New score finds the training data most open to privacy attacks

Researchers published a method to find which training points of a model are most open to membership inference attacks. Such an attack tries to find if one record was in the training data. The method uses one model and no shadow models (more models that copy the target). The latest version of the paper is dated 12 November 2026.

How it works

The authors show that the risk for one record comes from its loss and also from a geometric measure of the data. In a linear model, they give a correct division into a leverage score and a loss term. For deep networks, they use a surrogate score on the last layer.

The proof

Tests on many datasets and model types show that the score is better than loss and gradient norm baselines when they find the highest risk points. The summary gives no numbers. The tests use top attacks.

What is not known

The summary does not tell how large the increase is. It does not name the datasets or models. It does not tell if the score works for large language models.

Insight: Output checks can miss privacy risk

Earlier, researchers found that output tests show more unlearning than there is. Now these authors find that the privacy risk of one record does not come only from loss, an output measure. This reads as a trend: tests that use only outputs miss risk that is in the model. Teams that claim privacy or deletion must add checks of the model itself.