Membership inference attacks (MIAs) are used to test practical privacy of machine learning models. MIAs complement formal guarantees from differential privacy (DP) under a more realistic adversary model. We analyse MIA vulnerability of fine-tuned neural networks both empirically and theoretically, the latter using a simplified model of fine-tuning. We show that the vulnerability of non-DP models when measured as the attacker advantage at a fixed false positive rate reduces according to a simple power law as the number of examples per class increases. A similar power-law applies even for the most vulnerable points, but the dataset size needed for adequate protection of the most vulnerable points is very large.
@article{arxiv.2402.06674,
title = {Impact of Dataset Properties on Membership Inference Vulnerability of Deep Transfer Learning},
author = {Marlon Tobaben and Hibiki Ito and Joonas Jälkö and Yuan He and Antti Honkela},
journal= {arXiv preprint arXiv:2402.06674},
year = {2026}
}