Quantized DNNs remain as vulnerable to membership inference as full-precision models

The five-minute version

Quantization at practical levels (4-8 bits) does not meaningfully reduce membership inference attack (MIA) success, while only extreme low-bit (2-bit) quantization yields privacy gains but degrades model accuracy by up to 95%. The study evaluates eight MIAs across six quantization methods and finds that existing defenses (dropout, differential privacy, adversarial regularization) add only limited extra protection and further hurt utility. The evidence is based on experiments on four public benchmark datasets and multiple DNN architectures.

What they found 1

• Practical quantization levels (4-8 bits) have limited impact on membership privacy risks.

  “Our results reveal that practical quantization levels (4-8 bits) have limited impact on membership privacy risks, with quantized models remaining largely as vulnerable as their full-precision counterparts.”

What undercuts it the paper’s own results

• For MobileNetV2 on the CINIC-10 dataset, 4-bit quantization substantially reduces MIA effectiveness, with attack accuracy approaching random guessing.

What’s new here 4

• Evaluates eight MIAs (both black-box and white-box) on six modern quantization techniques, far broader than prior work.
• Includes both post-training quantization and quantization-aware training, as well as fixed- and mixed-precision schemes.
• Assesses the effectiveness of existing full-precision MIA defenses when applied to quantized models.
• Provides a public codebase and datasets for reproducible privacy evaluation of quantized DNNs.

Artifacts & methods 12

• PrivQNN frameworksystem
• CIFAR-100 datasetdataset
• CINIC-10 datasetdataset
• Texas datasetdataset
• Location datasetdataset
• ResNet-18primitive
• MobileNetV2primitive
• MLP (5-layer)primitive
• Post-Training Quantization (PQ)system
• AdaRoundsystem
• QDropsystem
• PACTsystem

Topics