📊 statistics

Membership Inference Risks in Quantized Models: A Theoretical and Empirical Study

This paper proposes a theoretically grounded, empirically estimable indicator to assess and rank the membership inference security of post-training quantized machine learning models, demonstrating its effectiveness through synthetic and real-world drug discovery datasets.

Original authors: Eric Aubinais, Philippe Formont, Pablo Piantanida, Elisabeth Gassiat

Published 2026-05-27

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Eric Aubinais, Philippe Formont, Pablo Piantanida, Elisabeth Gassiat

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Compressing Models Without Leaking Secrets

Imagine you have a very detailed, high-resolution photograph of a secret garden. This photo represents a Machine Learning Model trained on sensitive data (like medical records or chemical formulas). The photo is huge and takes up a lot of space, making it hard to send or store on small devices.

Quantization is like taking that high-resolution photo and compressing it into a smaller, lower-quality JPEG. You lose some tiny details (precision), but the main picture remains clear, and it's much easier to carry around. This is great for saving money and speed.

However, there's a worry: Does compressing the photo accidentally reveal more about the secret garden than the original? Or, conversely, does the "fuzziness" of the compression actually hide the secrets better?

This paper asks: When we compress (quantize) a model, how safe is it from "Membership Inference Attacks"?

The Threat: The "Did You Go There?" Detective

Imagine a detective (the Attacker) who sees the compressed photo (the Quantized Model) and wants to know: "Did this photo include a specific flower that I know you planted in your garden?"

If the answer is "Yes," the attacker learns something private about your data.
If the answer is "No," the attacker learns nothing.

This is called a Membership Inference Attack (MIA). The goal of the paper is to figure out how hard it is for this detective to guess correctly.

The Problem: The "Perfect Detective" is Too Hard to Simulate

Previously, to test if a model was safe, researchers would try to build the "perfect detective" using different strategies to see how well they could guess.

The Analogy: It's like trying to test a castle's security by hiring 1,000 different thieves to try breaking in. You have to build a new thief for every test, which takes a massive amount of time and money.
The Issue: The paper notes that calculating the true security level (called MIS - Membership Inference Security) is computationally impossible for large models because you'd need to simulate every possible attack strategy.

The Solution: A New "Security Meter"

The authors invented a new way to measure security without hiring a thousand detectives. They created a Security Meter (called $r_{Qn}$ ) that acts like a thermometer for privacy.

How it works (The Analogy):
Instead of hiring thieves, the authors look at the training process itself.

Imagine the model is a student taking a test.
When the model is "quantized" (compressed), it's like giving the student a slightly blurry version of the textbook.
The authors look at how much the student's score (loss) changes when they look at a specific question (data point) compared to the average.
The Metaphor: If the blurry textbook makes the student's score jump wildly and unpredictably for different questions, the model is secure (the detective can't guess). If the score stays very stable and predictable, the model is insecure (the detective can easily guess).

They derived a mathematical formula that calculates this "jumpiness" or variability.

High Variability = High Security (The model is safe).
Low Variability = Low Security (The model is vulnerable).

The Experiments: Testing the Meter

The authors tested their new "Security Meter" in two ways:

Synthetic Data (The Practice Garden):
They created fake, simple datasets. They compared their new Meter against the old method (hiring the "perfect detective").
- Result: The Meter gave the exact same ranking of security as the expensive detective method, but it was much faster (like checking a thermometer vs. waiting for a thief to break in).
Real-World Data (The Drug Discovery Lab):
They used real language models trained on chemical data (to help discover new drugs). They tested different compression levels (1-bit, 2-bit, 4-bit, etc.).
- The Finding: The Meter correctly predicted that heavier compression (making the model "blurrier" or using fewer bits) generally made the model more secure against these attacks.
- The Trade-off: Just like a blurry photo, if you compress it too much, the model stops being useful for its actual job (predicting drug properties). The paper found a "sweet spot" where you get good security without ruining the model's performance.

Key Takeaways

Compression helps privacy: Surprisingly, making a model "fuzzier" (quantizing it) can actually make it harder for attackers to steal private information about the training data.
No more "Perfect Detectives": You don't need to run expensive, complex attacks to know if a compressed model is safe. You can just use this new mathematical formula (the Meter) to estimate it quickly.
The Balance: There is a balance to strike. You want enough compression to be secure and efficient, but not so much that the model forgets how to do its job.

In short, the paper provides a fast, easy-to-use ruler to measure how safe your compressed AI models are, proving that sometimes, a little bit of "blur" is exactly what you need to keep your secrets safe.

Technical Summary: An Indicator of Membership Inference Security in Post-Training Quantized Models

Problem Statement
Quantization is a widely adopted technique for reducing the memory and computational costs of machine learning models, particularly for deployment on edge devices. While its efficiency benefits are well-documented, the impact of quantization on model privacy remains underexplored. Specifically, it is unclear whether reducing parameter precision inherently strengthens a model's resilience against Membership Inference Attacks (MIAs), which aim to determine if a specific data point was part of the model's training set.

Existing privacy evaluation methods rely heavily on empirical benchmarks using specific attack strategies. However, these approaches are limited because they depend on the attacker's specific knowledge and capabilities. To address this, the concept of Membership Inference Security (MIS) was introduced to characterize vulnerability against the strongest possible attacks, regardless of the attacker's knowledge. Yet, directly computing MIS is computationally prohibitive, as it involves estimating divergences between high-dimensional distributions. This paper addresses the gap in providing a practical, theoretically grounded, and attack-free indicator to evaluate and rank the privacy security of post-training quantized models.

Methodology
The authors propose a new MIS indicator derived from a theoretical asymptotic analysis of quantized learning procedures. The core theoretical insight is that, for large datasets, the MIS of a quantized learning algorithm is characterized by the distribution of per-sample losses across different quantized parameter configurations.

Theoretical Foundation: The paper establishes that as the dataset size $n$ increases, the MIS approaches 1 (indicating high security) at a rate determined by the loss landscape of the quantized models. Specifically, the rate is governed by the ratio of the squared gap between the expected losses of the best and second-best quantized configurations to the variance of the difference in their per-sample losses.
The MIS Indicator ( $r_{Q_n}$ ): Based on this asymptotic result, the authors define a new indicator:
$r_{Q_n} := \frac{1}{2} \min_{k>1} \frac{\left( \mathbb{E}[\ell(\bar{\theta}_n^k, z)] - \mathbb{E}[\ell(\bar{\theta}_n^1, z)] \right)^2}{\text{Var}\left( \ell(\bar{\theta}_n^k, z) - \ell(\bar{\theta}_n^1, z) \right)}$
where $\bar{\theta}_n^k$ represents the $k$ -th quantized parameter configuration sorted by expected loss, and $\ell$ is the loss function. This indicator is "attack-free" as it relies solely on the statistical properties of the loss function rather than training a specific adversary.
Estimation Strategy: Since the space of all possible quantized models is often exponentially large, the authors propose a practical estimation method. They observe that the indicator is empirically dominated by quantized models with the lowest loss. Therefore, they estimate $r_{Q_n}$ by analyzing the training trajectories of the model, specifically focusing on checkpoints and quantized versions of weights that exhibit low loss values.

Key Contributions

Theoretical Characterization: The authors prove that for large datasets, the MIS of a quantized learning procedure is fully characterized by the distribution of per-sample losses across quantized models (Theorem 3.4).
New Indicator: They introduce $r_{Q_n}$ , a novel, attack-free indicator that allows for the comparison of different quantization procedures based on their inherent privacy properties.
Practical Estimation: A methodology is presented to estimate this indicator using training trajectories, avoiding the computational infeasibility of enumerating all possible quantized states.
Empirical Validation: The approach is validated on both synthetic datasets and real-world applications, including drug discovery tasks using language models and molecular property prediction.

Results

Synthetic Data: Experiments on synthetic datasets demonstrate a strong Spearman correlation (average $\rho_{sp} = 0.86$ ) between the proposed $r_{Q_n}$ indicator and a baseline MIS estimation (which relies on training a discriminator to distinguish training members from non-members). The ranking of quantizers by privacy level is consistent between the new indicator and the baseline.
Stability: The proposed method achieves stable rankings with significantly fewer training runs (approx. 15 runs) compared to the baseline MIS method, which requires substantially more runs (approx. 150) to converge.
Real-World Applications (Language Models): In the context of drug discovery using fine-tuned LLMs (Qwen2.5), $r_{Q_n}$ successfully correlates with the performance of various black-box MIAs (including LiRa and LOSS-based attacks). Higher $r_{Q_n}$ values correspond to lower MIA performance (higher security).
Real-World Applications (Molecular Prediction): On molecular property prediction tasks, the study reveals a trade-off between performance and privacy. Stronger quantization (e.g., 1.58 bits with 90% sparsity) significantly improves privacy (higher $r_{Q_n}$ ) but incurs a performance cost (approx. 10% drop in AUROC for classification). Conversely, quantization at 2 bits or higher preserves performance but offers less privacy improvement.

Significance and Claims
The paper claims to fill a critical gap in the theoretical understanding of privacy in quantized models. By providing a rigorous, attack-free indicator, it enables practitioners to assess and rank the privacy resilience of different quantization strategies without the need for computationally expensive attack simulations. The authors emphasize that their work offers a practical tool for balancing efficiency and privacy in model deployment.

The authors remain modest regarding their findings, noting that while the indicator effectively ranks quantizers, it does not currently identify a single quantizer that simultaneously achieves strong downstream performance and high security. They suggest that future work could explore Quantization-Aware Training (QAT) methods to jointly optimize for task performance and the maximization of $r_{Q_n}$ . The study focuses on post-training quantization (PTQ), acknowledging that the results may differ for other training paradigms.