Membership Inference Risks in Quantized Models: A Theoretical and Empirical Study
On the map: LLM safety and security → Membership inference attacks
Abstract (arXiv)
Quantizing machine learning models has demonstrated its effectiveness in lowering memory and inference costs while maintaining performance levels comparable to those of the original models. In this work, we investigate the impact of quantization procedures on privacy in data-driven models, focusing on their vulnerability to membership inference attacks. Membership Inference Security (MIS) has recently been proposed to characterize the privacy of machine learning models against the most powerful (and possibly unknown) attacks. However, quantifying MIS appears to be computationally very difficult. In this paper, we propose a new MIS indicator for post-training quantization procedures of machine learning models that minimizes an empirical loss. This new indicator is a byproduct of a theoretical asymptotic analysis of the MIS in this context. We also present a methodology for empirically estimating our MIS indicator. Using synthetic datasets and real-world data (in the context of drug discovery), we demonstrate the effectiveness of our approach in assessing and ranking the MIS of different quantizers.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 50 of its 85 references that are in the map. First posted on arXiv 10 Feb 2025.
Builds on
50 of 85 references.
Closest ancestors · 6
Same direction, newest first
- 2024Do Membership Inference Attacks Work on Large Language Models?12 Feb
- 2023Low-Cost High-Power Membership Inference Attacks6 Dec
- 2023Fundamental Limits of Membership Inference Attacks on Machine Learning Models20 Oct
- 2021Membership Inference Attacks From First Principles7 Dec
- 2021Membership Inference Attacks on Machine Learning: A Survey14 Mar
- 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models4 Feb
Other references · 44
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
- 2020Scaling Laws for Neural Language Modelscited by 6,411
- 2023Qwen Technical Reportcited by 3,273
- 2022Training Compute-Optimal Large Language Modelscited by 2,927
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2013Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computationcited by 2,031
- 2022GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformerscited by 1,838
- 2017Quantization and Training of Neural Networks for Efficient Integer-Arithmetic-Only Inferencecited by 1,548
- 2023AWQ: Activation-aware Weight Quantization for LLM Compression and Accelerationcited by 1,234
- 2022LLM.int8(): 8-bit Matrix Multiplication for Transformers at Scalecited by 881
- 2021A Survey of Quantization Methods for Efficient Neural Network Inferencecited by 798
32 more
- 2023Extracting Training Data from Diffusion Modelscited by 723
- 2021A White Paper on Neural Network Quantizationcited by 453
- 2023Detecting Pretraining Data from Large Language Modelscited by 375
- 2019Data-Free Quantization Through Weight Equalization and Bias Correctioncited by 328
- 2024The Era of 1-bit LLMs: All Large Language Models are in 1.58 Bitscited by 289
- 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
- 2023A Survey on Model Compression for Large Language Modelscited by 263
- 2021Therapeutics Data Commons: Machine Learning Datasets and Tasks for Drug Discovery and Developmentcited by 258
- 2021Pre-training Molecular Graph Representation with 3D Geometrycited by 248
- 2020Information Leakage in Embedding Modelscited by 199
- 2023BitNet: Scaling 1-bit Transformers for Large Language Modelscited by 175
- 2023Beyond Memorization: Violating Privacy Via Inference with Large Language Modelscited by 167
- 2017Machine Learning Models that Remember Too Muchcited by 165
- 20213D Infomax improves GNNs for Molecular Property Predictioncited by 146
- 2018Scalable Methods for 8-bit Training of Neural Networkscited by 139
- 2024LlaSMol: Advancing Large Language Models for Chemistry with a Large-Scale, Comprehensive, High-Quality Instruction Tuning Datasetcited by 124
- 2022ChemBERTa-2: Towards Chemical Foundation Modelscited by 123
- 2022Overcoming Oscillations in Quantization-Aware Trainingcited by 116
- 2020ML Privacy Meter: Aiding Regulatory Compliance by Quantifying the Privacy Risks of Machine Learningcited by 66
- 2021Chemical-Reaction-Aware Molecule Representation Learningcited by 36
- 2024A Survey of Low-bit Large Language Models: Basics, Systems, and Algorithmscited by 30
- 2024ABQ-LLM: Arbitrary-Bit Quantized Inference Acceleration for Large Language Modelscited by 22
- 2025A Survey on Responsible LLMs: Inherent Risk, Malicious Use, and Mitigation Strategycited by 20
- 2021Membership Inference Attacks on Deep Regression Models for Neuroimagingcited by 19
- 2022Privacy-Aware Compression for Federated Data Analysiscited by 17
- 2023Randomized Quantization is All You Need for Differential Privacy in Federated Learningcited by 16
- 2024FBI-LLM: Scaling Up Fully Binarized LLMs from Scratch via Autoregressive Distillationcited by 12
- 2021Bounding Information Leakage in Machine Learningcited by 11
- 2023Hardware-Aware DNN Compression via Diverse Pruning and Mixed-Precision Quantizationcited by 9
- 2024ViT-1.58b: Mobile Vision Transformers in the 1-bit Eracited by 7
- 2022Measuring Unintended Memorisation of Unique Private Features in Neural Networkscited by 5
- 2023Killing Two Birds with One Stone: Quantization Achieves Privacy in Distributed Learningcited by 3
Built on by
Citing papers per year: 2025: 1; 2026: 2.
3 papers.