Toward Efficient Inference Attacks: Shadow Model Sharing via Mixture-of-Experts
Authors: Li Bai
Qingqing Ye
Xinwei Zhang
Sen Zhang
Zi Liang
Jianliang Xu
Haibo Hu
Venue: NeurIPS 2025 poster ()
Keywords: shadow model technique
data privacy
membership inference attacks
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Machine learning models are often vulnerable to inference attacks that expose sensitive information from their training data. Shadow model technique is commonly employed in such attacks, like membership inference. However, the need for a large number of shadow models leads to high computational costs, limiting their practical applicability. Such inefficiency mainly stems from the independent training and use of these shadow models. To address this issue, we present a novel shadow pool training framework SHAPOOL, which constructs multiple shared models and trains them jointly within a single process. In particular, we leverage the Mixture-of-Experts mechanism as the shadow pool to interconnect individual models, enabling them to share some sub-networks and thereby improving efficiency. To ensure the shared models closely resemble independent models and serve as effective substitutes, we introduce three novel modules: path-choice routing, pathway regularization, and pathway alignment. These modules guarantee random data allocation for pathway learning, promote diversity among shared models, and maintain consistency with target models. We evaluate SHAPOOL in the context of various membership inference attacks and show that it significantly reduces the computational cost of shadow model construction while maintaining comparable attack performance.

Toward Efficient Inference Attacks: Shadow Model Sharing via Mixture-of-Experts
Li Bai', Qingqing Ye', Xinwei Zhang', Sen Zhang', Zi Liang', Jianliang Xu', Haibo Hu Department of Electrical and Electronic Engineering, The Hong Kong Polytechnic University' PolyU Research Centre for Privacy and Security Technologies in Future Smart Systems? Department of Computer Science, Hong Kong Baptist University baili. bai@connect. polpaneeet.lll......mmm hk, haibo. hu@polyu. edu. hk
Abstract
Machine learning models are often vulnerable to inference attacks that expose sensitive information from their training data. Shadow model technique is com- monly employed in such attacks, such as membership inference. However, the need for large number of shadow models leads to high computational costs, limiting their practical applicability. Such inefficiency mainly stems from the independent training and use of these shadow models. To address this issue, we present novel shadow pool training framework SHAPOOL, which constructs multiple shared models and trains them jointly within a single process. In particular, we leverage the Mixture-of-Experts mechanism as shadow pool interconnect individ- ual models, enabling them to share some sub-networks and thereby improving efficiency. To ensure the shared models closely resemble independent models and serve effective substitutes, routing, pathway regularization, and pathway alignment. These modules guarantec random data allocation for pathway learning, promote diversity among shared models, and maintain consistency with target models. We evaluate SHAPOOL the context of various membership inference attacks and show that it significantly reduces the computational cost shadow model construction while maintaining comparable attack performance.
introduce three novel modules: path-choice
Introduction
With the increase of machine learning models trained sensitive personal data like facial images and medical records, various inference attacks pose severe threats to them, such as inferring the membership status of individual records (i.c., membership inference attacks) [ 3], reconstructing
representative samples (i.e., model inversion attacks) [ 5), and uncovering statistical properties of
the training dataset (i.e., property inference attacks) 6 7.
common technique adopted in almost all such attacks is the shadow model technique, which enables adversary to train multiple models using the same architecture as the target model on similar datasets. Recent works show is very effective in membership inference [
g 10 and
13 14 Typically, the number of shadow models determines the quality of inference attacks. For example, to achieve high attack performance, this number is set to 256 and 100 in 19 [1). respectively. However, the high computational cost of training shadow models has raised concerns [T5] [6] [4]. Several works based on shadow models attempt to address this issue by optimizing this cost inside of their specific attack algorithms. For instance, QMIA [17] focuses solely on non- con-member data to develop a quantile regression model, thereby eliminating the
property inference attacks [11] 12
"Corresponding author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

need for shadow models from other distributions. RMIA [16 employs pre-trained reference model on population data to save the training cost for shadow models in non-member cases. SNAP [[4] reduces the number of shadow models required by injecting poisoned samples that contain the target properties of interest for property inference. However, since these methods are tightly coupled with specific algorithms, they lack generalizability across different inference attacks.
In this paper, we address this problem from the perspective of shadow models themselves, that is, training each shadow model independently is not efficient I [I3.
Inspired by this, we present SHAPOOL, a shadow pool training framework that constructs shared shadow models in a single
training process. Specifically, we leverage the popular Mixture-of -fxpure-o--Expetts (MoE) mechanism [18] 20) build the pool with multiple identical sub-networks (i.e., experts) during training, and then generate shared models (i.e.. activated pathways) as substitute for conventional shadow models during inference. However, vanilla MoE may produce over-specialized, unstable, and under-trained experts, which reduces the diversity of shared models, poorly resembles independent models, and ultimately diminishes attack effectiveness. To overcome these challenges, we design three key modules: pathway-choice routing, pathway regularization, and pathway alignment. The path-choice routing strategy assigns inputs to specific pathways to ensure a randomized yet fixed data allocation for pathway learning on top of stability and reliability. Pathway regularization aims to enhance the diversity of shared models by enforcing orthogonality in the representation space of experts and penalizing paired pathways with similar outputs. Lastly, pathway alignment is introduced to improve consistency with independent models and mitigate generalization mismatches.
We conduct extensive experiments to evaluate SHAPOOL across various existing membership inference attacks (MIAs) 19 [6], demonstrating that it outperforms the conventional shadow models in both attack performance and training efficiency. On one hand, in a resource- limited scenario where only a limited number of shadow models can be trained [2I]. shared models can enhance the performance of existing attacks under similar computational budget. On the other hand, in resource- abundant scenarios like data auditing and risk assessment 22 23 24]. it achieves comparable
performance while significantly reducing the computational cost of conventional methods.
Overall, our contributions are as follows: (1) We present a novel shadow pool training framework. To the best of our knowledge, this is the first work to enhance the efficiency of various inference attacks from the perspective of the shadow model construction. (2) We propose utilizing the MoB mechanism as shadow pool to interconnect individual models, enabling them to share sub-networks and enhance the overall training efficiency. (3) To ensure that shared models serve as effective substitutes, we introduce three modules that guarantee specialized data allocation for pathway learning, promote diversity among shared models, and ensure consistency with independent models. (4) Extensive experiments demonstrate the effectiveness and efficiency of our proposed method compared to conventional shadow models.
2
Preliminary
2.1 Shadow Model-based Inference Attacks
Shadow model technique a widely-used approach for various inference attacks 11 9 T0
12
13 14]. Typically, an adversary constructs n diverse shadow models ( (Ms Ms. to simulate the behavior of the target model Mr. The i-th shadow model Ms, is often trained using the same architecture as Mr on a similar auxiliary dataset DA,, and provides attack training data and corresponding ground-truit truth labels for the construction of the attack model A. For example, MIAs, shadow models generate outputs (c.g., logits or confidence scores) along with their corresponding membership labels (1 for member and 0 for non member)), which are then used to construct the attack training dataset for A (e.g.. a binary classifier) to predict membership status. The pseudocode for shadow model-based inference attacks is provided in Appendix A. where more related works are discussed. To ensure effective inference attacks, large number of shadow models are typically required to capture the diversity and randomness inherent in the training data distribution [7]. This leads to considerable computational overhead, especially for large-scale models, thereby limiting the practicality of shadow model-based attacks. In this paper, we introduce a novel training framework to advance the efficiency of shadow model construction.

---

2.2 Mixture-of-Experts Mechanism
vanilla MoE model consists of expert layers, each containing M experts with identical network structures and a router R. Given an input æ, the output of an expert layer is computed as the summation of the outputs from the top K experts selected by R:
h Σ R(x) ((())-E(()), R(x) = (G),()()), K),
(I)
where E is learnable expert, 9 is routing strategy based trainable networks heuristic functions, and TopK(-; K)) refers to the largest K values. With K = 1 and non-expert layers omitted, obtain an activated end-to-end network pathway, formally defined as sequence of selected experts across layers, i.e. [E L² .... ]. where E; indicates that the i-th expert in the first layer activated and 1 i,j, k S M. more detailed introduction the MoE architecture can be found in Appendix A.2
3 Analysis of Shadow Models
Ideally, an inference attack should be both effective (i.e., high inference accuracy) and efficient (i.e.. computationally cheap). We investigate which aspects of shadow models influence attack effectiveness via case study on MIA, providing guidance for optimizing their construction.
We at first introduce simple approach, model augmentation 23 shadow model construction. For each trained shadow model, we generate an augmented version, doubling the total number of shadow models while reducing the overall construction cost, detailed in Appendix B Specifically, we use neural masking [28] (30] that randomly prunes the weights of a base model's parameters in fully connected (FC) convolutional (Conv) layers with a predefined probability p. However, unfortunately, those attacks with augmented models fall short of expectations Figure ((a) Next, we explore why augmented models are not effective from three perspectives: consistency, diversity, and randomness.
26
2
29
to accelerate
AVC
7011
XC-12
rco2
Orad 35
ConeCd
6M
Modiist
Shadow Models
Shadow Models
Shadow Modelt
(a) Attack performance. (b) Consistency with My. (c) Diversity of models.
(d) Training subsets.
Figure I: (a): Attack performance and (b-d): Factors of shadow models. We evaluate augmented shadow models on LiRA [9. ori denotes attacks using conventional shadow models. FC-p (or Conv- p) denotes attacks with augmented models created via neural masking applied to fully connected layers (or convolutional layers). larger probability p indicates more perturbation in the model weights. s denotes the number of distinct training subsets used for conventional shadow models.
Factor D: Consistency with the target model. Shadow models aim to replicate the behavior the target model and have similar generalization capabilities (31] Therefore, we consider the consistency between shadow and target models by their output distributions. We fit training data logits on shadow models to a Gaussian distribution and measure their overlap with the target model using the Bhattacharyya coefficient. Figure [ shows that such consistency is dependent on the specific construction method. Moreover, the level of consistency strongly influences attack performance: the lower the consistency, the weaker the attack performance, e.g., Conv-0.05 0.05 and Comv-008 cases.
Factor 2: Diversity of shadow models. We further examine how the diversity of shadow models influences the success of inference attacks on FC-p. To validate this, we measure the diversity of shadow models using their output entropy and report the entropy gain from adding more models (starting with shadow models) in Figure [(c) We find that although more augmented models are used in FC-p, their diversity increases less than that of conventional shadow models. In other words,
3

---

they offer limited additional information to the subsequent attack model, resulting in only marginal improvements in attack effectiveness.
Factor 3: Randomness of training subsets. Since augmented shadow models are statically con- structed and share the same training subsets the original models, these subsets to explain attack effectiveness. For n. shadow models, we randomly construct distinct training subsets from the auxiliary data. When n > 5, multiple models are trained on the same subset. Figure [(d] shows that using totally unique training subsets achieves the best attack performance. Distinet training allocations enable shadow models better capture randomness in data distribution, thereby enhancing inference attack effectiveness.
the distribution of
Summary: The above analysis suggests that effective shadow models should capture the randomness inherent both the training process and the training data. The former necessitates consistency with the target model while ensuring diversity among shadow models, whereas the latter focuses distinct training subsets. These principles inspire us to design a new shadow model construction algorithm as follows.
Methodology
Our goal is to improve the efficiency of shadow model construction. As fundamental component of inference attacks, our threat models are aligned with specific attack settings. Existing inference attacks [I] 9 [4] typically assume that the adversary knows (1) the training algorithm T, e.g.. the network architecture and loss function of the target model, enables the training of a similar model from scratch datasets of the adversary's choice; (2) an auxiliary dataset from the same distribution, which may or may not overlap with the target dataset. Therefore, building on above assumptions, we address the efficiency issue of shadow model construction by proposing shadow pool training framework, SHAPOOL.
4.1 Motivation & Challenges
Shadow models account for large proportion of the computational overhead in inference attacks, as each model is trained and operates independently, causing the cost to scale significantly with the number of shadow models. To address this issue, we construct shared models that trained jointly within a single process. The advantage lies in the reuse of sub-networks across models, which significantly enhances construction efficiency.
Specifically, we utilize the MoE mechanism for inference attacks, as it offers two benefits as follows: (1) Well-suited structure: An end-to-end activated pathway in MoE can be equivalent to a shadow model of an identical architecture, which allows us create a large number of shared models potential substitutes. Theoretically, MoE model with L layers, each containing M experts, can form up to A/" unique pathways. (2) Training efficiency: The sparse activation in MoE effectively scales model parameters without proportionally increasing computational demands [34]. This design enables the reuse of trained experts across different activated pathways, thereby improving the overall training efficiency of the shared models. However, it is non-trivial to adapt a vanilla MoE to construct the shadow pool due to the following challenges:
18
32 33
to construct a shadow pool of shared models
Challenge 1: Routing Specialization and Fluctuation. Existing routing strategies assign each input to the most suitable experts during inference 32 35), which creates an over-specialized mapping between inputs and pathways. Such specialization not only hinders the ability to capture diverse model behaviors
identical inputs (9), but also results in insufficient randomness of training data distribution across pathways, violating Factor @ Moreover, the routing fluctuation effect in MoE (36), where the target expert for the same input can change during training, leads to unstable and overlapping usage training data across pathways.
Challenge 2: Similar Pathways. Although randomness in the training process, such as weight initialization, mini-batch SGD, and random routing
[37], allows variations in expert performance, shared experts across multiple pathways may still lead to similar behaviors, violating Factor @. In an extreme case, only pair of experts differ between two highly overlapping pathways. Such similarity leads to redundant and under- indermiiformativ shared models for subsequent inference attacks.

---

Challenge 3: Generalization Mismatch. The end-to-end activated pathways exhibit varying degrees of generalization compared to models trained independently, thereby violating Factor D, as shown in Appendix Figure 5(a) For each pathway in MoF, the training data is typically much smaller compared to that of independently trained models, which leads to some experts being under-trained. On the other hand, the sharing mechanism affects the extent of overfitting in individual pathways.
4.2 SHAPOOL: MoE-based Shadow Pool Training Framework
To overcome above challenges, propose SHAPPOL, MoE-based shadow pool training frame- work, where activated pathways serve as effective substitutes for independently trained shadow models. As shown Figure 2(a) it includes three modules, pathway-choice routing, pathway regularization, and pathway alignment, to maintain similar effectiveness and reduce the computa- tional cost of the construction. For clarity, we use the terms 'activated pathway' and 'shared model' interchangeably throughout this paper.
Independent Trainnn
SHAPOOL
SM:
Layer Lawer
SIA
Layer'
Lager'
SM;
S16
S
Impt
-10
SM,
S14
A
Shadow Modsis
Pattway Routing
Shared Models
E
Painvay Regulatiction
Pathway Aliginent
(a) Overview of SHAPOOL.
(b) Illustration of pathway regularization.
Figure 2: (a) Solid lines represent hard connections within shadow models, while dotted lines indicate soft connections across experts in MoE. (b) The sub-networks in orange denote an activated pathway, while those in blue indicate a reference pathway.
Module 1: Pathway-choice Routing, To deal with routing specialization and fluctuation, i.e.,
Challenge we propose pathway-choice routing strategy, which routes each input fixed but randomly selected pathways and activates only one expert per layer during training and inference. This design enables us to maintain stable correlations between activated pathways and inputs, as well as to ensure a distinct data allocation for pathway learning.
We implement this pathway-choice routing strategy by establishing hard mapping between pathways and disjoint training subsets. Given an MoE model with L layers and M experts per layer, we first enumerate all possible pathways set (P M where P R2 denotes the indices of activated
experts in this pathway. Given a training set Dtr, we define c Prr as a binary mapping matrix, where each element B indicates whether the w-th pathway is updated by the input v, from the training set for update, otherwise). Formally, our pathway-choice router of the 1-th layer for the w-th pathway is defined as
R(x;; w, I) = B [(p))=
(2)
where I
IP.,. [kk=)] is an M -ddimensional binary vector indicating which expert is activated at the layer for the w-th pathway. Then, the output of the 1-th expert layer formulated as:
R(,,; w. E(x,).
E(x;) represents an output matrix of all experts, where each row refers to the output of a single expert for the input 24. We establish random yet stable assignment between experts and inputs by mapping matrix B. By controlling the overlap of data points across pathways, we ensure distinct training subsets for shared models and capture randomness in data distribution.
Module 2: Pathway Regularization. SHAPOOL leverages pathway regularization to improve the diversity of shared shadow models to address Challenge 2. The core idea is to constrain the outputs of experts and produce diverse model predictions for the same input. We enforce the constraint on activated pathways by introducing two loss terms: similarity regularizer and orthogonal regularizer. Inspired by contrastive learning 38 39, SHAPOOL activates a pair of pathways each iteration instead of single pathway to enhance their differences.. During training, we randomly select
5

---

an additional pathway as reference and update the model parameters of the activated pathway.
Figure ( illustrates one iteration of the training process for an input.
We first work on the issue of redundant model outputs from different pathways in SHAPOOL. Since model outputs are key component in various inference attacks, particularly against black-box models [3], we introduce similarity regularizer to control the alignment of output probability among pathways. Let p = f(x; P) denote the prediction probabilities of an MoE model f. where set of experts along the pathway P are activated. As shown in Figure 2(b) given that two pathways are activated in one iteration, their prediction probabilities are represented as P1 = fl:; P1) and p2 = fæ; P2), where P1 (.... Ej- E2, E ....} } and P3 {.... E3 Egj Es ..... respectively. We use the -ealbbacckLeiblee (KL) divergence to measure the similarity of the output distributions
between pairwise pathways [37]. The similarity regularizer Csn is defined as the negative average of two KI. divergence terms calculated from the prediction probabilities, as follows:
LSH(PL:P)) = (KL(xl - + K pt)))
(4)
We further introduce an orthogonal regularizer to eliminate feature correlation of experts within a single layer. This is important in extreme cases where pair of activated pathways share all but one expert, leading to highly similar predictions for the same inputs. To address this issue, a strong constraint is imposed from the perspective of expert outputs to enhance their misalignment. In particular, we turn to orthogonal regularization [40
41 42 to improve the orthogonality effect in the
representation spaces of experts. Rather than using common weight initialization methods, which may cxhibit uncertain orthogonality in the convolutional layer 45] and impose overly stringent constraints [40], we apply the regularizer directly to the outputs of the experts and make their representation space as orthogonal as possible, Let H| and H2 denote two sets of internal activations given a pair of pathways, respectively. We define the orthogonal regularizer CoR as the sum of the pairwise inner products of the outputs from activated experts across all layers, formally expressed as:
LoR(Hi; H2) = Elmb hh1
(5)
where N! and hy are the outputs of activated experts in the I-th layer for P1 and P2, respectively. Together with the commonly-usee cross-entropy loss LCe for model accuracy objective, the entire training objective of SHAPOOL with respect to training sample (x, y) is to minimize:
(6) The hyperparameters a and B are introduced to balance model utility and the diversity strength of two regularization terms. The training objective in (6) forces all experts to minimize training accuracy errors while maximizing the diversity of their predictions.
L = LCE(PL:)) + aCsn(piPP)) + BCon Hı; H2))
Module 3: Pathway Alignment. Challenge points out that shared models in MoE tend to misalign with independent models in terms of generalization. Consequently, this mismatch fails to mimic the behaviors of the target model and degrades the performance of inference attacks. To address this issue, we aim to drive under-trained experts toward the performance of well-trained ones. The core idea is to enhance the memorization capacity of these activated pathways and align their behaviors with those of independent models across different data distributions, through key module in SHAPOOL termed pathway alignment.
We leverage the commonly used fine-tuning technique to achieve this alignment. A simple approach to update specific layers a pre-trained model while keeping the remaining weights frozen [4 45). Similarly, we update the model parameters along the activated pathway using small dataset D, randomly sampled from Drr (around 10%). Specifically, after Modules and 2, we randomly select pathways from the pre-trained MoE model and fine-tune them on D, by minimizing Leg. We reuse a portion of samples from the overall training set Dr, to enrich the data available to each pathway, since each is initially trained on considerably smaller subset compared to independent shadow models. These selected pathways are further trained on more examples, making their behavior more similar to that of conventional shadow model and effectively reducing the mismatch with the target model, as illustrated in in Appendix Figure ((b)
The Complete Algorithm: We present the pseudocode for SHAPOOL in Appendix, specialized MoE. model designed for the shadow model construction problem, where activated pathways can replace conventional shadow models in various attacks. Prior to MoE training, we randomly assign

---

training data to different pathways and record the mapping between each input and its corresponding activated pathway. During training, we promote diversity and informativeness among shared models by regulating pairwise pathway similarity via (6. Finally, the pathway alignment module post- processes the trained pathways to align their behaviors with those of independently trained models across both training and test data distributions. Last but not least, similar to the shadow model technique, to learn more different aspects both data distribution and the training process, we can develop multiple independent shadow pools, each providing some shared models for inference attacks.
5
Evaluation
This section conducts comprehensive evaluation of SHAPOOL, demonstrating its effectiveness and efficiency across existing inference attacks under two distinct scenarios: (1) Sessorce-Constraiig Scenario: There is a limit to training only small number of shadow models, such as online inference attacks [21]. In this case, our goal is to enhance the effectiveness of existing attacks while consuming the same or similar amount of computational resources. (2) Resource-Unconstraieen Scenario: There are no explicit cost constraints, allowing for a large number of shadow models, such as offline data auditing or model vulnerability analysis 22 23 We aim to maintain comparable attack performance while significantly improving computational efficiency.
5.1 Experiment Settings
Datasets and Models. Our evaluation is conducted on three benchmark datasets: CIFARION 100
46
CIFARIO 10 (46) and CINIC10, and three typical network architectures: ResNet18 (47), VGG16 48
and WideResNet28-10 44). For the configuration of SHAPOOL, we set the number of expert layers T. to (3 for WideResNet22-100 the number of experts M to 4, and the number of shared models to 64. Detailed settings are provided in Appendix C.I
Evaluation Protocol and Baseline. A shadow model-based inference attack pipeline generally consists of three stages: shadow model construction, attack model construction, and inference execution. We consider the conventional shadow model construction approach the baseline (denoted by BASE), where each shadow model is independently trained on a randomly sampled subset of auxiliary data. Our proposed framework replaces the shadow model construction stage with shared models from the pool, while the other two stages remain unchanged.
16 50, 51, we assume that an adversary knows the target model's network structure and possesses shadow datasets similar to the target data distribution. We evaluate the effectiveness of SHAPOOL by integrating it into two shadow model-based MIAs: LiRA [9] and RMIA [6], replacing their original shadow model construction. Each method is evaluated in both offline and online modes; the latter generally offers better performance but incurs higher computational cost. Further details are available in Appendix C.2
Attack Setup. Following
29 52]. we adopt two evaluation metrics as performance indicators, i.e., Area Under the ROC Curve (AUC) and True Positive Rate (TPR) at low False Positive Rate (FPR). As for computational costs, we present the wall-clock time (in hours) required for shadow model construction, along with the corresponding percentage reduction in runtime. We report the average results over five independent runs with different random seeds and and release the source code at https:tp//. http::///gthbbb com/ Baaiibb//Saaowoooo .itt.
Evaluation Metrics. Following existing MIAs 9
5.2 Main Results
We evaluate the effectiveness of SHAPOOL in two different scenarios, followed by an investigation into how its several components contribute to the overall attack performance.
Inference Attacks under Low Computation Budget. We first analyze the performance of inference attacks under low computational resources, i.e., using a small number of shadow models. To achieve a similar cost, we use one shadow pool for SHAPOOL, while BASE uses four shadow models for ARA--nninee and two shadow models for LiRA and uses only a few fine-tuning epochs when conducting LiR A-fffiiee Detailed settings are provided in Appendix C.I Table I compares the attack performance of different construction methods.
SHAPOOL removes pathway regularization
7

---

Table 1: Attack performance and computational cost of LiRA under the constrained resource. We use to represent changes in the attack performance smaller than 0.02 and TF1 to denote FFR=1P.=
RESNETI8
VGG16
WiDEResNer28-10 TFI COST
DATASET
METHOD
AUC
TFI
COST
AUC
TFI
COST
AUC
LIRA-OFFINEE ATTACK
BASE SHAPOOL
0.73
0.22
0.5
0.69
0.16
0.4
0.76
0.30
2.4
CIFAR 100
0.82
0.32
0.4
0.76
0.17
0.5
0.81
0.27
1.9
+0.09
+0.10
+0.07
+0.05
-0.03
BASE SHAPOOL
0.51
0.06
0.5
0.56
0.04
0.4
0.55
0.08
2.2
CIFARIO
0.63
0.09
0.5
0.64
0.09
0.4
0,60
0.08
1.6
+0.12
+0.03
+0.08
+0.05
+0.05
LIRA ONLINE ATTACK
BASE SHAPOOT
0.90
0.34
1.0
0.86
0.25
0.9
0.90
0.36
3.6
CIFAR 100
0.92
0.42
1.0
0.88
0.25
0.9
0.91
0.42
3.4
+0.02
+0.08
+0.02
+0.06
BASE
0.69
0.11
1.0
0.67
0.07
0.9
0.67
0,09
4.4
CIFARIO
SHAAPOL
0.71
0.11
1.0
0.69
0.10
1.2
0.69
0.12
4.5
+0.02
+0.02
+0.03
+0.02
+0.03
Table 2: Attack performance and computational cost of LiRA under the unconstrained resource.
RESNET18
VGG16
WIDERESNEr28-10 TFI
DATASET
METROD
AUC
TFI
COST
AUC
TFI
COST
AUC
COST
MIRA-OFFLINE ATTACK
BASE
0.81
0.36
15.4
0.72
0.25
12.1
0.77
0.37
76.8
CIFARI00
SHAPOOL
0.84
0.37
1.6
0.78
0.21
2.0
0.82
0.36
7.7
+0.03
L 990%
+0.06
-0.04
84%
+0.05
1. 9.0%
BASE
0.57
0.11
16.8
0.54
0.06
13.7
0.56
0.09
70.8
CIFAR
SHAPOOT.
0.63
0.13
1.9
0.65
0.10
1.6
0.61
0.09
6.4
+0.06
+0.02
4 89%
+0.11
+0.03
88%
+0.05
4.9 91%
LIRA-ONLINE ATTACK
BASE
0.95
0.55
30.7
0.90
0.36
24.3
0.93
0.50
153.6
CIFARIOO
SHAPOOL
0.53
3.9
0.31
3.1
0.92
-0.02
8.%
-0.05
88%
-0.02
91%
BaSE
0.71
0.16
33.7
0.71
0.14
27.5
0.71
0.13
141.6
CIFAR
SHAPOOL
0.70
0.14
4.0
0.69
0.13
4.8
0.70
0.13
18.1
88%
-0.02
1. 87%
Overall, SHAPOOL demonstrates superior performance in most cases across various settings. For instance, SHAPOOL improves AUC by 5%-12% in LiRA-offling and by around 2% in LiRA-online, respectively. We also observe relatively modest improvement on the WideResNet28- 10 network compared to the other network types, attributed to its fewer expert layers and less diverse shared models. Besides, SHAPOOL shows a more significant improvement in LiRA-offline across evaluation metrics than in LiRA-onnine. This difference arises because the former attack is less sensitive to the output distribution of shadow models. these results indicate that SHAPOOL enhances inference attack performance by replacing independent shadow models with more shared models under similar computational cost.
Ultimate Performance of Inference Attacks. We then evaluate the attack power when a large number of conventional shadow models can be trained. This scenario aims validate SHAPOOL's training efficiency and ultimate attack performance. Following previous settings 9 [2), we prepare 128 shadow models for LiRA-online (half IN and half OUT) and 64 for LiRA-offinne (all OUT). In this case, we construct four shadow pools, each randomly sampling 64 pathways as shared models. Table 2 presents the attack performance and computational cost across different settings. First, for the LiRA-offline attack, our proposed method outperforms the baseline as the size of the shadow pools increases, mostly achieving higher attack performance while significantly reducing the computational cost of conventional shadow model training by an average of 88. 88.6%. Regarding LiRA-online MIA, SHAPOOL achieves comparable performance terms of AUC, with slight reduction in TPR @ FPR=1%. &. This is attributed to the high sensitivity and limited robustness of the online mode to the behavior of shadow models on the training data distribution [9. Overall, our SHAPOOL framework improves the efficiency of shadow model training by approximately
8

---

Table 3: Attack performance and computational cost of RMIA.
Table 4: Loss terms.
RMIA-ofiline TRQ1
RMIA-oaline TFO1
Loe
CaR
CoR
AUC
TF)
Method
AUC
TF1
Cost
AUC
TF1
Cost
0.83
0.35
RASE
0.94
0.53
0.44
7.5
0.94
0.53
0.40
16.0
v
0.84
0.36
SHAPOOL A
0.93
0.52
0.42
18
0.93
0.53
0.39
4.0
0.39
76%
-0.02
4 75%
4
0.87
0.42
7.7x compared to BASE on LiRA. Apart from CIFARIO and CIFARIO0, we further validate the performance of SHAPOOL on CINICIO in Appendix C.3
Performance on Different Attacks. To further validate the board applicability of SHAPOOL across different attacks, we report experimental results RMIA using ResNet18 and CIFAR 100, evaluating AUC, TPR @ FPR=1% % (TF1), and TPR @PR@FPR=1E FPR=0.1 1% (TF01) under the unconstrained setting. Specifically,
compare the performance of the original RMIA using 64 independent shadow models with its enhanced version that utilizes shared models from four shadow pools. Table demonstrates that unlike previous methods tailored specific attack strategies, our approach generalizes across different inference attacks with improved efficiency and adaptability. Moreover, beyond MIAs, we extend our method to PIAs, as detailed in Appendix C.4 further demonstrating its effectiveness and efficiency.
5.3 Ablation Study
We investigate how various components in SHAPOOL collectivly achieve comparable attack perfor- mance using CIFAR100 and ResNet18.
6,85
-6.48
AAC
AUC
AUC
2.02
0.42
0.44
+00.0
0.50
3.43
0.40
0.30
0.24
6.44
8.8
081
0.22
3.25
6.92
Shared Models
Shadow Poots
Hyperparametor
Hypurarramederr
(a)
(b)
(c)
(d)
Figure Hyperparameter settings on the LiRA-offline using ResNet18 and CIFARI00.
Number of Shared Models. We evaluate the impact of the number of shared models sampled from the shadow pool on attack performance. We test LiRA-offline attacks using four different numbers of shadow models: 8, 16, 32, and 64, using CIFAR 100 and ResNet18. Figure 3 illustrates slight performance improvement in both AUC and TPR @ FPR=1% as the number of shared models increases; however, this effect diminishes when the number exceeds 32, indicating that while shadow pool can provide numerous potential shared models, their effectiveness is ultimately limited.
build multiple shadow pools for shared models in the above experiments. Here, we examine the impact varying the number of shadow pools attack performance, ranging from to 4. Figure (3bb shows that increasing the number of shadow pools improves both evaluation metrics, especially a more noticeable effect TPR @FPR=1% % This upward trend suggests that SHAPOOL. has the potential further
Number of Shadow Pools. To approximate the ultimate attack performance,
enhance attack performance beyond the results reported in Tables 2 and
Training Objective. Path regularization employs specialized training objective to enhance the diversity of shared models. Here, we examine the relative contributions its loss terms: Lcg, CSR- that Con plays crucial role in attack performance, whereas
and Con- The results in adding LSR results in only a slight improvement AUC and TPR FPR=1 %, as LoR imposes a more direct restriction the experts.
Regularization Strength. We further investigate the impact of the regularization strengths a and B. To control the experiment, we set the other hyperparameter to zero when testing either one. Regarding the hyperparameter a, Figure 3(c) demonstrates that the attack performance remains stable as long as is not very large (e.g., a < 0.05). And 3 has similar effect attack performance in Figure 3(d)

---

As such, in our experiments, we set it to value smaller than 0.01. The two regularizers positively influence attack performance when setting their contribution an appropriate scale. Due to space limitations, additional results under various settings are provided in Appendix C.3
6 Discussion
Broader Impacts. This paper advances our understanding of inference attacks in machine learning models. We take a new perspective on investigating the construction of shadow models. By adopting MoE-based shared model training, we not only accelerate the construction but also enhance the effectiveness of these shadow models for inference attacks. Our proposed framework offers model publishers or data owners an efficient tool audit and assess potential privacy risks when publishing model or model service.
Limitations. We improve the efficiency of shadow model construction by introducing MoE- based shadow pool, where activated pathways serve as substitutes for conventional shadow models. However, this approach requires adapting the shadow model architecture to the MoE framework, entailing network architectural modifications. Furthermore, due to the increased number of parameters in MoE, the proposed method more effective when the adversary possesses a sufficient amount of auxiliary data; its performance may degrade in low-data attack scenarios.
7 Conclusion
Targeting the efficiency bottleneck of shadow model construction, a component of inference attacks, we propose an attack-agnostic solution to address this issue. Instead of independently training shadow models in conventional manner, we construct large number of shared models and train them jointly within a single process using the MoE mechanism. While this reuse of sub-networks improves the construction efficiency, dependent shadow models may negatively impact the attack performance. We propose three enhancement modules to address these issues and enable shared models from the pool serve effectivve substitutes. Our approach replaces conventional shadow models with shared models, significantly reducing construction costs while preserving competitive attack performance across various datasets. Moreover, it can be seamlessly integrated into wide range of inference attacks. Future work can explore refined parameter- sharring-- strategies to further balance attack efficiency and effectiveness. Additionally, adaptive shadow model training mechanisms remain an interesting direction.
Acknowledgments
This work was supported by the National Natural Science Foundation of China (Grant No: 92270123 and 62372122), the Research Grants Council (Grant No: 15208923, C2004-21GF C2003-23Y), and the PolyU Research Centre for Privacy and Security Technologies Future Smart Systems, Hong Kong SAR, China.
References
[1] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3-18. IEFE, 2017.
[2] Hongyang Yan, Shuhao Li, Yajie Wang, Yaoyuan Zhang, Kashif Sharif, Haibo Hu, and Yuanzhang Li. Membership inference attacks against deep learning models via logits dis- tribution. JEEE Transactions on Dependable and Secure Computing, 20(5):3799-3800 2022.
[3] Li Bai, Haibo Hu, Qingqing Ye, Haoyang Li, Leixia Wang, and Jianliang Xu. Membership inference attacks and defenses federated learning: survey. ACM Computing Surveys, 57(4):1-35, 2024.
[4] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference computer and communications security, pages 1322-1333, 2015. 2015.
10

---

[5] Haoyang Li, Li Bai, Qingqing Ye. Haibo Hu, Yaxin Xiao, Huadi Zheng. and Jianliang Xu. A sample-leve Menele evaluation and generative framework for model inversion attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 18287-18295, 2025.
[6] Giuseppe Ateniese, Luigi V Mancini, Angelo Spognardi. Antonio Villani, Domenico Vitali, and Giovanni Felici. Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers. International Journal of Security and Networks, 10(3):137 150, 2015.
[7] Li Bai, Xinwei Zhang, Sen Zhang, Qingqing Ye, and Haibo Hu. Provfl: Property inference attacks against vertical federated learning. IEEE Transactions on Information Forensics and Security, 2025.
[8] Christopher A Choquette-Chog, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label- only membership inference attacks. International conference on machine learning, pages 1974. PMLR, 2021.
[9] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897-1914. IEEE, 2022.
[10] Lauren Watson, Chuan Guo, Graham Cormode, and Alexandre Sablayrolles. On the importance of difficulty calibration membership inference attacks. In The Tenth International Conference on Learning Representations (ICLR), 2022.
[11] Wanrong Zhang, Shruti Tople, and Olga Ohrimenko. Leakage of dataset properties in (Multi- Party) } machine learning. In 30th USENIX security symposium (USENIX Security 21), pages 2687-2704, 2021.
[12] Anshuman Suri and David Evans. Formalizing and estimating distribution inference risks. arXiv preprint AXXv:2209.000244 2021.
[13] Saeed Mahloujifar, Esha Ghosh, and Melissa Chase. Property inference from poisoning. In
2022 IEEE Symposium on Security and Privacy (SP), pages 1120-1137. IEEE, 2022.
[14] Harsh Chaudhari, John Abascal, Alina Oprea, Matthew Jagielski. Florian Tramer, and Jonathan Ullman. Snap: Efficient extraction of private properties with poisoning. In 2023 IEEE Symposium Security and Privacy (SP), pages 400-417. IEEE, 2023.
[15] Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. MI-leaks: Model and data independent membership inference attacks and defenses on machine learning models. 26th Annual Network and Distributed System Security Symposium, 2019.
[16] Sajjad Zarifzadeh, Philippe Liu, and Reza Shokri. Low-cost high-power membership inference attacks. In Forty-first International Conference Machine Learning, 2024.
[17] Martin Bertran, Shuai Tang. Aaron Roth, Michael Kearns, Jamie H Morgenstemn and Steven Wu. Scalable membership inference attacks via quantile regression. Advances in Neural Information Processing Systems, 36, 2024.
[18] Jiaqi Ma, Zhe Zhao, Xinyang Yi, Jilin Chen, Lichan Hong, and Ed H Chi. Modeling task relationships in multi-task learning with multi-gate mixture-of-experts. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining, pages 1930-1939, 2018
[19] Min Lin, Jie Fu, and Yoshua Bengio. Conditional computation for continual learning. arXiv preprint arXiv: 19066066335 2019.
[20] Joan Puigcerver, Carlos Riquelme, Basil Mustafa, Cedric Renggli, André Susano Pinto, Sylvain Gelly, Daniel Keysers, and Neil Houlsby. Scalable transfer learning with expert models. arXiv preprint 200% 2020.

---

[21] Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. When machine unlearning jeopardizes privacy. In Proceedings of the 2021 ACM SIGSAC conference on computer and communications security, pages 896-911, 2021.
[22] Zonghao Huang, Neil Zhenqiang Gong, and Michael K Reiter. A general framework for data-use auditing of ml models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1300--314, 2024.
[23] Yugeng Liu, Rui Wen, Xinlei He, Ahmed Salem, Zhikun Zhang, Michael Backes, Emiliano De Cristofaro, Mario Fritz, and Yang Zhang. (ML-Doctor): Holistic risk assessment of inference attacks against machine learning models. In 3/st USENIX Security Symposium (USENIX Security 22), pages 3925-4542, 2022.
[24] Li Bai, Haibo Hu, Qingqing Ye, Jianliang Xu, Jin Li, Chengfang Fang, and Jie Shi. Rmr: A relative membership risk measure for machine learning models. IEEE Transactions on Dependable and Secure Computing, 2025.
[25] Ibomoiye Domor Mienye and Yanxia Sun. A survey of ensemble learning: Concepts, algorithms, applications, and prospects. IEEE Access, 10:991 29999919,, 2022.
[26] Xumeng Gong, Cheng Yang, and Chuan Shi. Ma-gel: Model augmentation tricks for graph con- trastive learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 4284 4292, 2023.
[27] Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, and Alan Yuille. Learning transferable adversarial examples via ghost networks. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 11458-11655, 2020.
[28] Han Wu, Guanyan Ou, Weibin Wu, and Zibin Zheng. Improving transferable targeted adversarial attacks with model self-enhancement. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24615-24624, 2024.
[29] Yuyang Long, Qilong Zhang, Boheng Zeng. Lianli Gao. Xianglong Liu, Jian Zhang, and Jingkuan Song. Frequency domain model augmentation for adversarial attack. In European conference on computer vision, pages 549-566 Springer, 2022.
[30] Xue Ying. An overview of overfitting and its solutions. In Journal of physics: Conference series, volume 1 1168, page 022022. IOP Publishing, 2019.
[31] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pages 268 (68. IEEE, 2018
[32] Noam Shazeer, Azalia Mirhoseini, Krzysztof Maziarz, Andy Davis, Quoe Le, Geoffree Hinton, and Jeff Dean. Outrageously large neural networks: The sparsely-gated mixture-of-experrs layer. arXiv preprint arXiv: /001: 70653888 2017.
[33] Zhiwen Fan, Rishov Sarkar, Ziyu Jiang, Tianlong Chen, Kai Zou, Yu Cheng, Cong Hao, Zhangyang Wang, et al. Mi Mixtureoof-expers vision transformer for efficient multi-task learning with accel-acce co-design. Advances in Neural Information Processing Systems, 35:28441-28457, 2022.
[34] Weilin Cai, Juyong Jiang, Fan Wang, Jing Tang, Sunghun Kim, and Jiayi Huang. A survey on mixture of experts. arXiv preprint arXiv:2407.0620 2024.
[35] Dmitry Lepikhin, HyoukJoong Lee, Yuanzhong Xu, Dehao Chen, Orhan Firat, Yanping Huang, Maxim Krikun, Noam Shazeer, and Zhifeng Chen. Gshard: Scaling giant models with condi- tional computation and automatic sharding. arXiv preprint arXiv:2006. 16668, 2020.
[36] Damai Dai, Li Dong, Shuming Ma, Bo Zheng, Zhifang Sui, Baobao Chang, and Furu Wei. Stablemoe: Stable routing strategy for mixture of experts. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics, pages 7085-7095 Association for Computational Linguistics, 2022.
12

---

[37] Simiao Zuo, Xiaodong Liu, Jian Jiao, Young Jin Kim, Hany Hassan, Ruofei Zhang, Tuo Zhao, and Jianfeng Gao. Taming sparsely activated transformer with stochastic experts. arXiv preprint arXiv:21 10.04260, 2021.
[38] Ishan Misra and Laurens van der Maaten. Self-supervised learning of pretext-invariant rep- resentations. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6707-6717, 17, 2020.
[39] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning, pages 1597-1607. PMLR, 2020.
[40] Takeru Miyato, Toshiki Kataoka, Masanori Koyama, and Yuichi Yoshida. Spectral normalization for generative adversarial networks. arXiv preprint 0rX.v::802.05957, 2018.
[41] Andrew Brock. Large scale gan training for high fidelity natural image synthesis. arXiv preprint 1809: 1096, 2018.
[42] Yishi Li, Kunran Xu, Rui Lai, and Lin Gu. Towards an effective orthogonal dictionary convo- lution strategy. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 1473-1481, 2022.
[43] Jiayun Wang. Yubei Chen, Rudrasis Chakraborty, and Stella X Yu. Orthogonal convolutional neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11505-11515, 2020.
[44] Jason Yosinski, Jeff Clune, Yoshua Bengio, and Hod Lipson. How transferable are features in deep neural networks? Advances in neural information processing systems, 27, 2014.
[45] Jeremy Howard and Sebastian Ruder. Universal language model fine-tuning for text classifi- cation. In ACL 2018-56th Annual Meeting of the Association for Computational Linguistics, volume 1, pages 328-339. Association for Computational Linguistics, 2018.
[46] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[47] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[48] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 2014.
[49] Sergey Zagoruyko. Wide residual networks. arXiv preprint arXiv: 160..00166.. 2016.
[50] Florian Tramèr, Reza Shokri, Ayrton San Joaquin, Hoang Le, Matthew Jagielski, Sanghyun Hong, and Nicholas Carlini. Truth serum: Poisoning machine learning models to reveal their se- crets. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 2799, 2022.
[51] Zitao Chen and Karthik Pattabiraman. A method to facilitate membership inference attacks in deep learning models. arXiv preprint arXiv:2407.01919, 2024.
[52] Yuxin Wen, Arpit Bansal, Hamid Kazemi, Eitan Borgnia, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Canary in coalmine: Better membership inference with ensembled adversarial queries. arXiv preprint arXiv:2210. 10750, 2022.
[53] Borja Balle, Giovanni Cherubin, and Jamie Hayes. Reconstructing training data with informed adversaries. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1138-1156. IEEE, 2022.
[54] Zhibo Wang, Yuting Huang, Mengkai Song, Libing Wu, Feng Xue, and Kui Ren. Poisoning- assisted property inference attack against federated learning. IEEE Transactions on Dependable and Secure Computing, (0(4))3328-3344) 2022.
13

---

[55] Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang. {Updates- Leak]: Data inference and reconstruction attacks in online learning. 29th USENIX security symposium (USENIX Security 20), pages 1291-1308, 2020.
[56] Hao Li, Zheng Li, Siyuan Wu, Chengrui Hu, Yutong Ye, Min Zhang, Dengguo Feng, and Yang Zhang. Seqmia: Sequential metric based membership inference attack. In Proceedings of the 2024 ACM SIGSAC Conference Computer and Communications Security, pages -196-3510, 2024.
[57] Svetlana Pavlitska, Christian Hubschneider, Lukas Struppek, and Marius Zöllner. Sparsely- gated mixture-offexperr layers for enn interpretability. In 2023 International Joint Conference on Neural Networks (IJCNN), pages 1-10. IEEE, 2023.
[58] Lam Pham, Huy Phan, Ramaswamy Palaniappan, Alfred Mertins, and Ian McLoughlin. Cnn- moe based framework for classification of respiratory anomalies and lung disease detection. IEEE journal of biomedical and health informatics, 25(8):2938-22 -9948, 2021.
[59] Carlos Riquelme, Joan Puigcerver. Basil Mustafa, Maxim Neumann, Rodolphe Jenatton, André Susano Pinto, Daniel Keysers, and Neil Houlsby. Scaling vision with sparse mixture of experts. Advances in Neural Information Processing Systems, 34:8583-8595 2021.
[60] Yanqi Zhou, Tao Lei, Hanxiao Liu, Nan Du, Yanping Huang, Vincent Zhao, Andrew M Dai, Quoe Le, James Laudon, et al. Mixture-of-experts with expert choice routing, Advances in Neural Information Processing Systems, 35:7103-7111 2022.
[61] Mike Lewis, Shruti Bhosale, Tim Dettmers, Naman Goyal, and Luke Zettlemoyer. Base layers: Simplifying training of large. sparse models. In International Conference on Machine Learning, pages 6265-6274. PMLR, 2021.
[62] William Fedus, Barret Zoph, and Noam Shazeer. Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity. Journal of Machine Learning Research, 2311 2022.
[63] Stephen Roller, Sainbayar Sukhbaatar, Jason Weston, et al. Hash layers for large sparse models. Advances in Neural Information Processing Systems, 34:17555-17566, 2021.
[64] Liwei Song and Prateek Mittal. Systematic evaluation of privacy risks of machine learning models. In 30th USENIX Security Symposium (USENIX Security 2/), pages 2615-2632, 2021.
[65] Ilya Loshchilov and Frank Hutter. Sgdr: Stochastic gradient descent with warm restarts. arXiv preprint arXiv: 03983, 2016
[66] Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. Enhanced membership inference attacks against machine learning models. In Proceedings of the 2022 ACM SIGSAC conference on computer and communications security, pages 3093-3106, 2022.
[67] Yigitean Kaya and Tudor Dumitras. When does data augmentation help with membership inference attacks? In International conference on machine learning, pages 5345-5355. PMLR, 2021.
[68] Li Hu, Anli Yan, Hongyang Yan, Jin Li, Teng Huang, Yingying Zhang, Changyu Dong, and Chunsheng Yang. Defenses to membership inference attacks: A survey, ACM Computing Surveys, 56(4):1-34, 2023.
[69] D. Dua and C. Graff. Uci machine learning repository. httt:///archive ics. ucw.edu/m. 2017.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
We give our claims in the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We provide the discussion in Appendix
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA].
15

---

Justification:
No theoretical part.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We give the experiment setup in Section 5 and Appendix and the source code is released in http:////ggiiaub...oo//aaa//////
git
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
16

---

Answer: [Yes]
Justification:
We provide our code above.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ ctpppp..c/pulli//guiii wwwiii/gguie///eeeeeeoeic CoodeSubeiiieeee ssi wswinnolli onnolicy)))) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We give the experiment setup Section 5 and Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: We report the average experimental results.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
17

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of enrors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We introduce this in Appendix C.1
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g.. preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: //t:::///euiss..eeeee cwterripscccpppeeeee http:///...ppppcccctcctccicieee.
Answer: [Yes]
Justification: Our research obeys the NeurlPS code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is a special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We analyze the potential impact in Appendix 6
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to
18

---

generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative socictal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [No]
Justification: This paper poses such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We cite reference papers that used the source code or datasets.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, wwppppsiipteeeee www.ree.wthhhe....c. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's is creators.
13. New assets
Question: Are new assets introduced in the paper well documented and the documentation provided alongside the assets?
19

---

Answer: [No]
Justification:
This paper does not release new assets
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: this paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: this paper does not involve crowdsourcing research with human subjects
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Answer: [NA]
20

---

Justification:
Only for writing and editing purposes.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to L.M policy http:s/s//eeerippocccc//oorrreep for what should or should not be described.
21

---

Appendices
Algorithm 1: Shadow Model-based Inference Attacks
Input: Training algorithm T, Target model Mr, Auxiliary dataset A Query examples Q, Attack algorithm T'
Output: Inferred secret s'_
// Shadow Model Construction
Construct shadow training subsets DAj Dagi Day randomly sample from DA
for i= 1 S M do
Train a shadow model Ms, + TDDA))
end // Attack Model Construction Dau f- 0; for i 1; M do
(D).:8)) < (DA.) Dus Datt U (DA,, 8,);
11 811 ground-truth secret, e.g., membership status
end
10 Train attack model A (Daui) // Inference Attack s' + (Q))
12 return s':
A Related Work
A.1 Shadow Model-based Inference Attacks
The shadow model training technique aims mimic the behavior of the target model by preparing shadow models with the same network architecture similar datasets, which provides the ground truth of inference results and outputs for the meta-classifiers used inference attacks [8 53 33 [4]
as outlined in Algorithm T Several popular inference attacks highlight the versatility of this techmique. For instance, shadow model-based membership inference attacks leverage shadow models to construct binary inference classifiers or hypothesis tests 19. Similarly, property inference attacks [3 14 54
use shadow models to build meta-classifiers that reveal sensitive property information in property inference attacks. Moreover, in advanced model inversion attacks (55), shadow model training facilitates the joint supervised training the encoder and decoder with collection of shadow- target model pairs.
Current research on shadow models mainly examines their training setup in relation to the target model, focusing on factors such as employing an identical network architecture [56] [0] and analyzing the effects of varying shadow training data distributions [15] TO Departing from this focus, we aim to explore advanced methods for shadow model construction and enhance the attack efficiency of shadow model-based inference attacks.
R
R213
Poport ayant
Poport ayart
Pepatt ayent
88
on
Tapos
Figure 4: Example vallina MoE. For simplicity, non-expert layers are omitted here. An activated end-to-end pathway, highlighted in blue, is formed by the experts selected through the input-dependent routing function R, along with the fixed non-expert layers.
22

---

A.2 Mixture of Experts
As special instance of conditional computation 19 20 sparsely-gated MoE 18 33 52 35
[59] contains a group of identical sub-networks (i.e., experts) and makes input-dependent predictions according to the choices of experts. It increases model parameters while maintaining similar computational cost per example during inference, powering kinds of Al domains, including multi-task and computer vision
learning T8 85 NLP
32 35
59
For simplicity, we refer to it as
MoE moving forward.
Let first introduce vanilla MoE model consisting of L expert layers, each containing M experts with identical network structures and router R. as illustrated in Figure Given an input æ, the output of an expert layer is computed as the summation of the outputs from the top K experts selected by R:
K h Σ R(x) (R())))(()), R(x) = (G))
(7)
where E is a learnable expert (i.e., sub-network), G is routing strategy based on trainable networks or heuristic functions and TopK(; K) refers to selecting the largest K values with the remaining values set to zero. Figure illustrates an iteration of the MoE training process.
Key research on MoE models focuses on effective routing strategies that navigate inputs the most suitable experts and achieve expert load balance [60, 61 62 20] The mainstream approach, known as the input-choice routing strategy, assigns each input one or more experts. For example, Switch Transformers [22 uses softmax layer to select the top expert for each example. Similarly, Base Layers 66] employ linear assignment function to allocate tokens to experts. Hash Layer [63]
utilizes hashing to assign input tokens to experts, whereas THOR (37 activates experts randomly for each input. Alternatively, rather than selecting one or two top-scoring experts for each input, [60] allows each expert to pick the top-k inputs, ensuring perfect load balancing. Unlike previous works focused on the MoE mechanism itself, our goal is to extend it to shadow model construction and reduce the high computational cost of inference attacks.
B Case Study: Model Augmentation-based Shadow Models
Model augmentation introduces variations in data, architectures, or training procedures to enhance machine learning models, improving generalization and robustness. Techniques such as dropout and data augmentation have been widely used for ensemble learning 255. continual learning (26). adversarial attacks [27] 28 [2)] and
Neural masking 330 28 is typical model augmentation approach, which randomly prunes the weight of model parameters of a base model W with a probability of p. The resulting weights of an augmented model W aug computed as follows:
Wang = Wf ② (1 E(W,
where 1 denotes the all-ones matrix with the same size as the weight of the base model, C represents the Hadamard product that performs element-wise multiplication on the weights, and & refers to specific augmentation technique.
Model augmentation provides alternative approach to generating multiple augmented models derived from a base network. These augmented models are post-processed variations of the base network, which not stored or trained, thus reducing the overall cost of shadow model construction. Specifically, we employ neural masking to enlarge the set of trained shadow models for inference attacks by scaling model weights and generating diverse augmented models.
We explore varying levels of weight modification by focusing on either the fully connected layers (i.c., FC-p) or the convolutional layers (i.c.. Conv-p). We target the last fully connected layers, closest to the model outputs and are commonly utilized in various inference attacks 9 13 [4] 31 64). Conversely, pruning weights in the convolutional layers proves advantagcous due to its impact larger number of weights, resulting in more diverse augmented models. For example, in ResNet18, the last fully connected layer accounts for only 0.46% of the parameters, while the convolutional layers comprise approximately 99%.
We evaluate different augmentation settings on an MIA, LiRA 91 using CIFARION 100 and ResNet 8. To ensure the augmented models remain close to the base network while preserving similar generative capacity, we carefully adjust the scale of weight modifications, constraining the test error loss to
23

---

within 10%. For this, we set thresholds of 0.1 and 0.2 for FC and 0,05 and 0.08 for Conv. We start by constructing base shadow models quantities of 8. 16, 32, and 64, then generate one augmented model for each base model, outlined in Algorithm 2 As result, the total number of shadow models doubles after augmentation for Conv-p and FC-p.
Algorithm 2: Model Augmentation-basee Shadow Model Construction
Input:
Training algorithm T. Auxiliary datasct D Augmentation algorithm Aug.
Output: Shadow models {dís, M'' 1M 1i-1-
Construct shadow training subsets D Day DA2 .... D M randomly sample from Da
for 1; S
Train hase model Mr T(DA,):
Angment model 3,," (M,
end
return (Ma₁ Ms. M
Algorithm 3: SHAPOOL: MoE-based Shadow Model Construction
Input: MoF model f. training dataset D.., fine-tuning cattaset Dyp number of experts M,
number of layers number shared models
Output: Trained MoE model f. data-tn data-tt-pathwayy mapping matrix B3 selected pathway set S.
Before training: Pathway-choo
routing
Randomly split D,, into M subsets: D
Enumerate all possible pathways (Pw)a-i
Construct mapping matrix B between F3 and (P )
w=
// In training: Pathway regularization
foreach (ar, 1/) E
Randomly select two different pathways P.
Pa:
Compute intermediate output Nu using Eq.
Compute prediction p1 f(2; P:
Compute intermediate oulput hg using Eq.
Compute prediction p2 f(z; Pa]:
10
Update model parameters of f using Ey. 6
11
end
Fine tuning: Pathway alignment
12
Randomly select n pre trained pathways S;
13
i |8| do
14
foreach (ar, y) D, do Compute prediction p + [xx; S.):: Update model parameters of using Co (c((p)))
15
16
17
end
18
end
19
return f. B.S. S:
C Experimental Details and Additional Results
C.1 Model Setup
In our experiments, both the target and conventional shadow models adopt the same architecture. Excluding the initial and classification layers, we construct the shadow pool by dividing the remaining architecture into multiple expert layers. They are trained for 100 epochs with a batch size of 64 and
an initial learning rate of O. We use the SGD optimizer with weight decay of 5 10-4 and momentum of 0.9, along with a cosine learning rate schedule (65) for optimization.
Our experiments replace the conventional shadow models with shared models generated from SHAPOOL. For LiRA-offline, relatively weaker attack, we remove the pathway regularization (PR) module from SHAPOOL and set the fine-tuning epoch to 3 in the pathway alignment (PA) module. In contrast, LiRA-online is equipped with the PR module for SHAPOOL and sets the fine-tuning epoch to 10 in PA. This difference arises from the sensitivity of attacks for shadow models.
All experiments are implemented in Pytorch and performed on an NVIDIA RTX-3090 server with the Ubuntu operating system.
24

---

C.2 Off-the-shelf MIAs
We adopt two off-the-shell MIAs to demonstrate the effectiveness of SHAPOOL, including: LiRA [9] requires training multiple shadow models, where half are IN models trained on the query example, and the remaining half are OUT models that have not seen the example. It collects scaled logits from shadow models, fits them into two Gaussian distributions, and uses a likelihood-ratio test to determine the membership status of the query example. There are two attack modes: LiRA-online, which relies on two Gaussian distributions for members and non-members, and LiRA-offline, which relies solely on the Gaussian distribution of non-members.
RMIA [ introduces fine-grained modeling of the null hypothesis (OUT models) within the likelihood ratio test framework. As with LiRA, comes two variants: RMIA-online and RMIA- offline. By introducing reference models and population data samples to reduce reliance shadow models, both modes achieve comparable performance. In our experiments, report the average attack results of 1,000 query examples.
25
Member
Member
Non-member
Non-member
20
Frequency
1.5
19
0.3
0.2
0.1
0.0
0.1
0.2
03 -33
0.2
0.1
0.0
0.1
0.2
0.3
log logits
log logits
(a) w/o PA
(b) with PA (Epoch=5)
Figure 5: (a) Distribution of shared models of vanilla MoE. (b) Distribution of shared models after pathway alignment. We present the model output (i.e., scaled logits) distributions for both training (member) and test (non-member) data points using ResNet18 and CIFARIO0. The red and blue curves represent the distributions of the target model, while the pink and sky-blue curves illustrate that shared models from a shadow pool. Since the target model is trained independently, we align the outputs of shared models better resemble it through pathway alignment.
AUC
AUC
0.91
(PR 1R=1%
8
6.07
TPR@-PR=11%
0.46
0.30
AUC
42
0.92
0.03
-036
02
0.5
12
25
035
12
Fine-tuning Epoch
Fine-tuning Epoch
(a) LiRA-online
(b) LiRA-offline
Figure Effect of Fine-tuning Epoch.
C33 Additional Experimental Results
C.3.1
Comparison with Other Baselines
We consider the BASE method as an ideal baseline for training shadow models, as it independently trains shadow models with the same architecture and same data distribution as the target. As such, BASE is natural and widely adopted approach, especially in black-box MIAs. The only disadvantage its high computational cost, which the main motivation of this paper to train shadow models with lower costs.
25

---

Regarding alternative shadow model construction strategies, naive approaches such as simple model augmentation have demonstrated only limited effectiveness. In addition, R2 [66] introduces attack D, which leverages distilled models to approximate the OUT world of a query example. We refer to this baseline as Distilled. As shown in 3 this approach delivers suboptimal performance regardless of whether 64 or 128 distilled models are employed. Such results can be attributed to two reasons. First, while distilled models focus on the OUT world, SHAPOOL considers both IN and OUT worlds. Moreover, distilled models are not well-suited for constructing IN worlds, as the soft-labeling technique mitigates model overfitting-2 common defense against MIAs [67 68). Second, each distilled model is still trained from scratch using soft-labeled population samples, meaning it does not reduce the training cost of shadow models. In contrast, SHAPOOL refines the shadow model training process by utilizing shared models, significantly reducing the computational cost of MIAs.
Table 5: Various baselines on CIFAR 100 and ResNet18 (LiRA-online).
Method
AUC
TFI
Costch)
BASE
0.94
0.53
16.0
Distilledr64)
0.17
1.85
Distilledd 128)
0.83
0.21
3.45
SHAPOOL
0.93
0.53
4.0
C.3.2 Performance on More Datasets
Attack Performance and Computational Cost on CINIC1O. We now evaluate the performance of SHAPOOL on the CINICIO dataset using ResNet18. The experimental results in daboostdettsttttee that proposed method significantly reduces training costs while preserving comparable attack effectiveness, thereby enabling low-cost yet high-accuracy inference attacks. Moreover, Figure / presents the ROC curves of our proposed approach CINIC10, further demonstrating the superiority of SHAPOOL on attack performance.
Table 6: Attack performance and computational cost of LiRA on CINICIO. TF1 denotes TPR @ FPR=1% and results indicate changes in attack performance smaller than 0.02.
LIRA
METHOD
AUC
TFI
COST
AUC
TFI
COST
CONSTRAINED SCENARIO
0.09
1.25
SHAPOOL
0.68
0.13
1.24
0.75
0.15
1.55
+0.07
+0.02
+0.16
+0.06
UNCONSTRAINED SCENARIO
BASE SHAPOOL
0.61
0.14
40.3
0.77
0.22
82.8
0.70
0.15
4.8
0.77
0.21
6.2
+0.09
4 88%
933%%
Attack Performance and Computational Cost on Tiny ImageNet. In addition to the relatively small-scale datasets used in the previous experiments, we further evaluate SHAPOOL on a larger and more challenging dataset. Specifically, we conduct experiments TinylmageNet, subset derived from ImageNet, using ResNetl under the unconstrained setting. Table provides further evidence supporting the effectiveness of our approach.
Table 7: Performance and cost of RMIA TinyImageNet.
RMIA-OFFLIV INE
RMIA-ONTINE
Method
AUC
TF1
TF01
COST
AUC
TF1
TFD1
COST
BASE
0.99
0.95
0.86
28.1h
0.99
0.94
0.84
61.9h
SHAPOOL
0.99
0.94
0.87
7.9h
0.99
0.95
0.88
16.
+0.04
744
26

---

107
10-4
10-1
Tue Rosiivv 8ato
Tue Pezióve Rote
10"2
10-2
10-2
10-3
aucedio7s
suc- 6.752
10-3
10-3
10
Folse Positive Rate
Fulse Positive Rate
(a) constrained LiRA-offling
(b) constrained LiRA-online
107
10'
10-1
10
Thue Rostive Rate
10
Rolibve
10
10
Bac-5 2,02
10
6.77
SASED0I
SHAR00G (ntine))
10
10a
10
10
10
10
10
10
10
10
10"
10
10
10
False Positive Rate
False Positive Rate
(c) unconstrained LiRA-offline
(d) unconstrained LiRA-online
Figure 7: Comparing the true positive rate vs. false positive rate of our method on the CINICIO dataset. (a)-(b) constrained scenarios for LiRA-offiine/online (c)-(d) unconstrained scenarios for
LiRA--offine/online
C.3.3 More Ablation Studies
We conduct additional ablation studies to investigate the impact of different settings on attack performance using CIFARI00 and ResNet18, where shadow pool is prepared and shared models are randomly selected accordingly.
Size of Training Set Dirl- SHAPOOL construets shadow pool with numerous shared models, resulting in more parameters compared to a single shadow model, which naturally demands more training data. We now examine the impact of training set size attack performance, relative to the size of the training subset used for conventional shadow model training. Table [ presents the results for different scales of training datasets. Ao represents the size of the training subset for shadow model trained independently. Both D and |D are sampled from the auxiliary dataset, but we use different notations distinguish the training set of the shadow pool from that of an individual shadow model. We observe that the performance of SHAPOOL improves significantly after incorporating an additional 20% of data points, and then stabilizes with further increases.
Size of Fine-tuning Set DDyl- Pathway alignment fine-tune tne-tunes the selected pathways to reduce generalization mismatch the training set D,,- Here, examine the effect of the fine-tuning training set size, as shown in Table TO The percentage represents the ratio of D, to a training set Dr,. Notably, there is overlap between D, and Dtr. indicating that the training can be reused without introducing new data. We find that even a small fine-tuning dataset can achieve stable attack performance.
Fine-tuning Epochs. We explore the effect of the fine-tuning epochs in pathway alignment, as shown in Figure 6 The results show that the fine-tuning epoch has a limited effect on the LiRA-offline attack, while a larger epoch (e.g., greater than 15) leads to nearly stable attack performance for both attacks. This difference stems from specific algorithms: LiRA-offline relies non-member output distributions, which are initially similar in Figure(3) [S] This demonstrates that our pathway alignment requires minimal fine-tuning costs mitigate generalization mismatch.
Number of Experts. The above experiments use four experts in SHAPOOL for ResNet18 by default; explore whether other settings influence the attack performance. As shown in Table 9
27

---

find that introducing more experts improves attack performance, especially for the LiRA-online attack, as more experts enhance the diversity among shared models.
Table 8: Effect of the training
Table 9: Effect of the number of experts.
Table 10:
Effect of the fine-
set Dr on TF1.
tuning set [Py] on TF1.
LiRA-online LiRA-offline
M LiRA-anline LiRA-offliee
[P,]
LiRA-online LiRA-ofline
1.0
0.33
0.22
0.39
0,35
1.2
0.37
0.28
0.42
0.33
1000 (2.5%)
3000 (7.5%)
0.41
0.31
1.4
0.38
0.30
0.44
0.32
5000 (12.5%)
1.6
0.36
0.32
0.47
0.28
Performance under Fixed Costs. Take LiRA-online on CIFARI00 with ResNet18 as an example. A single SHAPOOL outperforms four individual shadow models under the same compute budger. Furthermore, four SHAPOOLs at a cost equivalent 16 individual models nearly match the performance achieved by using 128 shadow models. Table [T suggests that SHAPOOL consistently outperforms LiRA across a range of fixed compute budgets.
Table 11: Performance of LiRA-online with varying budgets on CIFARI00 (AUC/TF1)
#SHAPOOL ASM
(=+)
(=8)
(
(
BASE
0.900034
0.9310.44
0.94/U.46
0.93A0.49
0.92/0.42
0,93/0.48
0.93/.500
Algorithm 4: WEA.HHH--Laase Property Inference Attacks
Input: Predefined values to and f1; Attack dataset Dattack; Shadow dataset D; Attack algorithm A: Target model M; MoE. models fo and fı; Epoch
Output: Inferred property value i E {to,
for i E 1} do
Initialize mapping matrix of Sa via pathway-choice routing:
for j 1 E' do
Sample Di,;, Dł, C D such that P(D),) P(D),) = Randomly select pathways Pı and pa in fú;
Train and p2 jointly using pathway regularization on D and D
end
Randomly select a set pathways S C fsi foreach pathway E S do Record confidence scores: + f((Dattact:P):
10
end
13 end
Construct A using distributions: No co, Ni
Collect confidence scores: M (Dattack::
16
Compute probability: +- A(c| No), E A(e Ni);
return f arg max l;; (e(0.1)
C.4 Extension to Property Inference Attacks
Although our experiments primarily focus on MIAs, SHAPOOL can be extended to other attacks such as black-box property inference attacks (PIAs), which aim distinguish statistical properties (c.g.. between to and t1) [13 [13] [4]. To adapt SHAPOOL for PIAs, we can modify the training data of each pathway that SHAPOOL trained on data satisfying to (or f1), thereby replacing the multiple shadow models traditionally trained for each predefined property, as illustrated in Algorithm
Table 12: Performance of BASE and SHAPOOL on PlAS using the Census dataset (Accuracy)
Ace (Propertyssex)
(mroperty=mce)
Cost (h)
BASE
0.5125
0.8594
12.8
SHAPOOL
0.5243
0.8438
0.9
28

---

Following prior works on PIAs [14], we conduct experiments on the Census dataset [69], focusing on two target properties: sex ("Female") and race ("Black")) We aim to distinguish between 0.3 and 0.5 for the sex property, and between 0.05 and 0.15 for the race property. Specifically, we use a four-layer MLP with layer sizes of 32, 16, 8, and 4, employing ReLU activation functions. For the baseline PIAs (i.e., BASE), we build 32 shadow models for each predefined ratio, whereas in our method (i.c., SHAPOOL), we construct four shadow pools, each consisting of four MoE layers with two experts per layer, and select eight pathways for inference attacks. The comparison results, presented in Table T2] demonstrate that our method achieves comparable inference performance while significantly reducing training costs.
29


Reviews:
[{"review_id": "Yom1ZXWU3M", "reviewer": "Reviewer_ru5X", "summary": "This paper aims to tackle the problem of efficient membership inference attacks—specifically, how to reduce the number of shadow models required for such attacks. To this end, the paper proposes a novel shadow pool training framework, SHAPOOL, which constructs multiple shared models and trains them jointly within a single process. In addition, the authors introduce three novel modules—path-choice routing, pathway regularization, and pathway alignment—to ensure that the shared models closely resemble independently trained models and can serve as effective substitutes.", "questions": "See Weakness above.", "limitations": "Yes.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "Strengths:\n- The studied problem is interesting and important to the community.\n- The motivations for the studied problem and the proposed solution are both very sufficient.\n- The writing and the structure of the paper are good.\n- My expertise is not in the field. However, the paper provides necessary background information for me to understand the problem setting.\n- The proposed method makes sense in general.\n\nWeaknesses:\n- Experiments: The existing experiments are conducted Cifar10, Cifar100, and CINIC10. Could you also provide some experiments on datasets of large image size, e.g., ImageNet-Subset?", "was_revised": true, "final_justification": "My concerns have been well addressed. Therefore, I keep my score.", "rebuttal": "Thank you very much for your time and valuable comments, most of which are positive and encouraging. Due to very tight rebuttal schedule, for your suggestion to conduct experiments on larger-image datasets, we use the TinyImageNet [1] derived from ImageNet and ResNet18 under the unconstrained setting for RMIA. The results, presented below, provide further support for our approach. We will consider using even larger-image datasets in the final version of this paper.\n\n[1] Ya Le and X Yang. Tiny ImageNet Visual Recognition Challenge. 2015.\n\nTable: Performance and cost of RMIA on TinyImageNet.\n\n|       |**RMIA-OFFLINE**||||**RMIA-ONLINE**||||  \n|-------|---|---|----|----|---|---|----|----|\n|       |AUC|TF1|TF01|COST|AUC|TF1|TF01|COST|\n|BASE   |0.99|0.95|0.86|28.1h|0.99|0.94|0.84|61.9h|\n|SHAPOOL|0.99|0.94|0.87|7.9h |0.99|0.95|0.88|16.1h|\n|Δ      |=   |=   |=   |↓72% |=   |=   |+0.04|↓74% |"}, {"review_id": "q6dprSRFqO", "reviewer": "Reviewer_Y9em", "summary": "This paper proposes SHAPOOL, a shared shadow model training framework based on MoE, to reduce the computational cost of inference attacks through joint training with subnetwork sharing. The paper designs three main modules Pathway-choice Routing,  Pathway Regularization, and  Pathway Alignment to address the real-world challenges of MoE, and experiments show that the framework is able to have a low computational overhead against membership inference attacks.", "questions": "- Why did the performance comparison in the experiment only compare BASELINE and not the other  related methods?\n- How many times has the experiment been run and how stable is it?\n- Considering that the construction of shadow models is actually very dependent on training data, is the performance of the model maintained when only a small amount of data is available?", "limitations": "Yes", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths：\n\n- Although the use of MoE to enhance the performance of shadowing models is rather intuitive, it is also a way to bring new research perspectives to existing studies.\n- The article has a logical narrative, relatively adequate experiments, and open source code.\n\nWeaknesses：\n\n- Many of the statements in the main text reflect that the paper focuses on inference attacks rather than specifically on MIA, but only MIA is used in terms of both framework design and experimental evaluation. Therefore, the paper lacks focus in some of the narratives and lacks experimental validation of other inference attacks such as FIA (in fact, other inference attack methods may not require the use of shadow models, which also leads to a conflict with the concept of inference attack referred to in the article).\n- In addition to the intuitive introduction of the MoE approach, the design of the three core modules is actually rather intuitive, so I am pessimistic about the real contribution of these approaches.\n- An obvious flaw in the experimental design is that it only compares BASELINE and lacks comparisons with other shadow model building methods. As far as I know this part of the work is very extensive, so did the authors forget to compare with these or was the performance limited?\n- The experiment results are missing statistical data (e.g., variance, etc.).\n- The data font sizes in Figures 3 and 6 are too small and can be adjusted subsequently.", "was_revised": true, "final_justification": "The authors have taken most of my concerns into consideration. However, the W1 and W2 still need improvement.", "rebuttal": "We sincerely appreciate your time of reviewing our paper and insightful suggestions. We now address your concerns in details below.\n\n> Q1&W3: About baseline and related methods.\n\nWe consider the BASE method as an ideal baseline for training shadow models, as it independently trains shadow models with the same architecture and same data distribution as the target. As such, BASE is a natural and widely adopted approach, especially in black-box MIAs. The only disadvantage is its high computational cost, which is the main motivation of this paper to train similar quality of shadow models with much lower cost.\n\nRegarding alternative shadow model construction strategies, naive methods such as simple model augmentation have shown limited effectiveness in our context. The work [R1] proposed a distilled construction strategy, where shadow models are generated from a pre-trained model via distillation. However, as shown in the table below, this approach yields suboptimal performance—whether using 64 or 128 distilled models.\n\nTable 1: RMIA-online version on CIFAR100 and ResNet18.\n|Method|AUC|TPR@FPR=1%|Cost(h)|\n|------|---|----------|-------|\n|BASE|0.94|0.53|16.0|\n|Distilled(64)|0.85|0.17|1.85|\n|Distilled(128)|0.83|0.21|3.45|\n|SHAPOOL|0.93|0.53|4.0|\n\n[R1] Ye J, Maddi A, Murakonda S K, et al. Enhanced membership inference attacks against machine learning models[C]//Proceedings of the 2022 ACM SIGSAC conference on computer and communications security. 2022: 3093-3106.\n\n\n> Q2&W4: Experiments setup and stability.\n\nWe ran each experiment five times with different random seeds, as described in Section 5.1. To address your concern, we update Tables 1 to include standard deviation as below. Compared to BASE, our results show the same or slightly higher fluctuations in AUC and FPR.  \n\nTable 1 - LiRA-offline attack\n|Dataset |Method  |ResNet18 AUC|TF1 |Cost|VGG16 AUC|TF1 |Cost|WRN28-10 AUC|TF1 |Cost|\n|--------|--------|------------|-----|----|----------|-----|----|-------------|-----|----|\n|CIFAR100|BASE    |0.73±0.00   |0.22±0.03|0.5±0.10|0.69±0.01|0.16±0.01|0.4±0.06|0.76±0.02|0.30±0.01|2.4±0.11|\n|        |SHAPOOL |0.82±0.01   |0.32±0.04|0.4±0.10|0.76±0.01|0.17±0.05|0.5±0.08|0.81±0.02|0.27±0.04|1.9±0.06|\n|        |Δ       |+0.09       |+0.10     |-        |+0.07     |=       |-       |+0.05     |-0.03    |-       |\n|CIFAR10 |BASE    |0.51±0.01   |0.06±0.00|0.5±0.13|0.56±0.01|0.04±0.00|0.4±0.08|0.55±0.02|0.08±0.01|2.2±0.06|\n|        |SHAPOOL |0.63±0.02   |0.09±0.02|0.5±0.09|0.64±0.02|0.09±0.02|0.4±0.14|0.60±0.02|0.08±0.02|1.6±0.14|\n|        |Δ       |+0.12       |+0.03     |-        |+0.08     |+0.05   |-       |+0.05     |=        |-       |\n\nTable 1 - LiRA-online attack\n|Dataset |Method  |ResNet18 AUC|TF1 |Cost|VGG16 AUC|TF1 |Cost|WRN28-10 AUC|TF1 |Cost|\n|--------|--------|------------|-----|----|----------|-----|----|-------------|-----|----|\n|CIFAR100|BASE    |0.90±0.00   |0.34±0.01|1.0±0.10|0.86±0.00|0.25±0.03|0.9±0.04|0.90±0.01|0.36±0.03|3.6±0.11|\n|        |SHAPOOL |0.92±0.01   |0.42±0.04|1.0±0.13|0.88±0.01|0.25±0.02|0.9±0.15|0.91±0.01|0.42±0.04|3.4±0.08|\n|        |Δ       |+0.02       |+0.08     |-        |+0.02     |=       |-       |=         |+0.06    |-       |\n|CIFAR10 |BASE    |0.69±0.00   |0.11±0.01|1.0±0.11|0.67±0.00|0.07±0.01|0.9±0.08|0.67±0.02|0.09±0.01|4.4±0.07|\n|        |SHAPOOL |0.71±0.03   |0.11±0.03|1.0±0.13|0.69±0.02|0.10±0.02|1.2±0.13|0.69±0.02|0.12±0.02|4.5±0.06|\n|        |Δ       |+0.02       |=         |-        |+0.02     |+0.03   |-       |+0.02     |+0.03    |-       |\n\n\n\n> Q3: Impact of the amount of available shadow dataset.\n\nWe agree with you that the amount of available training data can affect performance, as discussed in Appendix D. Since our method is based on an MoE model with more parameters than an individual model, sufficient training data can achieve good performance. Nonetheless, only when the available data is extremely limited, for instance, less than 1.2× the amount used for an individual shadow model, the performance of SHAPOOL may degrade, as shown in Table 6 of Appendix C.3.\n\n\n> W1: SHAPOOL’s generality\n\nAlthough our experiments primarily focus on MIAs, SHAPOOL can be extended to other attacks such as black-box property inference attacks (PIA) [1, 2], which aim to distinguish statistical properties (e.g., between $t_0$ and $t_1$). To adapt SHAPOOL for PIA, we can modify the training data of each pathway so that one SHAPOOL is trained on data satisfying $t_0$ and the other on $t_1$, replacing the shadow models for each property, as shown in the pseudo-code below. While we are currently developing the PIA pipeline and conducting experiments, the results may not be completed by the end of this rebuttal. Nonetheless, we will report these results in the final version of this paper.\n\n[1] Mahloujifar S, Ghosh E, Chase M. Property inference from poisoning[C]//2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022: 1120-1137.    \n[2] Chaudhari H, Abascal J, Oprea A, et al. SNAP: Efficient extraction of private properties with poisoning[C]//2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023: 400-417.\n\n\n********\n*Algorithm: SHAPOOL-based Property Inference Attacks*  \n**Input**: Predefined values $t_0$ and $t_1$;  Attack dataset $D_{attack}$; Shadow dataset $\\mathcal{D}$; Attack algorithm $\\mathcal{A}$;  \nTarget model $M$; MoE model $f$;    \n**Output**: Inferred property value $\\hat{t} \\in \\{t_0, t_1\\}$  \n**For** $i \\in \\{0, 1\\}$:  \n Initialize mapping matrix of $f_i$ via pathway-choice routing  \n **For** $j = 1$ **to** $m$:  \n  Sample $D_{i,j}^1, D_{i,j}^2 \\subset D$ such that $P(D_{i,j}^1) = P(D_{i,j}^2) = t_i$  \n  Randomly select pathways $p_1$ and $p_2$ in $f_i$  \n  Train $p_1$ and $p_2$ jointly using pathway regularization on $D_{i,j}^1$ and $D_{i,j}^2$  \n **End For**  \n Randomly select $n$ pre-trained pathways $S \\subset f_i$  \n **For each** pathway $p \\in S$:  \n  Fine-tune $p$ via pathway alignment  \n  Record confidence scores: $c_i \\leftarrow p(D_{attack})$  \n **End For**  \n**End For**  \nConstruct $\\mathcal{A}$ using distributions:\n    $N_0 \\sim c_0$, $N_1 \\sim c_1$  \nCollect confidence scores: \n    $\\mathbf{c} \\leftarrow M(D_{attack})$  \nCompute probability:\n    $\\ell_0 \\leftarrow \\mathcal{A}(\\mathbf{c} \\mid N_0)$, \n    $\\ell_1 \\leftarrow \\mathcal{A}(\\mathbf{c} \\mid N_1)$  \nReturn: $\\hat{t} \\leftarrow \\arg\\max\\limits_{i \\in \\{0,1\\}} \\ell_i $\n********\n\n> W2: Design of three modules.\n\nWe agree that the modules are based on intuitive principles; however, their novelty lies in adapting MoE for shared shadow model construction through minimal yet effective modifications. As demonstrated in our ablation study (Figure 5 and Table 4), each module contributes meaningfully to the final attack performance. Moreover, the simplicity of our design facilitates easy integration, while achieving comparable or even superior performance (Tables 1 and 2) compared to traditional shadow model construction methods.\n\n\n> W5: Experimental figure settings.\n\nWe will revise Figures 3 and 6 to improve readability in the final version."}, {"review_id": "Ue5qCBtz0h", "reviewer": "Reviewer_rfXF", "summary": "The paper introduces a novel method of training shadow models for inference attacks that is more computationally efficient and in specific settings outperforms the baseline method of training shadow models independently.", "questions": "1. Could you explain what \"Extension to Other Inference Attacks\" means and what you mean by prior work is \"coupled with specific algorithms\"?\n\n2. How does the full ROC-curve comparison between your attack and LiRA & RMIA look like for the experiments you have already run?\n\n3. Does your attack perform as well as RMIA in the low reference model (<= 4) setting?\n\n4. Does your attack outperform (in terms of computational time and attack performance) LiRA across a range of fixed compute budgets?", "limitations": "yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n1. Their method is novel and interesting.\n2. The improvements to computational cost appear significant.\n\n**Weaknesses**  \n_1. Unsubstantiated Claims_  \nThere are some claims that are left entirely unsubstantiated in the paper. Specifically, the authors make the claim that their method is \"more generalizable\" than prior work. However, I do not fully understand the claim that prior work is \"coupled with specific algorithms\" and is not cited in the Introduction. What do the authors mean by this and where does this claim come from? Furthermore in the Evaluation section under \"Extension to Other Inference Attacks\", the authors claim that Table 3 shows that their method generalizes across different attacks. But I do not see how Table 3 shows that since the attack they compare against (RMIA) is also a membership inference attack. I was expecting the authors to compare their SHAPOOL method with LiRA and RMIA across different attack types, e.g., property inference and model inversion in order to make this claim.\n\n_2. Additional Experiments_  \nI am not entirely convinced that the authors' main claims are fully substantiated either. First, Tables 1 and 2 are missing TPR@FPR=0.1%, even though the authors had indicated this was a metric they were interested in studying. Furthermore, I cannot find full ROC curves for any of the experiments and this is not discussed in the experiments. Specifically, I would like to see whether there are regions of FPRs that their method underperforms prior work. Lastly, Tables 1 and 2 only really compare one configuration for the constrained and un-constrained settings, each. I do not think this is enough for the authors to claim that the computational cost gains are always justified. Here, I think it's important for the authors to vary the number of shadow models and shadow pools for LiRA and SHAPOOL, respectively and compare the two based on the computational cost. Basically, the analogue of Figure 3 from the arXiv version of the RMIA paper.\n\n_3. Unfair comparisons_  \nI am not really sure why the authors are comparing their method against LiRA under the constrained scenario. Shouldn't they compare against RMIA since it is already known that RMIA beats LiRA in resource-constrained settings? Also it seems odd that Table 3 uses 64 shadow models for RMIA when 4/8 is supposedly enough. Again going back to point 2. this I believe further motivates the authors to do a comparison between SHAPOOL, LiRA, and RMIA across different number of models/computational costs.  \n\n_4. Writing Improvements_  \nJust some minor points, \"Bhattacharya coefficient\", \"CINC10\" are missing citations. Hardware details (i.e., number and type of GPUs) also seem missing from the Experimental Details section.", "was_revised": true, "final_justification": "The authors have taken the time to faithfully engage in the rebuttal process and have addressed all of the concerns that I have raised, even responding with updated results. Therefore I feel confident in recommending this paper to be accepted. I would just like to point out that there are two main results from the discussions that I would like to see in the main paper as well, which I had also mentioned to the authors during the rebuttal discussion. Namely:\n\n1. Comparison with RMIA in constrained resource setting.\n2. Comparison between SHAPOOL and LiRA/RMIA under fixed compute budget", "rebuttal": "Thank you very much for your thorough review and thoughtful suggestions. We have carefully addressed each concern, as detailed below.\n\n> Q1&W1: SHAPOOL’s generality and relation to attack-specific methods.\n\n(1) The section \"Extension to Other Inference Attacks\" refers to applying SHAPOOL to different MIA algorithms, rather than other types of inference attacks. Although our experiments primarily focus on MIAs, the proposed method can be extended to other inference attacks such as black-box property inference attacks (PIA) [1, 2], which aim to distinguish between statistical properties (e.g., $t_0$ vs. $t_1$). To adapt SHAPOOL for PIA, we can modify the training data for each pathway such that one SHAPOOL is trained on data satisfying $t_0$ and the other on $t_1$, replacing the shadow models for each property. We present the pseudo-code as follows. While we are currently developing the PIA pipeline and conducting experiments, the results may not be completed by the end of this rebuttal. Nonetheless, we will report these results in the final version of this paper.\n\n[1] Mahloujifar S, Ghosh E, Chase M. Property inference from poisoning[C]//2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022: 1120-1137.  \n[2] Chaudhari H, Abascal J, Oprea A, et al. SNAP: Efficient extraction of private properties with poisoning[C]//2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023: 400-417.\n\n\n********\n*Algorithm: SHAPOOL-based Property Inference Attacks*  \n**Input**: Predefined values $t_0$ and $t_1$;  Attack dataset $D_{attack}$; Shadow dataset $\\mathcal{D}$; Attack algorithm $\\mathcal{A}$;  \nTarget model $M$; MoE model $f$;    \n**Output**: Inferred property value $\\hat{t} \\in \\{t_0, t_1\\}$  \n**For** $i \\in \\{0, 1\\}$:  \n Initialize mapping matrix of $f_i$ via pathway-choice routing  \n **For** $j = 1$ **to** $m$:  \n  Sample $D_{i,j}^1, D_{i,j}^2 \\subset D$ such that $P(D_{i,j}^1) = P(D_{i,j}^2) = t_i$  \n  Randomly select pathways $p_1$ and $p_2$ in $f_i$  \n  Train $p_1$ and $p_2$ jointly using pathway regularization on $D_{i,j}^1$ and $D_{i,j}^2$  \n **End For**  \n Randomly select $n$ pre-trained pathways $S \\subset f_i$  \n **For each** pathway $p \\in S$:  \n  Fine-tune $p$ via pathway alignment  \n  Record confidence scores: $c_i \\leftarrow p(D_{attack})$  \n **End For**  \n**End For**  \nConstruct $\\mathcal{A}$ using distributions:\n    $N_0 \\sim c_0$, $N_1 \\sim c_1$  \nCollect confidence scores: \n    $\\mathbf{c} \\leftarrow M(D_{attack})$  \nCompute probability:\n    $\\ell_0 \\leftarrow \\mathcal{A}(\\mathbf{c} \\mid N_0)$, \n    $\\ell_1 \\leftarrow \\mathcal{A}(\\mathbf{c} \\mid N_1)$  \nReturn: $\\hat{t} \\leftarrow \\arg\\max\\limits_{i \\in \\{0,1\\}} \\ell_i $\n********\n\n(2) By “coupled with specific algorithms,” we mean that prior works such as [10, 12, 13] are specific attack algorithm, not general-purpose shadow model construction techniques and thus cannot be easily reused across different attacks. In contrast, SHAPOOL focuses purely on shadow model construction, making it more flexible for integration into different attack pipelines.\n\n> Q2&W2: Description of the full ROC-curve comparison.\n\nSHAPOOL serves as a shadow model construction method that can be integrated into existing MIA frameworks such as LiRA and RMIA. Per your question, it yields ROC curves similar to the BASE versions under the same attack algorithm, with only some fluctuations and occasionally lower (less than 0.05) performance than BASE. Due to format constraints in this rebuttal, we are unable to enclose  the full ROC curves here but will provide them in the final version of this paper.\n\n> Q3: The performance of fewer SHAPOOLs.\n\nAccording to the ablation study (Figure 3b), we think that using fewer SHAPOOLs may lead to degraded performance and fall short of RMIA’s optimal results. Nonetheless, this is expected as the RMIA’s optimal results use unlimited number of individual shadow models, which incurs infeasible computational cost. \n\n> Q4&W2&W3: Performance under fixed compute budget.\n\nTake LiRA-online on CIFAR100 with ResNet18 as an example. A single SHAPOOL outperforms four individual shadow models **under the same compute budget**. Furthermore, four SHAPOOLs—at a cost equivalent to 16 individual models—nearly match the performance achieved by using 128 shadow models. These results suggest that SHAPOOL consistently outperforms LiRA across a range of fixed compute budgets. Supporting experimental results are provided below.\n\nTable 1: Performance (AUC/TF1) of LiRA-online with varying budgests on CIFAR100 (ResNet18)\n| #SHAPOOL (=SM)  | 1 (=4)   | 2 (=8)   | 3 (=12)  | 4 (=16)  |\n|---------------- |----------|----------|----------|----------|\n| BASE            | 0.90/0.34| 0.93/0.44| 0.94/0.46| 0.93/0.49|\n| SHAPOOL         | 0.92/0.42| 0.93/0.48| 0.93/0.50| 0.94/0.53|\n\n\n> W3: Clarification about experimental setup\n\n(1) Our goal is not to compare which MIA performs best under constrained settings, but to show how SHAPOOL improves the **efficiency** of shadow model construction. We use LiRA as a representative case and compare the performance of LiRA+BASE with that of LiRA+SHAPOOL.  \n(2) While RMIA reports stable AUC with 4/8 models, we find that key metrics like TF1 can continue to improve with more models (e.g., TF1 increases from 0.44 to 0.53 but AUC stays 0.93–0.94 for 2~64 shadow models). To fairly compare with SHAPOOL’s upper bound, we use 64 models for RMIA.\n\n> W4: Reference and hardware details.\n\nPer your suggestion, we add citations for the Bhattacharyya coefficient [1] and the CINC10 dataset [2]. The hardware details are included in Appendix C.1, that is, NVIDIA RTX 3090 GPUs with 24GB of memory.  \n[1] Bhattacharyya A. On a measure of divergence between two statistical populations defined by their probability distribution[J]. Bulletin of the Calcutta Mathematical Society, 1943, 35: 99-110.  \n[2] Darlow L N, Crowley E J, Antoniou A, et al. Cinic-10 is not imagenet or cifar-10[J]. arXiv preprint arXiv:1810.03505, 2018."}, {"review_id": "fR50jBWj2U", "reviewer": "Reviewer_xfRo", "summary": "The paper addresses the computational inefficiency in shadow model construction for inference attacks (e.g., membership inference) against machine learning models. The authors propose SHAPOOL, a framework leveraging the Mixture-of-Experts (MoE) mechanism to train multiple “shared” shadow models within a single process. Experiments across multiple datasets and settings demonstrate a significant reduction in computational costs, as well as competitive attack performance, compared to traditional approaches.", "questions": "- I'm a bit confused by the description of the method in Module 3: Pathway Alignment. The aim is to better mimic the behaviors of the target model. Does this process require access to confidence scores from the target model, align results only between experts within the MoE, or simply fine-tune certain experts using additional subsets of the training data?\n\n- The introduction discusses three existing methods for efficient shadow model training: QMIA, RMIA, and SNAP. But the experimental section only provides a direct comparison with RMIA. Is there any reason why QMIA and SNAP were not included in the evaluation?\n\n- I understand that the authors focus on three specific factors in Section 3 to maintain consistency with the subsequent challenges and method design. I wonder if there were additional aspects that could impact MIA performance. Exploring or discussing the potential impact of these additional factors would be more intriguing. \n\n- It's better to provide ROC curves for MIA result comparisons.", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "### Strengths\n- The proposed issue, computational cost of training shadow models, is a pressing bottleneck in the privacy attack community, especially for attacks such as LiRA.\n- Adapting MoE to address the issue is novel.\n- Comprehensive experiments across multiple settings demonstrate the effectiveness of the proposed method. \n\n\n### Weaknesses\n- Some parts seem confusing to follow.\n- Experiments could be further enhanced.", "was_revised": true, "final_justification": "The authors’ response has generally addressed my concerns. I would like to maintain my original assessment, as I believe there is still room for improvement in the manuscript.", "rebuttal": "We thank the reviewer for the constructive comments and address each issue raised below in detail.\n\n> Q1: Clarification about pathway alignment.\n\nThe pathway alignment module fine-tunes selected experts using additional subsets of the training data to mitigate under-training issues in the MoE model.  \nBy “mimic the behavior,” we mean training in a similar manner as the target model. But using confidence scores from the target model would result in a different training paradigm and is shown to reduce MIA effectiveness, as discovered in knowledge distillation-based defenses [1, 2].   \n[1] Tang X, Mahloujifar S, Song L, et al. Mitigating membership inference attacks by {Self-Distillation} through a novel ensemble architecture[C]//31st USENIX security symposium (USENIX security 22). 2022: 1433-1450.    \n[2] Mazzone F, Van Den Heuvel L, Huber M, et al. Repeated knowledge distillation with confidence masking to mitigate membership inference attacks[C]//Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security. 2022: 13-24.\n\n> Q2: About baseline choices.\n\nQMIA and SNAP are specific inference attack methods rather than shadow model construction techniques. QMIA does not use shadow models, making it incompatible with our framework, while SNAP focuses on property inference via poisoning, which falls outside the scope of our MIA experiments. In contrast, RMIA relies on shadow models, so we include them for comparison to evaluate how SHAPOOL enhances efficiency by replacing the original shadow model construction—i.e., comparing RMIA+BASE with RMIA+SHAPOOL.\n\n> Q3: Additional factors for MIA performance.\n\nWe acknowledge that MIA performance can be influenced by additional factors beyond the three key ones we focus on. In particular, while this work focuses on MIA attacks from a black-box perspective, in a white-box setting where the target model’s parameters are accessible, alignment between the shadow models and the target model in parameter space, such as producing similar gradients or intermediate results, may also influence attack effectiveness. We will consider these factors when we extend this work to white-box settings.\n\n> Q4: Suggestions about ROC curves. \n\nWe agree that ROC curves offer valuable insights. Due to format constraints in this rebuttal, we are unable to enclose the full ROC curves here but will provide them in the final version of this paper."}]

Author rebuttal:

Meta-review: This paper tackles an important computational bottleneck in common strategies for inference attacks--the use of independently trained shadow models. The reviewers agree that the use of a mixture-of-experts architecture is nice and novel. The authors have also addressed many questions initially raised by the reviewers.
Decision: Accept (poster)