Predict Privacy Leakage From Weights Alone: ρ=0.87
Membership inference audits are the worst kind of expensive: to know whether your model leaks training data, the state of the art (LiRA) trains dozens of shadow models per target, replays the attack, and only then tells you what you already suspected. A new arXiv preprint (2609.11780) asks a heretical question: can you get most of that answer by simply looking at the weight matrices? The measured answer is yes — stable rank alone tracks LiRA attack success at Spearman's ρ = 0.87 on CIFAR-10 and ρ = 0.60 on tabular data, with no shadow models, no data, no attack.
The problem: audits priced in shadow models
Membership inference attacks (MIAs) ask a binary question about every training point: "was this in the training set?" LiRA, the current reference attack, answers it by calibrating per-example likelihoods against an ensemble of ~64 shadow models trained under matched conditions. That's the cost of an honest audit: 64 model trainings per audited model. Fine for one model; impossible for a training grid, a release pipeline, or a sweep over checkpoints. Meanwhile every cheaper proxy on the table — generalisation gap, train/test accuracy delta — is noisy, requires held-out data, and (as this paper shows) leaves signal on the floor.
The method: read the spectrum, skip the attack
The authors borrow their metrics from the heavy-tailed self-regularisation framework — the same machinery behind WeightWatcher. For each layer's weight matrix W, form the correlation matrix X = W₂ᵗW and read its eigenvalue spectral density (ESD). From that ESD they extract four numbers: the power-law exponent α, the log α-norm, the log spectral norm, and the stable rank (effective dimensionality of the matrix). None of these require training data or model outputs — they are pure white-box weight arithmetic.
The experiment: 44 MLPs across 11 depth/width configurations on CIFAR-10 and the OpenML Volkert tabular dataset, each run under a learning-rate and weight-decay grid, then attacked with LiRA to get ground-truth privacy leakage (AUC plus TPR@0.001 — the attack's hit rate when you tolerate only 1-in-1000 false positives). Correlate spectrum against leakage. That's the whole design, and its simplicity is the point.
mindmap
root((LiRA audit))
Old path: ~64 shadow models per target
expensive
data-dependent
only audits one model
New path: weight spectrum, no shadows
stable rank: AUC rho=0.87
log alpha-norm: TPR@0.001 rho=-0.55
beats generalisation gap
combined model: R2=0.71
The results: the spectrum knows things the gap doesn't
Three findings deserve the headline, one deserves the footnote it won't get.
- Stable rank is the AUC oracle. ρ = 0.87 (CIFAR-10) and 0.60 (Volkert) against LiRA AUC, both at p ≤ 0.01. Bigger effective dimensionality — a more random-like weight spectrum — means more attack surface.
- Log α-norm owns the low-FPR regime. For TPR@0.001, the metric regulators actually care about, α-norm correlates at ρ = −0.55 / −0.40 while stable rank collapses to ρ = 0.023 on CIFAR-10. The two spectral metrics are complementary, not interchangeable: stable rank predicts overall attack power, α-norm predicts the scarce-signal regime.
- The spectrum beats the generalisation gap at its own game. εgap reaches only ρ = 0.675 on CIFAR-10 AUC (and a dismal ρ = 0.043 on TPR@0.001). Stable rank hits 0.874. And a joint OLS model (εgap + stable rank) reaches R² = 0.71 versus 0.47 and 0.43 for each alone — both coefficients stay significant, so the spectrum carries information the gap literally does not contain.
The uncomfortable footnote: stable rank also correlates with test accuracy (ρ = 0.73 CIFAR-10, raw accuracy–AUC ρ = 0.766). Better models leak more in this setup. A cheap privacy audit that quietly rewards you for being accurate is a metric you should read with both eyes open.
Limitations the authors underplay
Credit where due — the limitations section is honest. But three cuts matter more than the authors admit:
- MLPs only, 100 epochs, 44 models per dataset. Every headline number lives inside a grid of small MLPs. The WeightWatcher literature's messiest open question is whether layer-level spectral diagnostics survive residual connections and attention; this paper doesn't touch a ResNet or a transformer. Treat ρ = 0.87 as "true in the sandbox."
- One attack. LiRA is calibrated against shadow-model likelihood distributions. A spectrum that predicts LiRA vulnerability is not the same as a spectrum that predicts membership leakage in general — loss-ratio attacks, quantile-regression attacks, and embedding-space MIAs may key off different model properties entirely.
- No held-out validation. The regressions are fit and read on the same 44 models. The authors flag this themselves; the claimed complementarity of εgap and stable rank is suggestive, not demonstrated. A cross-dataset transfer test would have been the killer experiment, and it isn't there.
- And the correlation is not a mechanism. The working hypothesis — spectrum proxies generalisation, generalisation proxies leakage — is explicitly undermined by the authors' own data, since spectrum beats generalisation as a predictor. Something else is doing the work, and this study can't name it.
Why builders should care
The practical read: a triage tool, not a certification tool. Computed from weights alone, stable rank and α-norm give you a zero-training-cost sweep across every checkpoint in a training run — find the spike in effective dimensionality at epoch 37, then spend real shadow-model money auditing only the suspicious region. That inverts the current economics, where the attack cost forces blind sampling. For anyone shipping models trained on user data, this is also the cheapest early-warning signal for the memorisation that unlearning and DP claim to fix — and a natural gate for model selection: reject checkpoints whose spectrum says "leaky" before they ever see an auditor.
The paper's binary-risk result makes the gate concrete: α and log α-norm reliably separated high-risk from low-risk models on both datasets, while the gap and stable rank flipped direction between domains. If you build one guardrail from this paper, build the α-based flag, not the stable-rank regression.