Paper deep dive
Assessing Per-Sample Membership Inference Vulnerability without Retraining
Valentin Dorseuil, Jamal Atif, Olivier Cappé
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 89%
Last extracted: 7/21/2026, 3:41:46 AM
Summary
This paper introduces the Generalized Leverage Score (GLS) as a computationally efficient, theoretically grounded metric for assessing per-sample privacy vulnerability to Membership Inference Attacks (MIA) without retraining shadow models. The authors demonstrate that in linear settings, the leverage score precisely characterizes MIA risk by quantifying a data point's geometric influence on the model. They extend this concept to deep neural networks via implicit differentiation, showing that the GLS correlates strongly with state-of-the-art attack success rates, offering a scalable alternative to expensive shadow-model-based auditing.
Entities (7)
Relation Signals (6)
Generalized Leverage Score → isusedfor → Privacy Vulnerability Assessment
confidence 95% · We propose a computationally efficient generalization of the leverage score for deep learning... providing a computationally efficient and theoretically grounded tool for per-sample privacy risk assessment.
Leverage Score → characterizes → Membership Inference Vulnerability
confidence 92% · We establish that in Gaussian linear models, this score precisely characterizes membership inference vulnerability.
Generalized Leverage Score → generalizes → Leverage Score
confidence 90% · We extend this leverage score to general differentiable models via the Generalized Leverage Score (GLS)
Generalized Leverage Score → outperforms → Shadow Model Methods
confidence 90% · Empirical evaluations... show that our score outperforms loss and gradient-norm baselines... at identifying the highest-risk points under state-of-the-art attacks
Shadow Models → iscomputationallyprohibitive → Large-scale Models
confidence 85% · However, these techniques are computationally prohibitive, especially for large-scale models, as they require retraining the model multiple times.
Differential Privacy → provides → Worst-case Guarantees
confidence 80% · Differential Privacy (DP) provides worst-case guarantees for membership privacy.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Recent work in the privacy literature shows that sample-targeted membership inference attacks (MIAs) significantly outperform untargeted approaches by a wide margin. Motivated by this observation, we address the following question: can the privacy vulnerability of individual training points be assessed without training shadow models? We show that per-sample exposure to MIA is governed not only by a point's loss, but also by a data-dependent geometric measure. In the linear setting, we derive a closed-form decomposition of individual black-box MIA vulnerability into a population leverage score and a residual loss term, making explicit how sample-dependent geometry translates into privacy exposure. Since the final layer of most modern architectures is linear, we extend this framework to deep networks and propose a surrogate score operating on last-layer representations that requires only a single trained model and no shadow models. Empirical evaluations across diverse datasets and architectures show that our score outperforms loss and gradient-norm baselines at identifying the highest-risk points under state-of-the-art attacks, providing a computationally efficient and theoretically grounded tool for per-sample privacy risk assessment.
Tags
Links
- Source: https://arxiv.org/abs/2602.15919v2
- Canonical: https://arxiv.org/abs/2602.15919v2
Trouble viewing inline? Open PDF directly →
Full Text
79,704 characters extracted from source content.
Expand or collapse full text
Generalized Leverage Score for Scalable Assessment of Privacy Vulnerability Valentin Dorseuil Corresponding author: valentin.dorseuil@ens.psl.edu DI ENS, École normale supérieure, Université PSL, CNRS, 75005 Paris, France Jamal Atif CMAP, École polytechnique, Institut Polytechnique de Paris, 91120 Palaiseau, France Olivier Cappé DI ENS, École normale supérieure, Université PSL, CNRS, 75005 Paris, France Abstract Can the privacy vulnerability of individual data points be assessed without retraining models or explicitly simulating attacks? We answer affirmatively by showing that exposure to membership inference attack (MIA) is fundamentally governed by a data point’s influence on the learned model. We formalize this in the linear setting by establishing a theoretical correspondence between individual MIA risk and the leverage score, identifying it as a principled metric for vulnerability. This characterization explains how data-dependent sensitivity translates into exposure, without the computational burden of training shadow models. Building on this, we propose a computationally efficient generalization of the leverage score for deep learning. Empirical evaluations confirm a strong correlation between the proposed score and MIA success, validating this metric as a practical surrogate for individual privacy risk assessment. †footnotetext: Preprint. Under review. 1 Introduction Modern machine learning models, and deep neural networks in particular, are known to memorize aspects of their training data (Zhang et al., 2017; Carlini et al., 2019). This memorization induces privacy vulnerabilities that can be exploited by Membership Inference Attacks (MIAs), which aim to determine whether a specific data point was included in the training set (Shokri et al., 2017; Carlini et al., 2022). A principled defense against membership inference is provided by Differential Privacy (DP) (Dwork, 2006), implemented in deep learning through noise-injected stochastic gradient methods (Abadi et al., 2016). However, controlling the trade-off between privacy protection and model utility remains challenging. Noise calibration typically relies on worst-case theoretical accounting, paired with empirical privacy auditing via MIAs, and often leads to either over-conservative noise levels or insufficient privacy protection. In this context, designing MIAs for empirical auditing is essential to quantify leakage in non-private models (Yeom et al., 2018) or to validate the practical tightness of DP guarantees in private models (Nasr et al., 2021; Jagielski et al., 2020). While such auditing is now standard practice (Carlini et al., 2022; Nasr et al., 2021; Zarifzadeh et al., 2024), relying on aggregate metrics like average accuracy or AUC is insufficient. Such global measures can obscure critical risk heterogeneity, as outliers and rare subgroups are significantly more prone to memorization than typical samples (Carlini et al., 2022; Feldman and Zhang, 2020). Consequently, a model certified as private on average may still expose specific points to high privacy risks. To address this heterogeneity, recent work is increasingly focusing on individual privacy risk assessment, aiming to quantify membership leakage at the level of each data point, separately, rather than in aggregate. State-of-the-art methods for per-sample auditing (Carlini et al., 2022; Zarifzadeh et al., 2024) predominantly rely on shadow models. These techniques train multiple reference models on random data splits to characterize each data point’s influence on the model’s behavior. This enables identification of which points exhibit increased sensitivity to their presence in the training dataset. However, these techniques are computationally prohibitive, especially for large-scale models, as they require retraining the model multiple times. This leads to our central question stated in the abstract: can the privacy vulnerability of individual data points be assessed without retraining models or explicitly simulating attacks? In classical statistics, the leverage score quantifies a data point’s geometric influence on a model, independent of its label. We establish that in Gaussian linear models, this score precisely characterizes membership inference vulnerability. We prove that under an optimal black-box attack, the privacy loss distribution is controlled by a single scalar, the leverage score. In other words, membership inference vulnerability is fundamentally about self-influence: samples that are geometrically positioned to have a disproportionate effect on the model’s learned parameters are the most at risk of privacy leakage. Consequently, while specific outcomes fluctuate due to noise, the individual average privacy risk in the linear regime is determined by data geometry. To extend this analysis to deep neural networks, we introduce the Generalized Leverage Score (GLSGLS). Derived via implicit differentiation of the training optimality conditions, the GLSGLS measures the infinitesimal sensitivity of a model’s prediction to its own label, generalizing the leverage score to both regression and classification settings. While the exact computation is expensive for deep networks, we demonstrate that a last-layer approximation remains highly effective in practice. This allows us to compute a scalable, theoretically principled, proxy for privacy risk that correlates with the success of state-of-the-art attacks, without the need for retraining or shadow models. Contributions. (i) We prove that for Gaussian linear models under black-box access, the leverage score is the sufficient statistic characterizing both the privacy loss distribution and the optimal membership inference test. (i) We extend this leverage score to general differentiable models via the Generalized Leverage Score (GLSGLS), deriving a principled and scalable estimator of privacy vulnerability. (i) Through multiple experiments, we show that this metric serves as a surrogate for individual privacy risk. It identifies vulnerable samples, showing a strong correlation with state-of-the-art shadow model attacks, at a reduced computational cost. 2 Related Work Membership Inference Attacks (MIA). Membership inference aims to determine if a specific sample was used to train a model. Early approaches relied on simple metric-based classifiers, exploiting overfitting signals such as prediction confidence, entropy, or the magnitude of gradients (Shokri et al., 2017; Yeom et al., 2018). While computationally inexpensive, these methods often struggle to distinguish between a “vulnerable" member and a “hard" non-member. To address this, current state-of-the-art methods adopt the shadow model paradigm Shokri et al. (2017). By training multiple models on different data splits, attacks like LiRA (Likelihood Ratio Attack) (Carlini et al., 2022) essentially perform a hypothesis test on the loss distribution of a target point (Zarifzadeh et al., 2024). While highly effective, this approach is computationally prohibitive, often requiring hundreds of training runs to estimate the risk for a single point accurately. Our work seeks to achieve the precision of these hypothesis-test based methods without their computational burden, by substituting retraining with geometric analysis. Influence Functions and Data Attribution. Originating in robust statistics with influence measures such as Cook’s distance (Cook, 1977), influence functions quantify the effect of a training point on model parameters or predictions. In modern deep learning, Koh and Liang (2017) reintroduced influence functions via Hessian-vector products to explain model’s behavior and identify mislabeled data. Recent work has begun to explore the connection between influence and privacy. Notably, Feldman and Zhang (2020) and Feldman (2020) link the memorization of a sample to its influence on the learning process, arguing that memorization is necessary for generalization in long-tailed distributions. However, classical influence functions typically measure the effect of a training point on a separate test point. In contrast, our GLSGLS formulation focuses on self-influence (the sensitivity of a prediction to its own label), identifying this specific form of leverage as the canonical driver of privacy leakage. Privacy Auditing and Heterogeneity. Differential Privacy (DP) (Dwork, 2006) provides worst-case guarantees for membership privacy. Using algorithms such as DP-SGD (Abadi et al., 2016), one can train Deep Learning models to be private. However, these bounds are often loose and do not capture the empirical reality that privacy risk is non-uniform: some outlier samples are far more exposed than others (Zarifzadeh et al., 2024). Auditing individual privacy risk (estimating the specific (ε,δ ,δ) for a given sample) remains an open challenge. Existing auditing tools rely heavily on the aforementioned shadow model techniques or randomized smoothing (Lecuyer et al., 2019), which are difficult to scale. Our work contributes to this domain by proposing an individual privacy risk metric for identifying vulnerable samples efficiently. We believe that this approach can complement existing auditing methods, providing a first-pass filter to identify high-risk points without retraining. 3 Leverage Scores and Membership Vulnerability We begin by analyzing how data heterogeneity impacts the effectiveness of Membership Inference Attacks (MIAs) in the fixed-design Gaussian linear regression framework. This setting is selected for its analytical tractability and its ability to represent data variance through the fixed design matrix. In contrast to approaches that assume an i.i.d. data distribution, our fixed-design analysis captures the non-uniform risk exposure inherent to heterogeneous datasets. We provide a characterization of the optimal membership inference test and its trade-off curve in this setting, where the average is taken over all possible training noise realizations for a fixed dataset, rather than across data points. By quantifying vulnerability using leverage scores, we establish a rigorous link between a point’s structural influence and its individual privacy risk exposure. 3.1 Problem Setting and Definitions Consider a fixed design matrix ∈ℝn×d X ^n× d, where each row i⊤ x_i represents a data point. We examine the multivariate linear model: =Θ∗+, Y= X ^*+ E, (1) where ∈ℝn×m Y ^n× m is the response matrix, Θ∗∈ℝd×m ^* ^d× m is the true parameter matrix, and ∈ℝn×m E ^n× m represents noise. We assume the noise is centered, independent and identically distributed (i.i.d.) Gaussian, such that for any row i, [i⋅]=0E[ E_i·]=0 and Cov(i⋅)=σ2mCov( E_i·)=σ^2 I_m. We assume n≥dn≥ d and that X has full column rank. The Ordinary Least Squares (OLS) estimator is Θ^=(⊤)−1⊤ =( X X)^-1 X Y. The fitted values are ^= Y= H Y, where =(⊤)−1⊤ H= X( X X)^-1 X is the hat matrix. For a specific data point i, the residual vector i∈ℝm r_i ^m is defined as: i=i−Θ^⊤i=∑j=1n(δij−hij)j, r_i= y_i- x_i= _j=1^n( _ij-h_ij) y_j, (2) where δij _ij is the Kronecker delta. The diagonal elements of the hat matrix, hii=i⊤(⊤)−1ih_i= x_i ( X X)^-1 x_i, are the leverage scores. They satisfy 0≤hii≤10≤ h_i≤ 1 and ∑i=1nhii=d _i=1^nh_i=d, serving as a measure of the geometric influence of i x_i on the model’s predictions (Belsley et al., 1980). 3.2 Distinguishing Members from Non-Members To formalize the Membership Inference Attack, we define two hypotheses for a data point (i,i)( x_i, y_i). Under the member hypothesis (ℋ1=ℋtrainH_1=H_train), the pair was included in the training set used to compute Θ . Under the non-member hypothesis (ℋ0=ℋtestH_0=H_test), the model was trained on the dataset, but we evaluate the residual on an independent observation ~i y_i generated from the same distribution: ~i=Θ∗⊤i+i′ y_i= ^* x_i+ _i, where i′ _i is independent noise. Proposition 3.1 (Residual Distributions). Under the Gaussian noise assumption, the residuals for the i-th data point under the member and non-member hypotheses follow distinct multivariate normal distributions: i∣ℋtrain r_i _train ∼(0,σ2(1−hii)m), (0,σ^2(1-h_i) I_m ), (3) i∣ℋtest r_i _test ∼(0,σ2(1+hii)m). (0,σ^2(1+h_i) I_m ). (4) Consequently, the squared norms of the residuals follow scaled Chi-squared distributions: ‖i‖2∣ℋtrain \| r_i\|^2 _train ∼σ2(1−hii)χ2(m), σ^2(1-h_i)χ^2(m), (5) ‖i‖2∣ℋtest \| r_i\|^2 _test ∼σ2(1+hii)χ2(m). σ^2(1+h_i)χ^2(m). (6) The proof is provided in Appendix A.2. This result highlights that members have lower residual variance than non-members, with the gap controlled explicitly by the leverage score hiih_i. In particular, the distributions differ in scale and not in location, leading to fundamentally non-symmetric error trade-offs in membership inference. This asymmetry leads to easier detection of non-members (low false negative rate β) than members (low false positive rate α), which is consistent with the empirical behavior of state-of-the art MIAs (Carlini et al., 2022). 3.3 A Membership Inference Attack Perspective Using Proposition 3.1, we derive the theoretically optimal membership inference attack. The Neyman-Pearson Lemma (Neyman and Pearson, 1933) states that the most powerful test for distinguishing these hypotheses is the Likelihood Ratio Test. Due to the heterogeneity of the data (varying hiih_i), a global threshold on the raw loss ‖i‖2\| r_i\|^2 is suboptimal. Instead, the optimal decision rule requires a sample-specific normalization. Proposition 3.2 (Optimal MIA Test). Let Si(i)S_i( r_i) be the log-likelihood ratio statistic for the i-th sample. The most powerful test at level α rejects the non-member hypothesis ℋtestH_test (predicts membership) if Si(i)>γαS_i( r_i)> _α, where the sufficient statistic is given by: Si(i)=m2ln(1+hii1−hii)−hiiσ2(1−hii2)‖i‖2.S_i( r_i)= m2 ( 1+h_i1-h_i )- h_iσ^2(1-h_i^2)\| r_i\|^2. (7) The proof of this result is provided in Appendix A.3. To obtain the optimal (α,β)(α,β) trade-off curve, samples must be ranked in descending order of their score Si(i)S_i( r_i). This score represents a data-dependent affine transformation of the loss ‖i‖2\| r_i\|^2. This relationship aligns with the design of parametric MIAs that fit Gaussian distributions to scores. It suggests that such methods implicitly learn this affine transformation to distinguish members from non-members (Carlini et al., 2022; Zarifzadeh et al., 2024). We follow the approach of f-Differential Privacy defined in Dong et al. (2022) to characterize the membership inference trade-off curve as a functional relationship between error types. Proposition 3.3 (MIA Errors Curve). For the point i, the trade-off between the false alarm rate α (Type-I error) and the missed detection rate β (Type-I error) is described by the curve: βi(αi)=1−Fm(1+hii1−hiiFm−1(αi)). _i( _i)=1-F_m ( 1+h_i1-h_iF_m^-1( _i) ). (8) where FmF_m is the Cumulative Distribution Function of the χ2(m)χ^2(m) distribution. This result highlights that hiih_i is the unique parameter controlling the distinguishability of training points from test points in the Black-Box setting, i.e., when the attacker only has access to the loss values. The proof is provided in Appendix A.4 with an illustration for multiple hiih_i values in Figure 5. 3.4 An Influence Point of View The vulnerability of high-leverage points established in Proposition 3.2 can be intuitively understood through the lens of self-influence. While the leverage score hiih_i was defined geometrically via the projection matrix, it admits an operational interpretation as the self-influence of the i-th observation. With the OLS estimator, Θ we have: ^i=∑j=1nhijj=∑j=1ni⊤(⊤)−1jj. y_i= _j=1^nh_ij y_j= _j=1^n x_i ( X X)^-1 x_j y_j. (9) The fitted value for point i is a linear combination of all observed labels j y_j. Thus leverage score hiih_i corresponds to the sensitivity of the i-th fitted value ^i y_i with respect to the observed target i y_i. This yields the identity: ∂^i∂i=hiim. ∂ y_i∂ y_i=h_i I_m. (10) It quantifies how much the model’s prediction for a specific point changes when the label of that point is perturbed. The scalar leverage score can then be recovered via the trace: hii=1mTr(∂^i∂i)h_i= 1mTr ( ∂ y_i∂ y_i ). This identity highlights the link between the leverage score and the model’s sensitivity to its own training labels. For high-leverage points (hii≈1h_i≈ 1), the model is forced to interpolate the observation i y_i to minimize the global squared error. The specific noise instance i _i present in a member’s label is directly encoded into the prediction ^i y_i. Consequently the training residual i r_i vanishes, making membership easily detectable. While the geometric definition of hiih_i is specifically relevant to OLS, the sensitivity formulation in Equation (10) is general, allowing us to extend leverage scores to non-linear deep neural networks. 4 Generalized Leverage Scores (GLSGLS) We formalize the Generalized Leverage Score (GLSGLS) to extend the classical sensitivity interpretation to arbitrary differentiable models. 4.1 Formal Framework and Definition We consider a dataset =(i,i)i=1nD=\( x_i, y_i)\_i=1^n and a model fθ:→f_θ:X parameterized by θ∈Θ⊂ℝpθ∈ ^p. The output space Y is m-dimensional (for example m=1m=1 for scalar regression and m=Cm=C for C-class classification). Training is performed by minimizing the empirical risk: ℒ(θ)=1n∑i=1nℓ(fθ(i),i),L(θ)= 1n _i=1^n (f_θ( x_i), y_i), (11) where ℓ is a twice-differentiable loss function. Let θ θ denote the optimal parameters obtained at convergence, i.e., θ^∈argminθ∈Θℒ(θ) θ∈ _θ∈ L(θ). Definition 4.1 (Generalized Leverage Score). The Generalized Leverage Score (GLSGLS) of the i-th sample is defined as the infinitesimal sensitivity of the model’s prediction at i x_i to its own observed label i y_i: GLSi=∂fθ^(i)∂i∈ℝm×m.GLS_i= ∂ f_ θ( x_i)∂ y_i ^m× m. (12) This metric captures a self-influence effect; it quantifies how much the model would alter its prediction for a specific sample if that sample’s label was perturbed, accounting for the implicit change in the learned parameters θ θ. 4.2 Analytic Derivation via Implicit Differentiation Computing GLSiGLS_i directly is challenging as θ θ depends on i y_i implicitly through the optimization process. To isolate this dependence, we follow the approach of Koh and Liang (2017) and derive a closed-form expression for GLSiGLS_i. Proposition 4.2 (Closed-form GLSGLS). Assuming the averaged loss function ℒL is twice differentiable and its Hessian θ H_ θ is invertible, the GLSGLS for a univariate output is given by: GLSi=−1n‖∇θfθ^(i)‖θ^−12(∂2ℓ∂∂f),GLS_i=- 1n \| _θf_ θ( x_i) \|^2_ H_ θ^-1 ( ∂^2 ∂ y∂ f ), (13) where ‖A2=⊤A\| v\|^2_A= v A v denotes the squared Matrix norm. For multivariate outputs, this generalizes to: GLSi=−1nθfθ^(i)θ^−1θfθ^(i)⊤(∂2ℓ∂∂f),GLS_i=- 1n J_θf_ θ( x_i) H_ θ^-1 J_θf_ θ( x_i) ( ∂^2 ∂ y∂ f ), (14) where θfθ^(i)∈ℝm×p J_θf_ θ( x_i) ^m× p is the Jacobian of the model outputs with respect to the parameters, θ H_ θ is the Hessian of the loss function ℒL, i.e. θ^=∇θ2ℒ(θ^) H_ θ= _θ^2L( θ), and ℓ denotes the pointwise loss evaluated at (fθ^(i),i)(f_ θ( x_i), y_i). This result follows from applying implicit differentiation to the first-order optimality condition ∇θℒ(θ^)=0 _θL( θ)=0, noting that θ θ depends implicitly on i y_i and ℒL depends explicitly on i y_i through ℓ(fθ^(i),i) (f_ θ( x_i), y_i). The full derivation is provided in Appendix B.2. The scaling factor ∂2ℓ∂∂f ∂^2 ∂ y∂ f acts as a loss-specific weighting term in the GLSGLS expression. We derive this term for common loss functions in both regression and classification settings. 4.3 GLS for Regression Models In the multivariate regression setting, we typically consider the quadratic loss. For a single data point (,)( x, y) the loss is defined as: ℓ(f(),)=‖f()−‖22. (f( x), y)=\|f( x)- y\|_2^2. Proposition 4.3 (Multivariate Regression). For the quadratic loss with targets ∈ℝm y ^m and predictions f∈ℝmf ^m, the second derivative is: ∂2ℓ∂∂f=−2m. ∂^2 ∂ y∂ f=-2 I_m. (15) This gives us: GLSi=2nθfθ^(i)θ^−1θfθ^(i)⊤.GLS_i= 2n J_θf_ θ( x_i) H_ θ^-1 J_θf_ θ( x_i) . (16) 4.4 GLS for Classification Models For classification, we consider the cross-entropy loss ℓ(^,)=−∑j=1myjlog(p^j) ( p, y)=- _j=1^my_j ( p_j), where ∈0,1m y∈\0,1\^m is the one-hot label vector and ^=s(fθ^())∈[0,1]m p=s(f_ θ( x))∈[0,1]^m is the vector of predicted probabilities obtained via the softmaxsoftmax function s. The GLSGLS depends on the loss through the second derivative ∂2ℓ∂∂f ∂^2 ∂ y∂ f, which for cross-entropy reduces to a constant matrix: Proposition 4.4 (Cross-Entropy Derivatives). For the cross-entropy loss with one-hot labels y and logits f, the second derivative is: ∂2ℓ∂∂f=−m. ∂^2 ∂ y∂ f=- I_m. (17) While the GLSGLS is formally derived in terms of logit sensitivity, interpreting these scores in the probability space is often more practical. For classification, we thus consider the GLSGLS in the probability space. Applying the chain rule, we have: GLSi _i =∂^i∂i = ∂ p_i∂ y_i =∂s∂f×∂fθ^(i)∂i = ∂ s∂ f× ∂ f_ θ( x_i)∂ y_i =1n(diag(^i)−^i^i⊤)⏟Softmax Jacobianθfθ^(i)θ^−1θfθ^(i)⊤. = 1n (diag( p_i)- p_i p_i )_Softmax Jacobian J_θf_ θ( x_i) H_ θ^-1 J_θf_ θ( x_i) . This formulation yields a leverage score properly normalized within the probability simplex. We use this score as our primary privacy metric in the following experiments. Detailed derivations are in Appendix B.3. 4.5 Interpretation in Binary Classification To further interpret the GLSGLS in classification, we consider the classical binary logistic regression model. The model predicts p^i=σ(y^i) p_i=σ( y_i), where y^i=i⊤θ y_i= x_i θ and σ:z↦1/(1+e−z)σ:z 1/(1+e^-z) is the sigmoid function. The standard cross entropy loss is ℓ(y^i,yi)=−yilog(p^i)−(1−yi)log(1−p^i) ( y_i,y_i)=-y_i ( p_i)-(1-y_i) (1- p_i). Proposition 4.5 (Binary Logistic Leverage Score). Under the cross entropy loss, for a binary logistic regression model, the GLSGLS in the probability space reduces to: ∂p^i∂yi=σ′(y^i)×GLSi=wii⊤(⊤)−1i, ∂ p_i∂ y_i=σ ( y_i)×GLS_i=w_i x_i ( X W X )^-1 x_i, (18) with wi=p^i(1−p^i)=σ′(y^i)w_i= p_i(1- p_i)=σ ( y_i) and =diag(w1,…,wn) W=diag(w_1,…,w_n). The proof is provided in Appendix B.4. We recover here the leverage score from logistic regression defined in Pregibon (1981). This score can be interpreted as a weighted version of the input’s norm in the Hessian-induced metric: ∂p^i∂yi=σ′(y^i)×‖i‖θ^−12, ∂ p_i∂ y_i=σ ( y_i)×\| x_i\|^2_ H_ θ^-1\,, (19) with θ^=⊤ H_ θ= X W X the Hessian of the loss at convergence. The term wi=p^i(1−p^i)w_i= p_i(1- p_i) reaches its maximum at p^i=0.5 p_i=0.5, which corresponds to sample located on the decision boundary. This aligns with the LiRA intuition that samples near the decision rule are most sensitive to perturbations in the training set, and thus most vulnerable to membership inference (Carlini et al., 2022). 5 Scalable Computation & Approximations Computing the GLSGLS directly from its closed-form expression can be computationally prohibitive for deep networks due to the need to invert the p×p× p Hessian matrix, where p is the number of model parameters. To address this challenge, we propose an efficient algorithm that leverages Hessian-vector products (HVPs) and iterative solvers to compute the GLSGLS without explicitly forming or inverting the Hessian. 5.1 Efficient GLS Computation The key observation is that the GLSGLS expression involves the term θ^−1θfθ^(i)⊤ H_ θ^-1 J_θf_ θ( x_i) . Instead of computing the inverse Hessian directly, we can reformulate this as solving a linear system: θ^i=θfθ^(i)⊤, H_ θ Z_i= J_θf_ θ( x_i) , (20) for each sample i, where i Z_i is the unknown matrix we wish to compute. Once i Z_i is obtained, the GLSGLS can be computed as: GLSi=−1n(∂2ℓ∂∂f)θfθ^(i)i.GLS_i=- 1n ( ∂^2 ∂ y∂ f ) J_θf_ θ( x_i)\; Z_i\,. (21) To solve the linear system efficiently, we employ the conjugate gradient (CG) method, which only requires the ability to compute Hessian-vector products. These products can be computed efficiently using automatic differentiation techniques without explicitly forming the Hessian matrix (Pearlmutter, 1994). The overall algorithm for computing the GLSGLS for a set of target samples =ii=1kX=\ x_i\_i=1^k is summarized in Algorithm 2. The key steps involve computing the Jacobians for the target samples, solving the linear systems using CG (Algorithm 1), and finally assembling the GLSGLS values. Using torch.vmap (Paszke et al., 2019) and tensor parallelization, we implemented a version of this algorithm that was able to process multiple target samples at the same time. Algorithm 1 Inverse-Hessian Jacobian Product via Conjugate Gradient Solver Input: trainD_train, Model fθ^f_ θ, Jacobians ⊤ J , Damping λ, Iterations T Output: ∈ℝp×m Z ^p× m Define the linear operator†The Hessian Jacobian product can be computed using mini-batches for the Hessian part, allowing for efficient estimation by summing the contributions from each batch without requiring the full dataset in one pass. : [⊤]=(θ^+λ)⊤ A[ J ]=( H_ θ+λ I) J ←CG Algorithm(operator=,target=⊤,iters=T) Z Algorithm(operator\!=\! A,\!target\!=\! J ,iters=T)†The CG algorithm iteratively refines the solution to the linear system using only matrix-vector products, making it suitable for large-scale problems where the matrix is not explicitly formed. The details of the CG algorithm can be found in Hestenes and Stiefel (1952). return Z Algorithm 2 Generalized Leverage Score Computation Input: Target samples X, trainD_train, fθ^f_ θ, Damping λ, Iterations T Output: GLSii=1k\GLS_i\_i=1^k for i=1i=1 to k do i←∇θfθ^(i)i=1k J_i←\ _θf_ θ( x_i)\_i=1^k i←−1n∂2ℓ∂∂f(f(i),i) M_i←- 1n ∂^2 ∂ y∂ f(f( x_i), y_i) i←Algorithm 1(train,fθ^,i⊤,λ,T) Z_i ~ alg:cg_solve(D_train,f_ θ, J_i ,λ,T) GLSi←iiiGLS_i← J_i Z_i M_i end for return GLSii=1k\GLS_i\_i=1^k Computational Complexity. The proposed framework avoids the O(p3)O(p^3) time and O(p2)O(p^2) memory requirements of direct Hessian inversion by using a conjugate gradient (CG) solver. The primary computational cost is dominated by solving the linear system [⊤] A[ J ], which computes Hessian-Matrix Products (HMPs) via a pass over the training set trainD_train. For a model with p parameters and m output logits, the total time complexity is O(kTnpm)O(kTnpm), where k is the number of target points, n is the training set size, and T is the number of CG iterations. Table 1: Computational Complexity of GLSGLS Subprocesses. Subprocess Time Memory Jacobian O(pm)O(pm) O(pm)O(pm) Hessian Matrix Product O(npm)O(npm) O(pm)O(pm) CG Solver (T iter) O(Tnpm)O(Tnpm) O(pm)O(pm) Total for k points O(kTnpm)O(kTnpm) O(pm)O(pm) 5.2 Approximation via Layer Restriction Exact computation of GLSGLS over the full training set (k=n)(k=n) is intractable for deep networks as our algorithm yields an O(n2)O(n^2) time complexity. Thus, our proposed algorithm is computationally feasible for a moderate number of target points k since the time complexity scales linearly with k. Figure 1: Spearman’s correlation (green line) between LiRA scores and GLSGLS (trace), and computational time (blue area) for different network depths. Error bars show 95% confidence intervals across 16 models. Computational times are measured on a single A100 GPU. Table 2: Spearman correlation between metrics computed using shadow models (LiRA) and Generalized Leverage Scores for different differentiation depths. Results are averaged over 16 different models; 95% quantiles are reported next to each entry using ± notation. Highest correlations per metric are in bold. Generalized Leverage Scores Shadow Metrics last layer 2 last layers 4 last layers full model LiRA Score 0.50±0.050.50± 0.05 0.51±0.040.51± 0.04 0.51±0.030.51± 0.03 0.51±0.040.51± 0.04 |σtest/σtrain|| _test/ _train| 0.40±0.040.40± 0.04 0.41±0.030.41± 0.03 0.41±0.040.41± 0.04 0.41±0.03 0.41± 0.03 TPR@FPR =0.05=0.05 0.27±0.040.27± 0.04 0.28±0.040.28± 0.04 0.28±0.050.28± 0.05 0.29±0.050.29± 0.05 |μtest−μtrain|| _test- _train| 0.06±0.040.06± 0.04 0.06±0.030.06± 0.03 0.07±0.040.07± 0.04 0.06±0.040.06± 0.04 To mitigate this, we explored computing our GLSGLS by differentiating only through a subset of layers, and found that restricting the computation to the last few layers yields nearly the same correlation with our comparison metrics as the full model. Formally, this corresponds to computing ∂^∂ ∂ y∂ y on a restricted model θsub _sub where the feature extractor is frozen. This is equivalent to masking the full Jacobian and Hessian to the subspace θsub _sub. The results can be observed in Figure 1, where the correlation between the LiRA Score†The LiRA score is computed as the likelihood ratio of the observation under two Gaussian distributions modeling the member and non-member hypotheses. The parameters of these distributions are estimated using an ensemble of shadow models. More information can be found in Carlini et al. (2022). and the GLSGLS is plotted against computation time for various differentiation depths. The resulting complexity is reduced to O(kTnmpsub)O(kTnmp_sub), where psubp_sub is the number of parameters in θsub _sub. In particular, when the last layer is linear, the GLSGLS admits a closed-form solution. We recover the classical statistical leverage scores in the feature space, allowing for easier computation. With d being the feature dimension, the closed-form lead to an improved complexity of O(nd2+d3)O(nd^2+d^3) for the regression case with quadratic loss (even with m>1m>1) and O(nm2d2+m3d3)O(nm^2d^2+m^3d^3) for the classification case with the cross entropy loss. More details can be found in Appendix C. 6 Experiments In this section, we empirically evaluate the effectiveness of the Generalized Leverage Score (GLSGLS) as a membership inference metric. We assess its correlation with the LiRA score, an established benchmark for membership inference attacks, and analyze its performance in identifying outlier samples within the training data. 6.1 Setup Dataset and Model. We conduct experiments on the CIFAR-10 dataset (Krizhevsky and Hinton, 2009), using a ResNet-18 architecture (He et al., 2016) trained to achieve approximately 92%92\% test accuracy. The training set consists of 50,000 images, while the test set contains 10,000 images. In order to compute the LiRA scores, we follow the protocol established by Carlini et al. (2022), training an ensemble of 200 shadow models with architectures identical to the target model. Each shadow model is trained on a random subset of 40,000 images from CIFAR-10, with the remaining 10,000 images reserved for evaluation. The LiRA scores are then computed for all the samples, split between members and non-members of the target model’s training set. Figure 2: t-SNE visualization of the model’s final layer representations for the "Frog" class. Point coloring represents the leverage score magnitude, highlighting the geometric distribution of high-leverage samples. Computation To compute the Generalized Leverage Scores (GLSGLS), we implement the algorithm outlined in Section 5.1. We set the damping factor λ between 10−410^-4 and 10−210^-2, depending on the differentiation depth and run the conjugate gradient (CG) solver for T=100T=100 iterations. In most cases, the solver returned a solution (with a tolerance of 10−310^-3 on the equality) before the maximum number of iterations was reached. We trained 16 different models with different random seeds to compute the GLSGLS scores and report averaged results. To compare results across models, we keep the first 128 samples in the train set for all models. We tried different operations on the GLSGLS matrix to get a scalar score: the Trace, the Frobenius Norm and the Spectral Norm. We observed that each of these operations lead to similar results. In the rest of the paper we report results with the Trace operator. 6.2 Metrics and Results Correlation with LiRA Table 2 reports the Spearman correlation between the Generalized Leverage Scores, computed for different differentiation depth, and various shadow model indicators, including the LiRA score, the mean gap (|μin−μout|| _in- _out|), the standard deviation ratio (σin/σout _in/ _out), and the TPR at low FPR. We observe a positive rank correlation between GLSGLS and the LiRA score as well as other metrics. This confirms that the leverage score captures a similar vulnerability signal as more computationally expensive shadow models: high-leverage points correspond to samples where attacks are more likely to confidently predict membership. Figure 3: Visualization of the 10 images with the Lowest and Highest Generalized Leverage Score. Figure 4: Error trade-off curves (α=FPR,β=FNRα=FPR,β=FNR) for samples in the 2%2\% highest and lowest GLSGLS quantiles. Curves represent the mean of 50 LiRA attacks; shaded areas indicate 95%95\% percentile intervals. Outlier Detection To further understand the characteristics of high-leverage samples, we visualize the model’s final layer representations using t-SNE (van der Maaten and Hinton, 2008). In Figure 2, we color the points based on their GLSGLS magnitude, revealing that most of the low-leverage samples cluster around the class center in the representation space. In contrast the points far from the class center tend to have high leverage scores. Additionally, we present a qualitative analysis of the images corresponding to the highest and lowest GLSGLS values in Figure 3. We observe that high-leverage samples often exhibit atypical features or artifacts, such as unusual poses or backgrounds, which may contribute to their disproportionate influence on the model. Conversely, low-leverage samples tend to be more prototypical representations of their respective classes. Membership Inference Attack Evaluation We evaluate the effectiveness of GLSGLS in membership inference attacks by comparing the performance of LiRA for high-GLSGLS samples and low-GLSGLS samples. The results show that high-GLSGLS samples are significantly more vulnerable to membership inference attacks compared to low-GLSGLS samples. Figure 4 illustrates the error trade-off curves for samples in the top and bottom 2%2\% of GLSGLS quantiles. The curves represent the mean of 50 LiRA attacks, with shaded areas indicating 95%95\% percentile intervals. Notably, high-leverage samples demonstrate a marked shift toward the lower-left of the plot, indicating increased susceptibility to membership inference attacks. 7 Conclusion We introduced the GLSGLS, an influence-based, per-instance diagnostic for assessing privacy exposure without retraining models or explicitly simulating attacks. Although derived in the linear setting, GLSGLS provides a computationally efficient tool for identifying data points with elevated risk of membership inference in deep learning models. Rather than offering formal privacy guarantees, it serves as an interpretable and scalable proxy for individual vulnerability that complements attack-based audits. While GLSGLS does not perfectly align with shadow-model–based metrics, it consistently highlights samples that are more susceptible to privacy leakage, making it particularly suitable for large-scale auditing scenarios. A key limitation of our approach is that its theoretical justification is confined to linear models, with effectiveness in non-linear regimes supported empirically. Promising directions for future work include extending the framework to white-box auditing settings, systematically evaluating its behavior across architectures and datasets, and studying its interaction with different training regimes, including differentially private optimization. References Abadi et al. (2016) Martín Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep Learning with Differential Privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308–318, October 2016. doi: 10.1145/2976749.2978318. Belsley et al. (1980) David A Belsley, Edwin Kuh, and Roy E Welsch. Regression Diagnostics: Identifying Influential Data and Sources of Collinearity, chapter 2, pages 6–84. John Wiley & Sons, Ltd, 1980. doi: 10.1002/0471725153.ch2. Carlini et al. (2019) Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19), pages 267–284, 2019. Carlini et al. (2022) Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE symposium on security and privacy (SP), pages 1897–1914. IEEE, 2022. Cook (1977) R. Dennis Cook. Detection of Influential Observation in Linear Regression. Technometrics, 19(1):15–18, 1977. doi: 10.1080/00401706.1977.10489493. Dong et al. (2022) Jinshuo Dong, Aaron Roth, and Weijie J Su. Gaussian differential privacy. Journal of the Royal Statistical Society Series B: Statistical Methodology, 84(1):3–37, 2022. Dwork (2006) C. Dwork. Differential privacy, volume 2006. ICALP, 2006. Pages: 1-12. Feldman (2020) Vitaly Feldman. Does learning require memorization? a short tale about a long tail. In Proceedings of the 52nd annual ACM SIGACT symposium on theory of computing, pages 954–959, 2020. Feldman and Zhang (2020) Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. Advances in Neural Information Processing Systems, 33:2881–2891, 2020. He et al. (2016) Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. Hestenes and Stiefel (1952) M.R. Hestenes and E. Stiefel. Methods of conjugate gradients for solving linear systems. Journal of Research of the National Bureau of Standards, 49(6):409, December 1952. ISSN 0091-0635. doi: 10.6028/jres.049.044. Jagielski et al. (2020) Matthew Jagielski, Jonathan Ullman, and Alina Oprea. Auditing differentially private machine learning: How private is private sgd? Advances in Neural Information Processing Systems, 33:22205–22216, 2020. Koh and Liang (2017) Pang Wei Koh and Percy Liang. Understanding Black-box Predictions via Influence Functions. In Proceedings of the 34th International Conference on Machine Learning, pages 1885–1894. PMLR, July 2017. Krizhevsky and Hinton (2009) Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical Report 0, University of Toronto, Toronto, Ontario, 2009. Lecuyer et al. (2019) Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE symposium on security and privacy (SP), pages 656–672. IEEE, 2019. Nasr et al. (2021) Milad Nasr, Shuang Songi, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlin. Adversary instantiation: Lower bounds for differentially private machine learning. In 2021 IEEE Symposium on security and privacy (SP), pages 866–882. IEEE, 2021. Neyman and Pearson (1933) Jerzy Neyman and Egon Sharpe Pearson. Ix. on the problem of the most efficient tests of statistical hypotheses. Philosophical Transactions of the Royal Society of London, Series A: Containing Papers of a Mathematical or Physical Character, 231(694-706):289–337, 02 1933. doi: 10.1098/rsta.1933.0009. Paszke et al. (2019) Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 32, 2019. Pearlmutter (1994) Barak A. Pearlmutter. Fast exact multiplication by the hessian. Neural Computation, 6(1):147–160, 01 1994. doi: 10.1162/neco.1994.6.1.147. Pregibon (1981) Daryl Pregibon. Logistic regression diagnostics. The Annals of Statistics, 9(4):705–724, 1981. Shokri et al. (2017) Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017. van der Maaten and Hinton (2008) Laurens van der Maaten and Geoffrey Hinton. Visualizing Data using t-SNE. Journal of Machine Learning Research, 9(86):2579–2605, 2008. Yeom et al. (2018) Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pages 268–282. IEEE, 2018. Zarifzadeh et al. (2024) Sajjad Zarifzadeh, Philippe Liu, and Reza Shokri. Low-Cost High-Power Membership Inference Attacks. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp, editors, Proceedings of the 41st International Conference on Machine Learning. PMLR, 21–27 Jul 2024. Zhang et al. (2017) Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning requires rethinking generalization. In International Conference on Learning Representations, 2017. Appendix A Leverage Scores and Membership Vulnerability: Proofs in the Linear Gaussian Case In this appendix, we provide detailed proofs for the results presented in Section 3, which analyzes the relationship between leverage scores and membership inference vulnerability in the context of linear models. A.1 Setup and Notations We recall here the setup for the linear regression model and the associated residual distributions under membership and non-membership hypotheses. Consider a fixed design matrix ∈ℝn×d X ^n× d, where each row i⊤ x_i represents a data point. We examine the multivariate linear model: =Θ∗+, Y= X ^*+ E, where ∈ℝn×m Y ^n× m is the response matrix, Θ∗∈ℝd×m ^* ^d× m is the true parameter matrix, and ∈ℝn×m E ^n× m represents noise. We assume the noise is centered, independent and identically distributed (i.i.d.) Gaussian, such that for any row i, [i⋅]=0E[ E_i·]=0 and Cov(i⋅)=σ2ImCov( E_i·)=σ^2I_m. The Ordinary Least Squares (OLS) estimator is Θ^=(⊤)−1⊤ =( X X)^-1 X Y. The fitted values are ^= Y= H Y, where =(⊤)−1⊤ H= X( X X)^-1 X is the hat matrix. For a specific data point i, the residual vector i∈ℝm r_i ^m is defined as: i=i−Θ^⊤i=∑j=1n(δij−hij)j, r_i= y_i- x_i= _j=1^n( _ij-h_ij) y_j, where δij _ij is the Kronecker delta. The diagonal elements of the hat matrix, hii=i⊤(⊤)−1ih_i= x_i ( X X)^-1 x_i, are the leverage scores. They satisfy 0≤hii≤10≤ h_i≤ 1 and ∑i=1nhii=d _i=1^nh_i=d, serving as a measure of the geometric influence of i x_i on the model’s predictions (Belsley et al., 1980). We consider the task of Membership Inference Attack (MIA), framed as a hypothesis test on a residual i r_i. We distinguish between two scenarios for a point i: • ℋ1=ℋtrainH_1=H_train (Member): The point i was included in the training set. • ℋ0=ℋtestH_0=H_test (Non-member): The point i is a fresh test point with the same features i x_i but a fresh noise realization ε~i _i. A.2 Residual Distributions See 3.1 Proof. Under the membership hypothesis ℋ1H_1, the residual for point i is: i r_i =i−Θ^⊤i = y_i- x_i =(Θ∗⊤i+i)−∑j=1nhij(Θ∗⊤j+j) =( ^* x_i+ _i)- _j=1^nh_ij( ^* x_j+ _j) =i−∑j=1nhijj = _i- _j=1^nh_ij _j =(1−hii)i−∑j≠ihijj =(1-h_i) _i- _j≠ ih_ij _j Since the noise terms j _j are i.i.d. Gaussian with mean 0 and covariance σ2Imσ^2I_m, the residual i r_i is also Gaussian with mean 0 and covariance: Cov(i) ( r_i) =[ii⊤] =E[ r_i r_i ] =(1−hii)2σ2Im+∑j≠ihij2σ2Im =(1-h_i)^2σ^2I_m+ _j≠ ih_ij^2σ^2I_m =σ2((1−hii)2+∑j≠ihij2)Im =σ^2 ((1-h_i)^2+ _j≠ ih_ij^2 )I_m =σ2(1−hii)Im =σ^2(1-h_i)I_m where we used the property of the hat matrix that ∑j=1nhij2=hii _j=1^nh_ij^2=h_i. Under the non-membership hypothesis ℋ0H_0, the residual for point i is: i r_i =y~i−Θ^⊤i = y_i- x_i =(Θ∗⊤i+~i)−∑j=1nhij(Θ∗⊤j+j) =( ^* x_i+ _i)- _j=1^nh_ij( ^* x_j+ _j) =~i−∑j=1nhijj = _i- _j=1^nh_ij _j =~i−hiii−∑j≠ihijj = _i-h_i _i- _j≠ ih_ij _j Similarly, the covariance of i r_i under ℋ0H_0 is: Cov(i) ( r_i) =[ii⊤] =E[ r_i r_i ] =σ2Im+hii2σ2Im+∑j≠ihij2σ2Im =σ^2I_m+h_i^2σ^2I_m+ _j≠ ih_ij^2σ^2I_m =σ2(1+hii2+∑j≠ihij2)Im =σ^2 (1+h_i^2+ _j≠ ih_ij^2 )I_m =σ2(1+hii)Im =σ^2(1+h_i)I_m Thus, we have: i∣ℋtrain∼(0,σ2(1−hii)Im) r_i _train (0,σ^2(1-h_i)I_m) i∣ℋtest∼(0,σ2(1+hii)Im) r_i _test (0,σ^2(1+h_i)I_m) ∎ A.3 Optimal Detection via Likelihood Ratio To distinguish between ℋ1H_1 and ℋ0H_0, the Neyman-Pearson lemma identifies the Likelihood Ratio (LR) as the most powerful test. See 3.2 Proof. The likelihood ratio for the residual i r_i is given by: Λ(i)=p(i|ℋtrain)p(i|ℋtest) ( r_i)= p( r_i|H_train)p( r_i|H_test) where p(i|ℋtrain)p( r_i|H_train) and p(i|ℋtest)p( r_i|H_test) are the probability density functions of the multivariate normal distributions under the two hypotheses. Using the results from Section A.2, we have: p(i|ℋtrain) p( r_i|H_train) =1(2π)m/2|σ2(1−hii)Im|1/2exp(−12i⊤(σ2(1−hii)Im)−1i) = 1(2π)^m/2|σ^2(1-h_i)I_m|^1/2 (- 12 r_i (σ^2(1-h_i)I_m)^-1 r_i ) =1(2π)m/2(σ2(1−hii))m/2exp(−12σ2(1−hii)‖i‖2) = 1(2π)^m/2(σ^2(1-h_i))^m/2 (- 12σ^2(1-h_i)\| r_i\|^2 ) and p(i|ℋtest) p( r_i|H_test) =1(2π)m/2|σ2(1+hii)Im|1/2exp(−12i⊤(σ2(1+hii)Im)−1i) = 1(2π)^m/2|σ^2(1+h_i)I_m|^1/2 (- 12 r_i (σ^2(1+h_i)I_m)^-1 r_i ) =1(2π)m/2(σ2(1+hii))m/2exp(−12σ2(1+hii)‖i‖2) = 1(2π)^m/2(σ^2(1+h_i))^m/2 (- 12σ^2(1+h_i)\| r_i\|^2 ) Substituting these expressions into the likelihood ratio, we obtain: Λ(i) ( r_i) =1(2π)m/2(σ2(1−hii))m/2exp(−12σ2(1−hii)‖i‖2)1(2π)m/2(σ2(1+hii))m/2exp(−12σ2(1+hii)‖i‖2) = 1(2π)^m/2(σ^2(1-h_i))^m/2 (- 12σ^2(1-h_i)\| r_i\|^2 ) 1(2π)^m/2(σ^2(1+h_i))^m/2 (- 12σ^2(1+h_i)\| r_i\|^2 ) =(1+hii1−hii)m/2exp(12σ2(11+hii−11−hii)‖i‖2) = ( 1+h_i1-h_i )^m/2 ( 12σ^2 ( 11+h_i- 11-h_i )\| r_i\|^2 ) =(1+hii1−hii)m/2exp(−hiiσ2(1−hii2)‖i‖2) = ( 1+h_i1-h_i )^m/2 (- h_iσ^2(1-h_i^2)\| r_i\|^2 ) Thus, the log-likelihood ratio is: logΛ(i)=m2log(1+hii1−hii)−hiiσ2(1−hii2)‖i‖2 ( r_i)= m2 ( 1+h_i1-h_i )- h_iσ^2(1-h_i^2)\| r_i\|^2 ∎ A.4 Error Curve Derivation We derive here the error trade-off curve for the optimal membership inference test based on the residual norm ‖i‖2\| r_i\|^2. We provide an illustration of these theoretical curves for different hiih_i values in Figure 5. Higher leverage scores correspond to curves closer to the origin, indicating increased vulnerability to membership inference attacks. The curves are non-symmetric due to the differing variances of the residual distributions under the two hypotheses, leading to easier detection of non-members than members. Figure 5: Theoretical error trade-off curves for different leverage scores hiih_i for m=1m=1. See 3.3 Proof. The type I error (false positive rate, i.e., non-member misclassified as member) is α(t)=ℙℋtest(‖i‖2≤t)=Fχm2(tσ2(1+hii)),α(t)=P_H_test (\| r_i\|^2≤ t )=F_χ^2_m ( tσ^2(1+h_i) ), (A.22) where Fχm2F_χ^2_m is the cumulative distribution function (CDF) of the χ2χ^2 distribution with m degrees of freedom. The type I error (false negative rate, i.e., member misclassified as non-member) is β(t)=1−ℙℋtrain(‖i‖2≤t)=1−Fχm2(tσ2(1−hii)).β(t)=1-P_H_train (\| r_i\|^2≤ t )=1-F_χ^2_m ( tσ^2(1-h_i) ). (A.23) Eliminating t by injecting Equation (A.22) into Equation (A.23), we obtain: βi(αi)=1−Fm(1+hii1−hiiFm−1(α)), _i( _i)=1-F_m ( 1+h_i1-h_i\,F_m^-1(α) ), where FmF_m is the CDF of the χ2(m)χ^2(m) distribution. ∎ Appendix B Generalized Leverage Score: Proofs In this section, we provide a formal derivation of the Generalized Leverage Score (GLSGLS) for arbitrary differentiable models, following the notation and conventions of the main paper. We also derive the proofs for the second-order derivatives required in the closed-form expression of the GLSGLS for two common loss functions: quadratic loss and cross entropy loss. B.1 Setup We restate the problem setup for completeness. Consider a dataset =(i,i)i=1nD=\( x_i, y_i)\_i=1^n and a model fθ:→f_θ:X parameterized by θ∈Θ⊂ℝpθ∈ ^p. The empirical risk is given by ℒ(θ)=1n∑i=1nℓ(fθ(i),i),L(θ)= 1n _i=1^n (f_θ( x_i), y_i ), where ℓ is a twice-differentiable loss function. The optimal parameters are θ^=argminθ∈Θℒ(θ) θ= _θ∈ L(θ). We recall the definition of the Generalized Leverage Score. See 4.1 B.2 Derivation via Implicit Differentiation We recall the closed-form expression for the GLSGLS. See 4.2 Proof. Let m∈ℕ∗m ^* be the output dimension of the model. We seek to compute the Jacobian GLSi=∂fθ^(i)∂iGLS_i= ∂ f_ θ( x_i)∂ y_i, accounting for the fact that θ θ depends implicitly on i y_i through the empirical risk minimization. Applying the chain rule, we have: ∂fθ^(i)∂i=θfθ^(i)∂θ^∂i, ∂ f_ θ( x_i)∂ y_i= J_θf_ θ( x_i) ∂ θ∂ y_i, (B.24) where θfθ^(i)∈ℝm×p J_θf_ θ( x_i) ^m× p is the Jacobian of fθ(i)f_θ( x_i) with respect to θ, evaluated at θ θ. We now need to compute ∂θ^∂i ∂ θ∂ y_i. We use implicit differentiation on the optimality condition for θ θ. This condition states that the gradient of the empirical risk vanishes at θ θ: ∇θℒ(θ^)=0. _θL( θ)=0. Since θ θ is implicitly a function of i y_i, we treat the optimality condition as an equation involving both θ and i y_i. Specifically, we express the first-order condition as ∇θℒ(θ^(i),i)=0 _θL( θ( y_i), y_i)=0, making explicit that θ θ depends on i y_i through the optimization, and that ℒL also depends directly on i y_i via the i-th term in the empirical risk. di∇θℒ(θ^(i),i) dd y_i _θL( θ( y_i), y_i) =0 =0 ∇θ2ℒ(θ^)∂θ^∂i+∂i∇θℒ(θ^,i) ∇^2_θL( θ) ∂ θ∂ y_i+ ∂ y_i _θL( θ, y_i) =0, =0, (B.25) where ∇θ2ℒ(θ^)=θ^∇^2_θL( θ)= H_ θ is the Hessian of the loss and where the partial derivative ∂i∇θℒ ∂ y_i _θL is taken with respect to i y_i only via the i-th term in the empirical risk, holding θ θ fixed. In the following we derive a closed-form for ∂i∇θℒ(θ^,i) ∂ y_i _θL( θ, y_i), and thus we drop the dependence of θ θ on i y_i in the notation for clarity. Substituting the definition of the empirical risk: ∂i∇θℒ(θ^,i) ∂ y_i _θL( θ, y_i) =∂i(1n∑j=1n∇θℓ(fθ^(j),j)) = ∂ y_i ( 1n _j=1^n _θ (f_ θ( x_j), y_j) ) =1n∑j=1n∂i∇θℓ(fθ^(j),j). = 1n _j=1^n ∂ y_i _θ (f_ θ( x_j), y_j). Since the dataset samples are independent, the loss for sample j (where j≠ij≠ i) does not depend explicitly on i y_i. Therefore, ∂i∇θℓj=0 ∂ y_i _θ _j=0 for all j≠ij≠ i. The summation collapses to the single i-th term: ∂i∇θℒ(θ^,i) ∂ y_i _θL( θ, y_i) =1n∂i∇θℓ(fθ^(i),i) = 1n ∂ y_i _θ (f_ θ( x_i), y_i) =1n∂i(θfθ^(i)⊤∇fℓ(fθ^(i),i)) = 1n ∂ y_i ( J_θf_ θ( x_i) _f (f_ θ ( x_i ), y_i ) ) =1nθfθ^(i)⊤∂2ℓ∂∂f, = 1n J_θf_ θ( x_i) ∂^2 ∂ y∂ f, as θfθ^(i) J_θf_ θ( x_i) does not depend on i y_i. Substituting back into Equation (B.25): ∂θ^∂i=−1nθ^−1θfθ^(i)⊤∂2ℓ∂∂f. ∂ θ∂ y_i=- 1n H_ θ^-1 J_θf_ θ( x_i) ∂^2 ∂ y∂ f. and then substituting into the chain rule expression for GLSiGLS_i (Equation (B.24)): GLSi _i =−1nθfθ^(i)θ^−1θfθ^(i)⊤(∂2ℓ∂f∂). =- 1n J_θf_ θ( x_i) H_ θ^-1 J_θf_ θ( x_i) ( ∂^2 ∂ f∂ y ). For m=1m=1, this reduces to the scalar case with θfθ^(i)=∇θfθ^(i)⊤ J_θf_ θ( x_i)= _θf_ θ( x_i) and ∂2ℓ∂f∂ ∂^2 ∂ f∂ y being a scalar, recovering the following result: GLSi _i =−1n(∂2ℓ∂f∂)∇θfθ^(i)⊤θ^−1∇θfθ^(i) =- 1n ( ∂^2 ∂ f∂ y ) _θf_ θ( x_i) H_ θ^-1 _θf_ θ( x_i) =−1n(∂2ℓ∂f∂)‖∇θfθ^(i)‖θ^−12. =- 1n ( ∂^2 ∂ f∂ y ) \| _θf_ θ( x_i) \|^2_ H_ θ^-1. ∎ B.3 Loss Function Derivatives We provide explicit derivations for the mixed second derivative ∂2ℓ∂∂f ∂^2 ∂ y∂ f for two common loss functions: quadratic loss and cross entropy loss with softmaxsoftmax outputs. See 4.3 Proof. For the quadratic loss, we have: ℓ(f(),)=‖f()−‖22. (f( x), y)=\|f( x)- y\|^2_2. The first derivative with respect to f is: ∂ℓ∂f=2(f()−). ∂ ∂ f=2 (f( x)- y ). The second derivative is: ∂2ℓ∂∂f ∂^2 ∂ y∂ f =∂(2(f()−)) = ∂ y(2 (f( x)- y )) =−2m, =-2 I_m, where m I_m is the m×m× m identity matrix. ∎ See 4.4 Proof. For the cross entropy loss with softmaxsoftmax outputs, we have: ℓ(f(),) (f( x), y) =−∑c=1myclog(efc()∑j=1mefj()) =- _c=1^my_c ( e^f_c( x) _j=1^me^f_j( x) ) =−∑c=1mycfc()+log(∑j=1mefj()). =- _c=1^my_cf_c( x)+ ( _j=1^me^f_j( x) ). The first derivative with respect to f is: ∂ℓ∂fc=−yc+efc()∑j=1mefj()=pc−yc, ∂ ∂ f_c=-y_c+ e^f_c( x) _j=1^me^f_j( x)=p_c-y_c, where pcp_c is the predicted probability for class c. The second derivative is: ∂2ℓ∂fc∂yd ∂^2 ∂ f_c∂ y_d =∂yd(pc−yc) = ∂ y_d(p_c-y_c) =−δcd, =- _cd, where δcd _cd is the Kronecker delta, equal to 1 if c=dc=d and 0 otherwise. Thus, the second derivative matrix is: ∂2ℓ∂∂f=−m, ∂^2 ∂ y∂ f=- I_m, where m I_m is the m×m× m identity matrix. ∎ Remark B.1. For vector-valued outputs, GLSiGLS_i is an m×m× m matrix. Scalar summaries such as the trace, Frobenius norm, or Spectral norm can be used to obtain a single leverage score per sample. As explained in the main part we decided to use the trace in our experiments as all these operations led to similar results. B.4 Proof of Proposition 4.5 See 4.5 Proof. We consider the binary logistic regression model where the prediction is p^i=σ(fθ^(i)) p_i=σ(f_ θ( x_i)) with fθ^(i)=i⊤θ^f_ θ( x_i)= x_i θ. The individual cross entropy loss is given by ℓ(y^i,yi)=−yilog(p^i)−(1−yi)log(1−p^i) ( y_i,y_i)=-y_i ( p_i)-(1-y_i) (1- p_i). 1. Gradient of the model output The gradient of the linear predictor fθ^(i)f_ θ( x_i) with respect to the parameters θ is: ∇θfθ^(i)=i _θf_ θ( x_i)= x_i 2. Second derivative of the loss We first find the derivative of the loss with respect to the linear output f. Recall that ∂p^i∂f=σ′(f)=p^i(1−p^i) ∂ p_i∂ f=σ (f)= p_i(1- p_i). ∂ℓ∂f=∂ℓ∂p^i∂p^i∂f=(−yip^i+1−yi1−p^i)p^i(1−p^i)=p^i−yi ∂ ∂ f= ∂ ∂ p_i ∂ p_i∂ f= (- y_i p_i+ 1-y_i1- p_i ) p_i(1- p_i)= p_i-y_i Taking the mixed partial derivative with respect to the label yiy_i: ∂2ℓ∂yi∂f=∂yi(p^i−yi)=−1 ∂^2 ∂ y_i∂ f= ∂ y_i( p_i-y_i)=-1 3. Hessian of the total loss The Hessian θ H_ θ for the averaged cross entropy loss ℒ=1n∑jℓjL= 1n _j _j is: θ^=∇θ2ℒ=1n∑j=1n∂2ℓj∂f2jj⊤ H_ θ= _θ^2L= 1n _j=1^n ∂^2 _j∂ f^2 x_j x_j Since ∂2ℓj∂f2=∂f(p^j−yj)=p^j(1−p^j)=wj ∂^2 _j∂ f^2= ∂ f( p_j-y_j)= p_j(1- p_j)=w_j, we have: θ^=1n⊤ H_ θ= 1n X W X 4. Computing the GLSiGLS_i (Logit Space) Substituting these into your general GLSGLS formula: GLSi=−1n(−1)‖i‖(1n⊤)−12=i⊤(⊤)−1iGLS_i=- 1n(-1) \| x_i \|^2_ ( 1n X W X )^-1= x_i ( X W X )^-1 x_i 5. Mapping to the Probability Space To find the sensitivity in the probability space ∂p^i∂yi ∂ p_i∂ y_i, we apply the chain rule: ∂p^i∂yi=∂p^i∂f×∂f∂yi=σ′(y^i)×GLSi ∂ p_i∂ y_i= ∂ p_i∂ f× ∂ f∂ y_i=σ ( y_i)×GLS_i Substituting wi=σ′(y^i)=p^i(1−p^i)w_i=σ ( y_i)= p_i(1- p_i), we obtain: ∂p^i∂yi=wii⊤(⊤)−1i ∂ p_i∂ y_i=w_i x_i ( X W X )^-1 x_i This completes the proof. ∎ Appendix C GLS for Last Linear Layer In this section, we derive the exact closed-form solution for our score matrix when differentiation is restricted to the last linear layer. We denote the Generalized Leverage Score, computed with differentiation restricted to the last linear layer, as GLSi|θsubGLS_i |_ _sub. We also denote d the dimension of the feature vector output by the penultimate layer, and we augment it with a bias term to form ~i=[(i)⊤,1]⊤∈ℝd+1 g_i=[ g( x_i) ,1] ^d+1. We analyze two cases separately: the quadratic loss for regression and the cross entropy loss for classification. The separation is necessary because the quadratic loss treats each output dimension independently, whereas the cross entropy loss couples all classes through the softmaxsoftmax function, preventing decoupled computation. Remark C.3, a the end of the section, provide a complexity analysis for both cases. C.1 Quadratic Loss (Regression) Proposition C.1 (Last Linear Layer GLSGLS for quadratic loss). Let ~i∈ℝd+1 g_i ^d+1 be the feature vector (embeddings and bias) and ~ G the matrix stacking all vectors ~i g_i. The last-layer GLSGLS for sample i under the quadratic loss is given by: GLSi|θsub=~i⊤(~⊤~)−1~i.GLS_i |_ _sub= g_i ( G G )^-1 g_i. (C.26) Proof. We consider a neural network model where the last layer is a linear transformation. 1. Notation and Jacobian Structure Let the model output be ()=()+∈ℝm f( x)= W g( x)+ b ^m. We denote the flattened parameter vector of this layer as θsub=vec([,])∈ℝm(d+1) _sub=vec([ W, b]) ^m(d+1). Since the model is linear with respect to θsub _sub, the Jacobian of the output (i) f( x_i) with respect to the parameters is a tensor product: i|θsub=∇θsub(i)=m⊗~i⊤∈ℝm×m(d+1) J_i |_ _sub= _ _sub f( x_i)= I_m g_i ^m× m(d+1) (C.27) where m I_m is the identity matrix of size m, and ⊗ denotes the Kronecker product. 2. The Hessian Matrix The Hessian of the loss ℒL with respect to θsub _sub is defined as |θsub=1n∑j=1nj⊤|θsub(∇2ℓj)j|θsub H|_ _sub= 1n _j=1^n J_j |_ _sub(∇^2_ f _j) J_j|_ _sub. For the quadratic loss, we have ∇2ℓ=2m∇^2_ f =2 I_m. Thus, the Hessian becomes: |θsub H|_ _sub =2n∑j=1n(m⊗~j)(m⊗~j⊤) = 2n _j=1^n( I_m g_j)( I_m g_j ) =m⊗(2n∑j=1n~j~j⊤) = I_m ( 2n _j=1^n g_j g_j ) =m⊗(2n~⊤~) = I_m ( 2n G G ) The inverse is given by : |θsub−1=m⊗(n2(~⊤~)−1) H|_ _sub^-1= I_m ( n2( G G)^-1 ) (C.28) 3. Derivation of the GLSGLS The Generalized Leverage Score matrix is given by GLSi=1n⋅i−1i⊤⋅(−∂2ℓ∂∂f)GLS_i= 1n· J_i H^-1 J_i · (- ∂^2 ∂ y∂ f ) We have the equivalent formulation using the restricted Jacobian and Hessian: GLSi|θsub=1n⋅i|θsub⋅|θsub−1⋅i⊤|θsub⋅(−∂2ℓ∂∂f)GLS_i |_ _sub= 1n· J_i |_ _sub· H|_ _sub^-1· J_i |_ _sub· (- ∂^2 ∂ y∂ f ) (C.29) The sensitivity term for quadratic loss is −∂2ℓ∂∂f=−(−2m)=2m- ∂^2 ∂ y∂ f=-(-2 I_m)=2 I_m. Injecting the expressions derived in Equations (C.27) and (C.28) into Equation (C.29) we have: : GLSi|θsub _i |_ _sub =2n(m⊗~i⊤)[m⊗n2(~⊤~)−1](m⊗~i) = 2n ( I_m g_i ) [ I_m n2( G G)^-1 ] ( I_m g_i ) =m⊗(~i⊤(~⊤~)−1~i) = I_m ( g_i ( G G)^-1 g_i ) This simplifies to the scalar leverage score multiplying the identity matrix. ∎ This formulation allows computing the GLSGLS for all samples in O(nd2+d3)O(nd^2+d^3) in time†This excludes the cost of the forward pass to obtain ~i g_i as these are typically available from the training or inference procedure. We refer only here to the computational overhead of the GLSGLS computation itself.. The O(nd2)O(nd^2) comes from computing ~⊤~ G G and O(d3)O(d^3) from inverting the d×d× d matrix. This is more efficient than the solution proposed in Algorithm 2 for moderate d and large n, as typically encountered in practice. C.2 Cross Entropy Loss (classification) Proposition C.2 (Last-Layer GLSGLS for Cross Entropy). Let j=softmax((j))∈ℝm p_j=softmax( f( x_j)) ^m be the probability vector for sample j, and let j=diag(j)−jj⊤ S_j=diag( p_j)- p_j p_j be the Jacobian of the loss w.r.t the logits. Let ~i∈ℝd+1 g_i ^d+1 be the feature vector (embeddings and bias). The last-layer GLSGLS for sample i under the cross entropy loss is the m×m× m matrix where the entry (u,v)(u,v) is given by: (GLSi|θsub)uv=1n~i⊤(|θsub−1)[u,v]~i (GLS_i |_ _sub )_uv= 1n g_i ( H |_ _sub^-1 )_[u,v] g_i (C.30) where |θsub∈ℝm(d+1)×m(d+1) H |_ _sub ^m(d+1)× m(d+1) is the Hessian, structured as a block matrix where the (k,l)(k,l)-th block (for 1≤k,l≤m1≤ k,l≤ m) is given by: |θsub[k,l]=1n∑j=1n(j)kl~j~j⊤∈ℝ(d+1)×(d+1). H |_ _sub_[k,l]= 1n _j=1^n( S_j)_kl g_j g_j ^(d+1)×(d+1). (C.31) Proof. We consider the same neural network model where the last layer is a linear transformation. 1. Notation and Jacobian Structure As in the regression case, let ()=()+∈ℝm f( x)= W g( x)+ b ^m and θsub=vec([,]) _sub=vec([ W, b]). The Jacobian of the output with respect to the parameters remains identical: i|θsub=m⊗~i⊤∈ℝm×m(d+1) J_i |_ _sub= I_m g_i ^m× m(d+1) (C.32) 2. The Hessian Matrix The Hessian of the loss with respect to the parameters is defined as: |θsub=1n∑j=1nj⊤|θsub(∇2ℓj)j|θsub H |_ _sub= 1n _j=1^n J_j |_ _sub(∇^2_ f _j) J_j |_ _sub For the cross entropy loss, ∇2ℓj=j∇^2_ f _j= S_j, which is the Hessian of the loss w.r.t the logits. Substituting the Jacobian structure, we can explicitly compute the structure of |θsub H |_ _sub. The matrix consists of m×m× m blocks, where each block captures the interaction between the parameters of class k and class l. The (k,l)(k,l)-th block of size (d+1)×(d+1)(d+1)×(d+1) is given by: [k,l] H_[k,l] =1n∑j=1n(j⊤|θsub(j)j|θsub)[k,l] = 1n _j=1^n ( J_j |_ _sub( S_j) J_j |_ _sub )_[k,l] =1n∑j=1n(j)kl~j~j⊤ = 1n _j=1^n( S_j)_kl g_j g_j Unlike the quadratic case, j S_j is dense, so |θsub H |_ _sub is not block-diagonal (i.e., [k,l]≠ H_[k,l]≠ 0 for k≠lk≠ l). Consequently, it must be inverted as a full matrix. 3. Derivation of the GLSGLS The Generalized Leverage Score matrix is given by: GLSi|θsub=1n⋅i|θsub⋅|θsub−1⋅i⊤|θsub⋅(−∂2ℓ∂∂)GLS_i |_ _sub= 1n· J_i |_ _sub· H |_ _sub^-1· J_i |_ _sub· (- ∂^2 ∂ y∂ f ) (C.33) The sensitivity term for cross entropy is −∂2ℓ∂∂=m- ∂^2 ∂ y∂ f= I_m. Injecting Equation (C.32) into Equation (C.33), we have: GLSi|θsub _i |_ _sub =1n(m⊗~i⊤)|θsub−1(m⊗~i) = 1n ( I_m g_i ) H |_ _sub^-1 ( I_m g_i ) To find the (u,v)(u,v)-th scalar entry of this resulting m×m× m matrix, we observe that the Kronecker structure of the Jacobian effectively projects the (u,v)(u,v)-th block of the inverse Hessian onto the feature space: (GLSi|θsub)uv=1n⋅~i⊤(|θsub−1)[u,v]~i (GLS_i |_ _sub )_uv= 1n· g_i ( H |_ _sub^-1 )_[u,v] g_i ∎ Remark C.3 (Computational Complexity Comparison). The computational cost differs significantly between the two losses due to the structure of the Hessian. For the quadratic loss, the Hessian consists of m identical diagonal blocks, allowing us to compute and invert a single (d+1)×(d+1)(d+1)×(d+1) matrix. This yields a total complexity of O(nd2+d3)O(nd^2+d^3). Conversely, for the cross entropy loss, the softmax function couples all m classes, forcing the construction and inversion of the full m(d+1)×m(d+1)m(d+1)× m(d+1) Hessian. This results in a significantly higher complexity of O(nm2d2+m3d3)O(nm^2d^2+m^3d^3).