Membership Inference Defenses — Beyond Basic Privacy

Why it matters

Membership inference is real privacy risk. Understanding defenses shapes training decisions.

The architecture

DP-SGD: differential privacy in training via gradient clipping + noise.

Ensemble: distinct models on partitions; harder to attack.

How it works end to end

DP-SGD: clip per-sample gradients to bound sensitivity; add Gaussian noise proportional to sensitivity. Formal privacy budget ε.

Model deduplication: prevent same training example being memorized.

Quality-privacy trade-off: stronger DP = worse quality.