{"id":"c2394fc8-07a0-474e-9eec-54f4f1c31298","arxiv_id":"2501.11577","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A white-box attack on the student model can infer teacher-training membership in transfer learning by comparing the student's hidden representations with those of a shadow student model.","lead":"This paper describes a new privacy attack on transfer learning. An attacker who can see the internal features of the fine-tuned student model can guess whether a specific image was used to train the original teacher model, even without seeing that model.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported At.T & Ac.S numbers do not clearly measure teacher membership: Algorithm 1 trains on shadow-student-member data labeled as teacher-member plus random-noise \"non-members,\" so the accuracy may reflect noise-vs-real separation rather than teacher leakage.","rationale":"The reader correctly identifies the unvalidated proxy in Algorithm 1: shadow-student-member data is labeled as teacher-member without ground-truth teacher membership. My stress-test sharpens this into a more specific validity threat. The class-0 non-member set is random noisy images, so the trained classifier and thresholds can achieve high apparent accuracy simply by separating real images from random noise; this does not require any teacher-membership signal. In addition, Section IV.B's inference procedure does not actually query the shadow student model with the target, so the proposed differential representation is not used at attack time in the way Algorithm 1 suggests. These issues are internal to the evaluation rather than disagreements with external consensus, and they are not resolved by the paper's stated limitations. Because the reported accuracies cannot be interpreted as measuring teacher membership without a corrected evaluation, the appropriate disposition is UNVERDICTED rather than CONDITIONAL: the central claim may be true, but the present manuscript does not provide valid empirical support for it. A focused re-evaluation with true teacher-membership labels and real non-member images would settle the question.","tokens_in":23621,"tokens_out":5237,"duration_ms":64269,"concrete_test":"Re-run the At.T & Ac.S evaluation with a corrected protocol: train the attack model on true teacher-membership labels (teacher-member and teacher-non-member images from the same dataset, e.g., ImageNet splits) and test on held-out teacher images, using the same hidden layer as the rest of the pipeline; if accuracy/AUC falls to roughly 0.5, the proxy/noise shortcut explains the reported results. As a complementary check, replace the random-noise class-0 set with real non-member images from the teacher distribution; if accuracy collapses, the reported numbers were driven by noise-vs-real separation.","verdict_should_be":"UNVERDICTED","load_bearing_attack":"The central claim—teacher membership is inferable from white-box student access, with Section VI.B reporting accuracies of 0.581, 0.632, and 0.728—depends on Algorithm 1 and the Section IV.B threshold procedure. In Algorithm 1, the class-1 \"teacher-member\" training set is compiled as (|M_s(x) - M'_s(x)|, 1) for x in mD_shadow_s, i.e., data used to train the shadow student model, not data with known teacher-membership status. The class-0 set is D_n, random noisy images. Thus the three-way classifier is trained to separate shadow-student-member data from random noise; no ground-truth teacher-membership label enters the training pipeline. At test time, Section VI.A evaluates against teacher member/non-member splits, so the reported accuracy is meaningful only if the proxy correlates with true teacher membership—an assertion that is never validated. Moreover, the threshold attack in Section IV.B never queries the shadow student model M'_s with the target; it compares M_s(x_target) to stored raw activations and stored difference vectors. Because class 0 consists of random noise, any real image (teacher member or non-member) is trivially far from the noise class, so the \"non-member\" decision is confounded by real-vs-noise separation rather than membership. The reported numbers therefore do not establish the claimed attack.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a white-box membership inference attack (MIA) against transfer learning, targeting the teacher model while only accessing the student model (At.T & Ac.S). The attack trains a three-class classifier on features extracted from the real student model, a from-scratch shadow student model, and random noisy images, and it also defines an adaptive thresholding procedure. Experiments are reported on CIFAR-100, Flowers102, and Cats vs Dogs, with a ResNet50 teacher pretrained on ImageNet and with additional results for VGG19, Inception v3, and DenseNet169. The headline numbers are accuracies of 0.581, 0.632, and 0.728 for At.T & Ac.S on the three datasets, with AUC values near or above 0.7, which the paper interprets as evidence that the teacher's training data remain susceptible to MIAs even when the attacker only sees the student model.","tokens_in":23899,"tokens_out":7749,"duration_ms":78839,"significance":"The research question is timely and important: transfer learning is widely deployed, and understanding whether a fine-tuned student model leaks information about the teacher's private training data has clear privacy implications. The paper is also useful in that it considers three attack cases (At.T & Ac.S, At.T & Ac.T, At.S & Ac.S), evaluates multiple architectures and datasets, and compares against two existing transfer-learning MIA baselines. If the central claim were established, the attack would be a meaningful contribution to the MIA literature. However, as written, the evidence does not support the claim: the attack model in Algorithm 1 is trained without ground-truth teacher membership labels, the threshold-based decision uses random noise as the non-member class, and the evaluation target in Section VI.A/VI.B is ambiguous. These issues are load-bearing rather than cosmetic, so the current manuscript does not substantiate its main conclusion.","major_comments":[{"comment":"The class-1 ('teacher-member') training set is compiled as the L2 difference between the real student model and the shadow student model evaluated on the shadow student's own member data, i.e., (|Ms(x) − M′s(x)|, 1) for x ∈ mD_shadow_s. No ground-truth teacher membership label enters this construction, so the attack model is trained to separate shadow-student-member features (class 2), L2 differences on those same points (class 1), and random noise (class 0), rather than to implement the teacher-membership decision defined in Eq. (2). The paper never validates that this proxy correlates with true teacher membership; the reported accuracies in Section VI.B are therefore not, by themselves, evidence that teacher membership is inferable.","section":"§IV.A, Algorithm 1 Step 3"},{"comment":"The threshold-based decision procedure uses random noisy images D_n as the non-member class and calibrates σ2 and σ3 on distances from noise features to shadow and real student features. In consequence, any natural image—whether a teacher member or a non-member—will likely be far from the noise class in representation space, so the 'non-member' outcome is confounded with a real-versus-noise separation rather than with membership. A control experiment that replaces D_n with real teacher non-member images during attack training is needed to rule out this confound.","section":"§IV.B and Algorithm 2"},{"comment":"The setup states that the teacher model is trained on ImageNet and transferred to student models on CIFAR-100, Flowers102, and Cats vs Dogs, yet Figure 6 and Table III present At.T & Ac.S results 'on three student datasets.' If the evaluated member/non-member points for teacher membership are drawn from the student datasets, then none of those points is a teacher member by construction, and the reported accuracies cannot measure the claimed attack. The paper must specify which dataset provides the true teacher member and non-member test points and must reconcile the statement that the teacher is pretrained on ImageNet with the later statement in Section VI.A that '70% [of the initial dataset is] for training the teacher model and 30% for the student model.'","section":"§VI.A and §VI.B"},{"comment":"The comparison with Zou et al. and TransMIA is not like-for-like: the proposed method uses white-box access to intermediate hidden-layer features, while the baselines are described as black-box attacks, and Table V even labels the scenario as 'black-box' for all rows. The observed gains (e.g., 0.728 vs. 0.624 vs. 0.539 for Cats vs Dogs) may reflect the stronger access assumption rather than the proposed methodology, so the 'outperforms SOTA' claim is not established as stated.","section":"§VI.D and Table V"},{"comment":"The paper never states which hidden layer is used for feature extraction in the experiments. Because the entire method relies on hidden-layer representations, the reported numbers depend on an unstated layer choice; the authors should identify the layer and report a sensitivity analysis over layers.","section":"§VI.A"}],"minor_comments":[{"comment":"Algorithm 2 contains confusing sign flips (e.g., distance1 ← −dis(M′s(x), Ms(x)) and then σ1 ← −median(distance1)) and a typo in line 6 ('dis(d(Ms(x1), Ms(x2)))'). Please simplify the expressions and correct the typo.","section":"Algorithm 2"},{"comment":"In decision rule (ii), the phrase 'the feature representation of the target data record is not the number of student number' is ungrammatical and should be rewritten to 'is not a member of the student model's training set.'","section":"§IV.B"},{"comment":"Section VII.B states that TransMIA improves attack effectiveness 'using a white-box approach,' while the Introduction claims the proposed work is the first white-box attack against transfer learning. Please reconcile these statements or temper the novelty claim.","section":"§VII.B vs. §I"},{"comment":"Table V lists the 'Scenario' for all approaches, including the proposed one, as 'black-box,' which contradicts the white-box framing used throughout the rest of the paper. This needs to be corrected.","section":"Table V"},{"comment":"In the submitted version, Figures 6–9 contain garbled text, making the plots unreadable. The captions, axis labels, and legends need to be regenerated so the reported numbers can be visually verified.","section":"Figures 6-9"},{"comment":"The limitations section states that Manhattan and Cosine distances showed lower MIA accuracy, but no such results are reported anywhere. Either include the supporting numbers or remove the claim.","section":"§VIII.B"}],"recommendation":"major_revision","confidential_remarks":"The manuscript addresses a worthwhile question and the core idea is interesting, but the current experimental pipeline does not use ground-truth teacher membership labels in attack training, the threshold decision is confounded with a real-versus-noise separation, and the evaluation target in Section VI is ambiguous. I recommend major revision rather than rejection because the idea may be salvageable: the authors should rework Algorithm 1 to use true teacher membership labels (e.g., via a shadow teacher) or explicitly validate the L2-difference proxy, clarify and correct the evaluation data, and rerun the comparisons under matched access assumptions. The paper is not acceptable in its present form."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper names a genuinely new attack scenario — teacher membership via white-box access to the student — but the current evaluation doesn't convincingly measure that scenario. The proxy is unvalidated and the attack description is internally inconsistent.\n\nWhat's new and good: The At.T & Ac.S setup (infer teacher membership from student hidden representations) is not in the cited Zou et al. or TransMIA work. The differential-representation idea is plausible, and the paper does real work across four teacher architectures and three student datasets. The limitations and assumptions section is candid about scope, and the comparison to black-box baselines is a reasonable touch.\n\nWhere it gets soft: Algorithm 1 trains the attack model on pseudo-labels — the L2 difference between real and shadow student features on shadow-student member data is labeled 'teacher-member', and random noise is labeled 'non-member'. True teacher-membership labels never enter the training. That means the reported test accuracy only means something if this proxy correlates with true teacher membership, and the paper never checks that directly. The threshold procedure in Section IV.B makes things worse: the medians are calibrated using noise, and the 'non-member' decisions are effectively distances to a noise cluster. Since test data are all real images, the real-vs-noise separation can dominate the result. I also note the white-box novelty claim is contradicted by the paper's own related-work description of Hidano et al. as white-box, and Table V lists the scenario as black-box. The paper never says which intermediate layer is used for the features, and no error bars or code are reported.\n\nSo the central claim — that teacher membership leaks through the student — is not yet established by the evidence presented. That said, the scenario is worth investigating, and the idea deserves a rigorous look. A serious referee could ask the authors to validate the proxy with true labels, clarify the attack pipeline (classifier vs thresholds), fix the novelty claim, and report variance.\n\nFor you: this is a good paper for discussing what counts as validation in MIA research, but I wouldn't build on the numbers. I'd send it to review, not desk-reject, but with a clear request for major revision.","headline":"Genuinely new attack scenario, but the evaluation pipeline doesn't yet show that the reported accuracies measure teacher membership.","tokens_in":24445,"tokens_out":7996,"would_cite":false,"duration_ms":83375,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a white-box attacker with access only to the fine-tuned student model can infer membership in the teacher model's private training data by comparing hidden-layer activation discrepancies with a shadow student model.","keywords":["membership inference attack","transfer learning","teacher-student model","white-box attack","shadow model","hidden-layer representation discrepancy","privacy leakage","adaptive threshold selection"],"falsifier":"Take a teacher model whose full training set is known, hold out a balanced set of true non-members from the same distribution, and run the attack against both groups. If accuracy on that ground-truth membership split falls to chance while the proxy-labeled accuracy remains high, the claimed teacher-membership signal is an artifact of the proxy labels; repeating the test across several intermediate layers would also show whether the signal depends on an unstated layer choice.","tokens_in":23377,"feed_emoji":"🕵️","tokens_out":8065,"duration_ms":77876,"temperature":0.7,"pith_summary":"Transfer learning releases the fine-tuned student model but keeps the teacher model private; this paper claims that privacy is not preserved. The proposed attack assumes a white-box view of the student model only, then trains a shadow student model from scratch on data with a similar distribution, and compares the hidden-layer activation vectors of the two models for the same input. The difference between those vectors is treated as evidence that the input was part of the teacher model's training set. On CIFAR-100, Flowers102, and Cats vs. Dogs, the paper reports attack accuracies of 0.581, 0.632, and 0.728, with AUC values approaching or exceeding 0.7, and reports that its method beats the two black-box transfer-learning baselines it compares against. The upshot, if correct, is that fine-tuning a model does not protect the original training data of the model it was derived from.","feed_headline":"Student model leaks teacher's training membership","feed_subtitle":"Hidden-layer differences with a shadow student reveal which images trained the original teacher.","key_machinery":"The load-bearing object is the differential feature-representation vector, the elementwise absolute difference between the real student model's hidden-layer output and the shadow student model's hidden-layer output for the same input. The paper's assumption is that the student inherits the teacher's frozen feature extractor, so data that shaped the teacher leaves a mark in the student's representations that a from-scratch shadow model does not share. That difference, measured with L2 distance and compared against three median-selected thresholds, is what lets the attack separate teacher-members, student-members, and non-members.","core_discovery":"On the paper's own terms, the discovery is that teacher-membership information survives transfer learning and is detectable from the student alone. The attack labels the absolute difference between the real student's hidden activations and the shadow student's hidden activations, $|M_s(x)-M'_s(x)|$, as 'teacher-member' for inputs in the shadow member set; labels the real student's raw activations $M_s(x)$ as 'student-member'; and labels activations from random noisy images as 'non-member'. A three-class classifier is trained on these labels, and at inference time the attacker measures L2 distances between the target's activation vector and the labeled training vectors, with three median-derived thresholds ($\\sigma_1,\\sigma_2,\\sigma_3$) deciding between the classes. The paper reports the attack succeeds across four teacher architectures and three student datasets, with accuracy increasing as more teacher layers are frozen in the student.","pith_inferences":["A stricter test of the claimed signal, not run in the paper, would hold out true teacher members and non-members, since Algorithm 1 labels shadow-member inputs as teacher-members without ground-truth teacher labels; that split would show whether the reported accuracies measure teacher membership or a proxy of it.","The paper does not specify which intermediate layer supplies the hidden activations, so a sensitivity analysis across layers would clarify how deep the teacher-membership trace survives and which layer maximizes the discrepancy.","The same discrepancy principle could be probed in longer transfer chains (teacher to student to student), where each stage may preserve or dilute the teacher-membership trace; this is a testable extension the authors flag as future work.","If the effect is real, a targeted defense would randomize or distill the student's frozen feature extractor specifically to break the correlation between teacher membership and hidden-activation discrepancies, rather than relying on output-level defenses."],"forward_implications":["A white-box view of any fine-tuned student model should be treated as partial exposure of the teacher's private training set, even if the teacher is never released.","Freezing more layers in the student increases the leak: reported accuracy on Cats vs. Dogs rises from 0.637 with the first two parts frozen to 0.809 with the first four parts frozen.","Leakage estimates from black-box transfer-learning attacks understate the risk, because the reported accuracy here exceeds both prior black-box baselines on every student dataset tested.","Defenses for transfer learning must address representation-level discrepancies, not just output calibration; the paper lists output randomization, adversarial training, generative obfuscation, model splitting, and pruning as candidate mitigations with no established defense yet."],"supporting_citations":[{"why":"Introduces the shadow-model training methodology that this attack's student-versus-shadow comparison inherits.","marker":"[9]"},{"why":"Shows shadow training can work without knowing the target model's exact training data, supporting the attack's reliance on a similar-distribution shadow dataset.","marker":"[18]"},{"why":"Provides the first transfer-learning membership inference baseline using shadow training, which this paper compares against and reports exceeding.","marker":"[25]"},{"why":"Introduces the transfer shadow training baseline that this attack outperforms on all student datasets tested.","marker":"[26]"},{"why":"Demonstrates that white-box information such as gradients boosts membership inference effectiveness, motivating the hidden-layer representation analysis.","marker":"[60]"}],"fun_headline_variants":["Teacher's data leaks through student's hidden layers","Membership attack: student reveals teacher's training set","Hidden-layer gap exposes teacher's membership","Transfer learning leaks teacher's training data","Student-only attack uncovers teacher's members"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes that the L2 discrepancy between the real student's hidden activations and a from-scratch shadow student's activations tracks true teacher membership, even though Algorithm 1 labels those discrepancies as teacher-member without ground-truth teacher labels and without specifying the intermediate layer.","fun_headline_variants_meta":{"raw":{"variants":["Teacher's data leaks through student's hidden layers","Membership attack: student reveals teacher's training set","Hidden-layer gap exposes teacher's membership","Transfer learning leaks teacher's training data","Student-only attack uncovers teacher's members"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000175,"raw_usage":{"total_tokens":1269,"prompt_tokens":915,"completion_tokens":354,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":531,"completion_tokens_details":{"reasoning_tokens":287}},"tokens_in":531,"tokens_out":354,"duration_ms":4781,"temperature":1.0,"reasoning_tokens":287,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T18:05:56.104282+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a teacher model whose full training set is known, hold out a balanced set of true non-members from the same distribution, and run the attack against both groups. If accuracy on that ground-truth membership split falls to chance while the proxy-labeled accuracy remains high, the claimed teacher-membership signal is an artifact of the proxy labels; repeating the test across several intermediate layers would also show whether the signal depends on an unstated layer choice.","supporting_citations":[{"cited_title":"Membership inference attacks against machine learning models,","cited_arxiv_id":null,"evidence_quote":"Introduces the shadow-model training methodology that this attack's student-versus-shadow comparison inherits."},{"cited_title":"Ml- leaks: Model and data independent membership inference attacks and defenses on machine learning models,","cited_arxiv_id":null,"evidence_quote":"Shows shadow training can work without knowing the target model's exact training data, supporting the attack's reliance on a similar-distribution shadow dataset."},{"cited_title":"Transmia: membership inference attacks using transfer shadow training,","cited_arxiv_id":null,"evidence_quote":"Introduces the transfer shadow training baseline that this attack outperforms on all student datasets tested."},{"cited_title":"Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,","cited_arxiv_id":null,"evidence_quote":"Demonstrates that white-box information such as gradients boosts membership inference effectiveness, motivating the hidden-layer representation analysis."}],"review_version":1}