal attacks in membership inference (Sablayrolles et al., 2019),” as justification for adopting loss gaps as a proxy for privacy loss is questionable and insufficient. In addition, the paper does not theoretically or analytically characterize the rationale for using the loss gaps as a proxy of the privacy risk in terms of attacker advantage.  

In experiments, three classes of MIA models are considered. However, the use of the loss gap as a proxy for privacy risk does not fully coincide with the privacy risk induced by these MIA models. In particular, the loss gap captures the average loss distinguishability between the member and the non-member. However, different MIA models including the three considered use a range of observations, including logits, confidence, entropy, correctness, and augmented predictions. These observations (of the attacker) capture different aspects of the mechanism's/model's output and behavior beyond just the loss values. As a result, the privacy risk represented by these attacks may involve patterns in these observations that a simple loss gap does not fully capture. For example, the augmentation-based attack depends on how the model responds to augmented inputs, which can reveal membership through consistency in the model's behavior across transformations. Loss gap does not capture this aspect of the model's sensitivity to augmented variations, so it might underestimate privacy risk in such scenarios.

Thus, it is in general possible for two different weight schemes with similar loss gaps to exhibit notably different attacker advantages.

Comment 2:

My concern regarding the feasibility of using loss gap as a proxy of privacy risk leads to the concern of adaptively setting the parameter weights based on the privacy sensitivity (i.e., the gradient of the loss gap w.r.t. the parameter). That is, the gradient might not precisely reflect the privacy sensitivity. It is suggested to provide analytical and theoretical characterizations for the feasibility of using loss gap as a proxy of privacy risk, including the possible assumptions. 


Comment 3:

The comparison between the PAST and the uniform-penality-based $\ell_1$ and $\ell_2$ baselines (or uniform baselines) needs more details. The paper clearly describes the difference between PAST and uniform baselines in terms of whether the weights of the parameters are uniform or privacy-aware. However, the impact of the magnitude of the weights on privacy risk is ignored (correct me if I am missing anything). 

Q1: In Figure 3 and Figure 4, what are the values of lambdas chosen for $\ell_1$ and $\ell_2$ baselines?

Q2: Is it possible that the performance differences between PAST and the $\ell_1$ and $\ell_2$ baselines shown in Figure 3 and Figure 4 are due to the combination of the magnitude of the weights and setting of uniform or privacy-aware penalties, rather than due to the setting of uniform penalties or privacy-aware alone?

It is intuitive that properly weighting the more-privacy-sensitive parameters more than the less-privacy-sensitive parameters might be enough to guarantee a certain degree of privacy. However, the comparison of PAST and the $\ell_1$ and $\ell_2$ baselines in terms of the privacy-utility/accuracy tradeoff without considering the magnitude of the weights could lead to unfair comparisons.

Comment 4:

Overparameterization is not the same as non-properly weighting a fixed number of parameters.  The proposed PAST applies adaptive regularization by adjusting the penalty weights of parameters based on their privacy sensitivity, which does not necessarily address the issue of overparameterization. 

Section 5 RELATED WORK discusses the relationship between the number of parameters (or model complexity) and privacy risk, particularly in the context of overparameterization. There are works that confirm the tradeoff between the number of parameters and privacy risk. However, there is limited discussion of how the specific values or magnitudes of those parameter weights might impact privacy. Adjusting the weights of parameters for fixed parameters could influence the model's tendency to memorize or generalize, which potentially affects privacy risk. However, the related work section does not discuss studies that study this trade-off between parameter weight and privacy directly. In addition, the paper is suggested to characterize this weight-privacy trade-off.

---

confidence: 4
contribution: 2
initial_rating: 5
presentation: 2
questions: See weaknesses for details. I am giving a score of 5 (marginally below the acceptance threshold). A lower score of 3 would feel overly harsh, as the paper shows some promise. However, this version still falls short of the standards expected at a top conference like ICLR. If the authors remain enthusiastic about this work and believe in the effectiveness of their approach, I encourage them to address the above feedback and consider resubmitting to a future ML or security-focused conference. The current version, however, is far from reaching the level required for acceptance at a top-tier conference.
soundness: 2
strengths: Clarity: The paper is easy to read.

Relevance: The paper aims to address an important topic in machine learning privacy.
summary: The paper presents Privacy-Aware Sparsity Tuning (PAST), an approach to defending against membership inference attacks (MIAs) by introducing an adaptive regularization method that selectively applies sparsity based on privacy sensitivity of parameters. The proposed method modifies ℓ1 regularization, assigning higher penalties to parameters with greater privacy sensitivity. The authors conduct experiments across datasets (Texas100, Purchase100, CIFAR-10/100, and ImageNet) to validate the efficacy of PAST, reporting improvements in the privacy-utility trade-off over baseline defenses.
weaknesses: 1.Lack of Comparison with Recent Baselines: The current version does not compare its approach with recent baselines from the past three years, which is crucial for an ICLR 2025 submission. The paper only references MIA attacks from six years ago and defenses from three years ago, missing key recent works that are important for establishing state-of-the-art (SOTA) context. Key references to consider include:

MIA Attacks:

(a)"Low-Cost High-Power Membership Inference Attacks" (ICML 2024)

(b)"Scalable Membership Inference Attacks via Quantile Regression" (NeurIPS 2023)

(c)"Membership Inference Attacks from First Principles" (S&P 2022)

(d)"Enhanced Membership Inference Attacks against Machine Learning Models" (CCS 2022)

MIA Defenses:

(a) "MIST: Defending Against Membership Inference Attacks Through Membership-Invariant Subspace Training" (USENIX 2024)

(b) "SELENA: Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture" (USENIX 2022)

These references represent a minimum set of recent works that should be discussed and included as baselines for a credible comparison.

2.Method Simplicity and Lack of Theoretical Rigor: The proposed method relies on a heuristic reweighting approach that lacks theoretical guarantees, which is a notable limitation for top conference standards. The reweighting method in Privacy-Aware Sparsity Tuning (PAST) is too simplistic and does not reach the research depth, completeness, and robustness generally expected of accepted MIA papers in top conferences. The authors are encouraged to enhance the theoretical foundation and complexity of their approach for future submissions.

3.Weak Motivation and Contribution: The paper's motivation, as shown in Figure 1(b) ("Only a small fraction of parameters substantially impacts privacy risk"), is already a well-known concept in machine learning. Given that parameters closer to the output layer naturally have more influence on gradients and results, this finding is not novel. The use of regularization as an MIA defense is also limited, as regularization is not a commonly adopted SOTA defense method in MIA. The paper does not address whether the proposed reweighting improvement would benefit more commonly used defenses, making its contribution less impactful given that it builds on a sub-optimal defense method.

Meta-review: The submission introduces, PAST, a defense mechanism against Membership Inference Attacks (MIAs). It is based on the observation that only a small fraction of the model parameters contribute significantly to the privacy risk, measured by the loss gap between member and non-members data. The PAST mechanism then modifies the traditional L1 regularization by applying adaptive penalties to different parameters depending on their privacy sensitivity.

The main concern about this paper is that the proposed method lacks theoretical rigor. While the authors added a rationale in the Appendix, the assumptions made require further justification.

Decision: Reject