Metraipolis › archive › dc_899f652fd3ba

Empirical Evaluation of Membership Inference Attacks on NLP Text Classifiers: A Baseline Study on SST-2 — arXiv:2609.10935

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.10935
License (as archived): CC0-1.0
Archived: 2026-10-16T05:44:18.953Z
SHA-256 of the archived text: fb99ce7d59ea946f2c8b845b96d651d8fbd3d5593c33578ef005a0ba6056199a
Stable URL of this page: https://metraipolis.com/documento/dc_899f652fd3ba

How to cite

Empirical Evaluation of Membership Inference Attacks on NLP Text Classifiers: A Baseline Study on SST-2 — arXiv:2609.10935 — arXiv (en), https://arxiv.org/abs/2609.10935 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_899f652fd3ba (Metraipolis archive dc_899f652fd3ba, sha256 fb99ce7d59ea946f2c8b845b96d651d8fbd3d5593c33578ef005a0ba6056199a)

BibTeX

@misc{dc899f652fd3ba,
  title = {Empirical Evaluation of Membership Inference Attacks on NLP Text Classifiers: A Baseline Study on SST-2 — arXiv:2609.10935},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.10935},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_899f652fd3ba; sha256 fb99ce7d59ea946f2c8b845b96d651d8fbd3d5593c33578ef005a0ba6056199a},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.10935. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Membership inference attacks (MIAs) try to determine whether a specific record was used to train a model, a privacy risk that matters in natural language processing (NLP), where training data can contain sensitive user text. This paper presents a controlled benchmark of membership inference vulnerability for text classification on the GLUE SST-2 sentiment dataset. A TF-IDF + Logistic Regression pipeline and a fine-tuned DistilBERT classifier are compared under a loss-threshold MIA, with utility measured by development accuracy and macro F1. DistilBERT reached 0.9466 accuracy and 0.9460 macro F1 against 0.8756 and 0.8727 for Logistic Regression, yet both models leaked membership signal (Attack AUC 0.5615 and 0.5800, respectively). Two mitigations were tested. Stronger regularization reduced leakage for Logistic Regression at a visible utility cost, whereas fine-tuning DistilBERT for 2 epochs instead of 3 reduced leakage with negligible accuracy loss. Lightweight training adjustments can improve the privacy-utility trade-off without complex defenses.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-11 in cs.CL).
Categorie arXiv: Cryptography and Security (cs.CR) ; Computation and Language (cs.CL); Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2609.10935 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-16T05:23:57.036Z dalla pagina https://arxiv.org/catchup/cs.CL/2026-09-11?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).