mlsanityData to 14 Oct 2026

Measuring Data Leakage in Machine-Learning Models with Fisher Information

arXiv 2102.11673 ↗First posted 23 Feb 2021cs.LG cs.CRcited by 33

Not on the map. Why?

Abstract (arXiv)

Machine-learning models contain information about the data they were trained on. This information leaks either through the model itself or through predictions made by the model. Consequently, when the training data contains sensitive attributes, assessing the amount of information leakage is paramount. We propose a method to quantify this leakage using the Fisher information of the model about the data. Unlike the worst-case a priori guarantees of differential privacy, Fisher information loss measures leakage with respect to specific examples, attributes, or sub-populations within the dataset. We motivate Fisher information loss through the Cram'er-Rao bound and delineate the implied threat model. We provide efficient methods to compute Fisher information loss for output-perturbed generalized linear models. Finally, we empirically validate Fisher information loss as a useful measure of information leakage.

Key facts. Cited by 33 papers in the map (data through 14 Oct 2026). Builds on 11 of its 56 references that are in the map. First posted on arXiv 23 Feb 2021.

Builds on

11 of 56 references.

References · 11

  1. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  2. 2020Extracting Training Data from Large Language Modelscited by 2,189
  3. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  4. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 864
  5. 2017Renyi Differential Privacycited by 650
  6. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  7. 2018Understanding Membership Inferences on Well-Generalized Learning Modelscited by 90
  8. 2017Towards Measuring Membership Privacycited by 29
  9. 2020Modelling and Quantifying Membership Information Leakage in Machine Learningcited by 13
  10. 2016Inferential Privacy Guarantees for Differentially Private Mechanismscited by 11
  11. 2020Black-box Model Inversion Attribute Inference Attacks on Classification Modelscited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 1; 2022: 8; 2023: 7; 2024: 6; 2025: 5; 2026: 6.

33 papers.

Sort:

By area:

  1. 2022Forecast Evaluation for Data Scientists: Common Pitfalls and Best Practicescited by 55
  2. 2022Bounding Training Data Reconstruction in Private (Deep) Learningcited by 46
  3. 2023Unleashing the Power of Randomization in Auditing Differentially Private MLcited by 20
  4. 2022Analyzing Privacy Leakage in Machine Learning via Multiple Hypothesis Testing: A Lesson From Fanocited by 17
  5. 2022Inferring Sensitive Attributes from Model Explanationscited by 15
  6. 2023Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Informationcited by 13
  7. 2021SHAPr: An Efficient and Versatile Membership Privacy Risk Metric for Machine Learningcited by 10
  8. 2022Privacy-Aware Compression for Federated Learning Through Numerical Mechanism Designcited by 6
  9. 2023Understanding Deep Gradient Leakage via Inversion Influence Functionscited by 6
  10. 2023Fundamental Limits of Membership Inference Attacks on Machine Learning Modelscited by 5
  11. 2025Practical Bayes-Optimal Membership Inference Attackscited by 5
  12. 2024Defending Against Data Reconstruction Attacks in Federated Learning: An Information Theory Approachcited by 4
21 more
  1. 2024Fisher Mask Nodes for Language Model Mergingcited by 4
  2. 2022Measuring and Controlling Split Layer Privacy Leakage Using Fisher Informationcited by 3
  3. 2023Automating Wood Species Detection and Classification in Microscopic Images of Fibrous Materials with Deep Learningcited by 3
  4. 2024Guarantees of confidentiality via Hammersley-Chapman-Robbins boundscited by 3
  5. 2025From Risk to Resilience: Towards Assessing and Mitigating the Risk of Data Reconstruction Attacks in Federated Learningcited by 3
  6. 2022How Do Input Attributes Impact the Privacy Loss in Differential Privacy?cited by 2
  7. 2023Uncovering Model Processing Strategies with Non-Negative Per-Example Fisher Factorizationcited by 2
  8. 2024Privacy Amplification for the Gaussian Mechanism via Bounded Supportcited by 2
  9. 2026Federated Causal Discovery Across Heterogeneous Datasets under Latent Confoundingcited by 2
  10. 2023SoK: Memorisation in machine learningcited by 1
  11. 2025AdaBet: Gradient-free Layer Selection for Efficient Training of Deep Neural Networkscited by 1
  12. 2022Protecting Data from all Parties: Combining FHE and DP in Federated Learningcited by 0
  13. 2024SimClone: Detecting Tabular Data Clones using Value Similaritycited by 0
  14. 2024Bayes-Nash Generative Privacy Against Membership Inference Attackscited by 0
  15. 2025Training Set Reconstruction from Differentially Private Forests: How Effective is DP?cited by 0
  16. 2025Nosy Layers, Noisy Fixes: Tackling DRAs in Federated Learning Systems using Explainable AIcited by 0
  17. 2026Reducing information dependency does not cause training data privacy. Adversarially non-robust features docited by 0
  18. 2026Certified but Private: Scalable Zero-Knowledge Proofs for Neural Network Guaranteescited by 0
  19. 2026Spectrum-Aware Bounds on Invertibility for Privacy-Enhancing Instance Encodingcited by 0
  20. 2026On the Relationship between Model Quantization and Model Inversion Attackscited by 0
  21. 2026From Pixels to Privacy-Sensitive Features: An Information-Theoretic Framework for Reconstruction Boundscited by 0