{"id":"c01363dd-eb4f-4801-ab47-2f01001ac7f3","arxiv_id":"2507.18372","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Attacking a Bayesian posterior with score matching is equivalent to minimizing an MMD, and the attack recovers the sufficient statistics of the training data.","lead":"This paper shows that training data can be reconstructed from Bayesian posterior samples by matching score functions, recovering summary statistics instead of exact points. It proves that this attack is equivalent to minimizing a maximum mean discrepancy whose kernel is built from the model's gradient features, linking leakability to model complexity.","discovery_kind":"first_principles","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Unconstrained weights in Definition 3.3 allow signed pseudo-measures, so the Bayesian attack may not output an empirical distribution of training data.","rationale":"I verified the algebraic steps of Theorem 3.4, Proposition A.1, and Lemma A.2; they are correct under the stated regularity conditions, and the sign error in Appendix B (N/σ should be -N/σ) cancels in the comparison and does not affect Lemma 5.1. The reader's weakest_assumption emphasizes exact posterior samples and the dependence of the kernel on π_X; those are real limitations but they are explicit idealizations, and the attack can be viewed as consistent in the large-sample limit. The more load-bearing issue I find is the unstated absence of a nonnegativity constraint on weights. The paper consistently treats P_w,Z as an empirical measure and π_w,Z as a posterior, but Definition 3.3 and the numerics allow weights to be arbitrary reals. With negative weights, the 'posterior' can be improper and the 'pseudo-measure' signed, so the attack output is no longer an empirical distribution. This does not refute the central identity, but it does mean the central claim that score-matching attacks recover the training-data measure requires an additional constraint or an explicit reframing in terms of signed measures. The reader's rationale already mentions unstated weight restrictions, so my concern overlaps partially rather than matching the stated weakest_assumption. No new reason to move the verdict; CONDITIONAL remains appropriate.","tokens_in":17003,"tokens_out":17513,"duration_ms":193221,"concrete_test":"Run the Section 5 kidscore experiment with the released code at M=400 and M=800, logging the individual weights w_m at convergence. Check whether any w_m is negative. If negative weights occur, repeat the optimization with weights reparameterized as softplus (or projected to R_{≥0}) and verify whether the Lemma 5.1 sufficient statistics are matched to the same accuracy. If they are not, the reported reconstruction relies on an invalid signed pseudo-measure rather than an empirical distribution.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Definition 2.1 sets the adversary goal as approximating P_X = Σ δ_{x_n} by P_w,Z = Σ w_m δ_{z_m}. For P_w,Z to be an empirical measure of pseudo-data, the weights must be nonnegative, but the paper never states this constraint. Definition 3.3 minimizes Fisher divergence over all w ∈ R^M, and the Section 5 optimization uses Adam on unconstrained w_m initialized at 1; nothing prevents w_m from becoming negative. With negative weights, the weighted posterior π_w,Z(θ) ∝ ∏ l(θ,z_m)^{w_m} π_0(θ) is generally not a valid probability measure: for a Gaussian likelihood a negative exponent makes the unnormalized density non-integrable, so the object is not a posterior. In that case the MMD matching is performed by a signed measure, not by a data set. Theorem 3.4's algebra still holds for the signed relaxation, but the advertised claim that score matching reconstructs the empirical training-data measure is then only about the relaxation; the optimizer's output cannot be interpreted as recovered training data unless weights are constrained. This is a load-bearing gap in the problem formulation, distinct from the explicit idealization of exact posterior samples.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper formalizes training-data reconstruction as approximating the unnormalized empirical measure P_X = Σ δ_{x_n} by a weighted pseudo-data measure P_{w,Z} = Σ w_m δ_{z_m}. For Bayesian models it proposes minimizing the Fisher (or sliced Fisher) divergence between the posterior π_X and a weighted pseudo-posterior π_{w,Z}, gives a Monte Carlo estimator from posterior samples, and proves (Theorem 3.4) that this Fisher divergence equals half the squared MMD between P_X and P_{w,Z} under a model-dependent kernel built from log-likelihood gradients averaged over π_X. For non-Bayesian models it substitutes a Dirac at the trained parameter θ* for the posterior and the loss gradient for the score, recovering the standard gradient-matching attack (Definition 4.2) and an analogous MMD identity (Theorem 4.3). Numerical experiments on the kidscore model from posteriordb demonstrate convergence of weighted reconstructions to the sufficient statistics identified by Lemma 5.1.","tokens_in":17211,"tokens_out":8785,"duration_ms":97218,"significance":"If the advertised interpretation is accepted, this is a valuable unification: it gives the first explicit Bayesian treatment of DRA, connects score-matching attacks to kernel mean embeddings, and provides a theoretical explanation for the empirical observation that larger models are more vulnerable. The derivations are self-contained and checkable, no free constants are fitted, and the code is available. The main caveat is that the unconstrained weights allow signed pseudo-measures, so the central 'reconstruction of the training-data measure' claim currently holds only for a signed relaxation.","major_comments":[{"comment":"Definition 2.1 defines the adversary's target as the empirical measure P_X approximated by P_{w,Z} = Σ w_m δ_{z_m}, but it does not require w_m ≥ 0, and Definition 3.3 minimizes over all w ∈ R^M. With negative weights, P_{w,Z} is a signed measure rather than an empirical distribution of pseudo-data; although Theorem 3.4 remains algebraically valid for signed measures, the optimal solution of Definition 3.3 cannot then be reported as reconstructed training data. The Section 5 experiments do not report the individual weights, so it is unknown whether the reported weighted statistics correspond to a nonnegative measure. Please either impose w ≥ 0 and adjust the optimization and proofs accordingly, or explicitly reframe the contribution as a signed-measure relaxation and state what additional steps (e.g., projection or reparameterization) are needed to obtain an actual data set.","section":"Section 2.2, Definition 2.1; Section 3.1, Definition 3.3"},{"comment":"The non-Bayesian attack and Theorem 4.3 rest on the assumption that the released parameters satisfy ∇θ L(θ*, X) = 0 exactly. Real training runs with early stopping, SGD noise, or regularization schedules do not land on exact stationary points, so the objective in (8) measures a residual gradient that may have little to do with the released model. The paper acknowledges the assumption, but it should discuss how violations affect the equivalence and ideally include an empirical robustness check, since this is the main fragility of the non-Bayesian half of the paper.","section":"Section 4.1, Assumption 4.1"}],"minor_comments":[{"comment":"The kernel in Theorem 3.4 is defined through integration against the true posterior π_X, so the characterization of vulnerable features is posterior-dependent; under Assumption 3.2 the adversary has samples from π_X and can estimate the kernel, but the paper should state this explicitly so readers do not interpret the characterization as depending only on the model architecture.","section":"Section 3.2, Theorem 3.4"},{"comment":"Lemma A.2 establishes an exact population-level equivalence between SFD and FD; the stochastic estimate in Equation (11) uses random slicing directions, so the equivalence does not hold for each noisy gradient estimate. The text should clarify that the numerical optimization is minimizing a randomized estimate whose population objective is SFD, not that every iteration is exactly FD.","section":"Appendix A, Lemma A.2"},{"comment":"The statements assume without qualification that the defining integrals for the kernel are finite and that the integration-by-parts identity leading to Equation (4) is valid; adding explicit regularity conditions on l, π0, and π_X would strengthen the results.","section":"Theorem 3.4 and Proposition A.1"},{"comment":"There are several typos and misspellings, including 'equivalance' in the abstract, 'ansatz' (should be 'ansatz'), 'Therfore', 'psuedo-data', 'stadard', and 'fuction'; these should be corrected in a revision.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The core theoretical results appear correct and the manuscript is within the journal's scope. The main risk is the unconstrained-weight issue, which affects the interpretation of the central claim; if the authors either constrain the weights or clearly reframe the contribution as a signed-measure relaxation, I would be supportive of publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the Fisher-divergence-to-MMD equivalence in Theorem 3.4 is real, algebraically correct, and gives the Bayesian reconstruction problem a clean theoretical handle. The paper deserves a serious referee, but it has a formulation gap that needs to be fixed before I would trust the attack's advertised output.\n\nWhat is actually new: the Bayesian reconstruction objective (Definition 3.3) and the MMD characterization (Theorem 3.4) are not in the cited literature. The connection to Loo et al. and Manousakas et al. is drawn honestly, and the non-Bayesian part reduces to known gradient-matching, which is a useful unification rather than a weakness. The Gaussian and linear-regression examples are worked carefully and make the theorem intuitive. The proof of Lemma 5.1 checks out.\n\nSoft spots, in order of size. First, the weight constraint issue. Definition 2.1 explicitly allows scalar weights in R^M, and Definition 3.3 optimizes over all such weights. Nothing forces w_m > 0. If weights go negative, the 'weighted posterior' pi_w,Z is generally not a normalizable probability measure, and P_w,Z is a signed measure, not an empirical distribution of pseudo-data. The MMD algebra in Theorem 3.4 still holds for this signed relaxation, but the paper's central claim—that the attacker approximates the empirical training-data measure with a data set—is then only about a relaxation. This is fixable: constrain weights to the simplex or positive orthant, or explicitly present the signed-measure version and discuss the consequences. Second, the assumptions: exact posterior samples (Assumption 3.2) and exact stationary points (Assumption 4.1) are strong idealizations. The paper is upfront about them, but they undercut the practical force of the attack. Third, the model-complexity monotonicity claims—wider and deeper networks recover more features—are asserted from the feature map without a proof. The examples support the intuition, but it is a claim, not a theorem. Fourth, the numerical section is a single run with no seeds, error bars, or baselines; it shows moment-matching behavior, not attack efficacy against a baseline.\n\nNone of this breaks the main result. The identity in Theorem 3.4 is the contribution, and it is correct. Who it is for: people working on privacy of Bayesian models and on score/MMD-based reconstruction. They will get a useful framework and a clean theorem. I would cite it. It should go to peer review, with the weight constraint and the overclaims addressed.\n\nRecommendation: send it out; expect a revise-and-resubmit.","headline":"Theorem 3.4 is real and the Bayesian attack is a genuine first, but the unconstrained weights let the pseudo-posterior drift into signed-measure territory and the complexity claims outrun the proof.","tokens_in":17760,"tokens_out":3684,"would_cite":true,"duration_ms":38871,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["62F15","62B10","68T07"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proves that reconstructing training data from a Bayesian posterior is equivalent to minimizing a kernel mean-embedding discrepancy fixed by the model's own score function.","keywords":["training data reconstruction","Bayesian posterior","maximum mean discrepancy","Fisher divergence","score matching","kernel mean embedding","model privacy","empirical measure"],"falsifier":"Take a simple model where both sides of Theorem 3.4 can be computed exactly, such as the Gaussian mean-location model, run the score-matching reconstruction on finite posterior samples, and compare the minimized Fisher divergence with the squared MMD between the recovered and true data measures; if the two disagree systematically as the sample size grows, the equivalence is not enough to predict attack behavior. For the non-Bayesian claim, train a model with early stopping and record the gradient norm $\\|\\nabla_\\theta L(\\theta^\\ast,\\mathcal X)\\|$; if reconstruction quality does not track this residual gradient, the stationary-point assumption is the weak link.","tokens_in":16766,"feed_emoji":"🔍","tokens_out":9559,"duration_ms":95767,"temperature":0.7,"pith_summary":"This paper tries to show that training-data reconstruction is not a contest between clever attacks and defenses but a property written into the model itself. The central result is an exact equivalence: the Fisher divergence between a true posterior and a pseudo-posterior built from weighted pseudo-data equals one half the squared maximum mean discrepancy (MMD) between the empirical training-data measure and the empirical pseudo-data measure, under a kernel formed by integrating the inner product of log-likelihood gradients against the posterior. Because MMD is a distance between kernel mean embeddings, the model's score function fixes the feature space, and the posterior fixes which directions receive weight: those are precisely the features an adversary can recover. The same argument, with a Dirac measure at the final parameters, reproduces standard non-Bayesian gradient-matching attacks, and a worked regression example shows that the recoverable statistics are exactly the model's sufficient statistics. If the paper is right, the appropriate question is not 'can the adversary recover my data?' but 'which features does my model expose?'","feed_headline":"Releasing a Bayesian model leaks training-data statistics","feed_subtitle":"An exact equivalence shows which training-data features a released posterior exposes, and why larger models leak more.","key_machinery":"The carrying object is the Fisher divergence between the true posterior and a weighted pseudo-posterior, rewritten by an integration-by-parts trick into a score-matching objective that needs only posterior samples. Theorems 3.4 and 4.3 then convert that divergence into a maximum mean discrepancy by expanding gradients as sums over data points, so the MMD kernel is $k(x,x')=\\int_\\Theta \\langle \\nabla_\\theta \\log \\ell(\\theta,x),\\nabla_\\theta \\log \\ell(\\theta,x')\\rangle\\,d\\pi_{\\mathcal X}(\\theta)$ in the Bayesian case and the analogous inner product of loss gradients at $\\theta^\\ast$ in the non-Bayesian case. The feature map $\\phi(x)=\\nabla_\\theta \\log \\ell(\\cdot,x)$ in $L^2(\\Theta,\\pi_{\\mathcal X})$ is what carries the argument: it determines which data features are exposed, while the posterior measure determines how they are weighted. This machinery simultaneously yields the attack objective and the characterization of what an attack can recover.","core_discovery":"The paper's central claim is that adversarial reconstruction of training data from a released Bayesian model can be understood as a kernel mean-embedding problem. Theorem 3.4 states that for unnormalized empirical measures $P_{\\mathcal X}$ and $P_{\\mathbf w,\\mathcal Z}$, the Fisher divergence between the posterior $\\pi_{\\mathcal X}$ and the weighted pseudo-posterior $\\pi_{\\mathbf w,\\mathcal Z}$ equals $\\frac{1}{2}\\mathrm{MMD}_k(P_{\\mathcal X},P_{\\mathbf w,\\mathcal Z})^2$, where $k(x,x')=\\int_{\\Theta}\\langle \\nabla_\\theta \\log \\ell(\\theta,x),\\nabla_\\theta \\log \\ell(\\theta,x')\\rangle\\,d\\pi_{\\mathcal X}(\\theta)$. Thus the features of training data that can be recovered are the mean embeddings of the data measure under the feature map $\\phi(x)(\\theta)=\\nabla_\\theta \\log \\ell(\\theta,x)$ in $L^2(\\Theta,\\pi_{\\mathcal X})$. The non-Bayesian analogue (Theorem 4.3) states the same for the residual gradient at a trained parameter vector $\\theta^\\ast$, with kernel $\\langle\\nabla_\\theta\\ell(\\theta^\\ast,x),\\nabla_\\theta\\ell(\\theta^\\ast,x')\\rangle$. Together these results present the first data-reconstruction attack for Bayesian posteriors and a unified explanation of why wider or deeper models leak more while larger training sets are harder to reconstruct.","pith_inferences":["A pre-release audit protocol follows from the paper but is not pursued in it: compute the RKHS norm of the training-data measure under the score kernel, or estimate the kernel's characteristicness, to predict which statistics an adversary could extract.","Because the kernel in Theorem 3.4 is integrated against the true posterior, an attacker working from approximate posterior samples, such as variational or short Markov-chain samples, is effectively attacking with a shifted kernel; whether the attack degrades gracefully is an open empirical question.","A direct corollary for defenses: perturbing individual data points may protect individual records while leaving the recoverable sufficient statistics intact, so noise calibrated to the score kernel or to the sufficient statistics is the more targeted countermeasure."],"forward_implications":["A released Bayesian posterior can be attacked without any prior knowledge of the training-data distribution: only posterior samples and the likelihood and prior specification are needed.","The features an adversary can recover are exactly the mean embeddings captured by the score-function kernel; more expressive models, such as wider or deeper networks, produce more expressive kernels and therefore expose more training-data statistics.","Larger training sets are intrinsically harder to reconstruct because the unnormalized empirical measure $P_{\\mathcal X}$ has norm that grows with $N$, so the approximation target becomes more complex.","The non-Bayesian gradient-norm attack used widely in the literature is recovered as the special case where the posterior is a Dirac point mass at the trained parameters, under the stationary-point assumption.","In a Bayesian linear regression with polynomial features of degree two, the recoverable statistics are exactly the sufficient statistics: the number of points, the sums, and the sums of squares of both covariates and responses."],"supporting_citations":[{"why":"Supplies the integration-by-parts identity that removes dependence on the unknown training data from the Fisher divergence, making the Bayesian attack objective computable.","marker":"Hyvärinen, 2005"},{"why":"Supplies the definition of maximum mean discrepancy and the feature-map reformulation, Lemma 4, used to prove Theorems 3.4 and 4.3.","marker":"Gretton et al., 2012"},{"why":"Provides the non-Bayesian gradient-norm reconstruction attack that the paper recovers as a special case and explains through the MMD characterization.","marker":"Haim et al., 2022"},{"why":"Introduces the earlier use of MMD as a proof tool in reconstruction attacks and the neural-network experiments whose outcomes the new results explain.","marker":"Loo et al., 2023"},{"why":"Supplies multiclass and weight-decay reconstruction attacks whose numerical trends with training-set size and layer width are directly accounted for by Theorems 3.4 and 4.3.","marker":"Buzaglo et al., 2023"},{"why":"Provides sliced score matching, the practical estimator used in the numerical reconstruction experiments.","marker":"Song et al., 2019"},{"why":"Supplies the benchmark model and reference posterior samples used in the numerical validation of the Bayesian reconstruction method.","marker":"Magnusson et al., 2023"},{"why":"Supplies the notion of sufficient statistics used to interpret which features of the training data are recoverable from a given model.","marker":"Casella & Berger, 2024"}],"fun_headline_variants":["Bayesian posteriors leak training data via kernel mean embeddings","Exact link: Bayesian posterior leakage equals MMD squared","First data-reconstruction attack on Bayesian models","Why bigger Bayesian models leak more training-data info","Fisher divergence reveals training data from released posteriors"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Everything rests on the adversary having a faithful version of what the model release advertises: exact or near-exact posterior samples for Bayesian models, and a truly converged parameter vector at a gradient-zero of the training objective for non-Bayesian models, so approximate samples or early stopping can make the attack objective measure the wrong thing.","fun_headline_variants_meta":{"raw":{"variants":["Bayesian posteriors leak training data via kernel mean embeddings","Exact link: Bayesian posterior leakage equals MMD squared","First data-reconstruction attack on Bayesian models","Why bigger Bayesian models leak more training-data info","Fisher divergence reveals training data from released posteriors"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000448,"raw_usage":{"total_tokens":2249,"prompt_tokens":921,"completion_tokens":1328,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":537,"completion_tokens_details":{"reasoning_tokens":1254}},"tokens_in":537,"tokens_out":1328,"duration_ms":9341,"temperature":1.0,"reasoning_tokens":1254,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T18:14:19.320332+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a simple model where both sides of Theorem 3.4 can be computed exactly, such as the Gaussian mean-location model, run the score-matching reconstruction on finite posterior samples, and compare the minimized Fisher divergence with the squared MMD between the recovered and true data measures; if the two disagree systematically as the sample size grows, the equivalence is not enough to predict attack behavior. For the non-Bayesian claim, train a model with early stopping and record the gradient norm $\\|\\nabla_\\theta L(\\theta^\\ast,\\mathcal X)\\|$; if reconstruction quality does not track this residual gradient, the stationary-point assumption is the weak link.","supporting_citations":[{"cited_title":"Reconstructing training data from trained neural networks","cited_arxiv_id":null,"evidence_quote":"Provides the non-Bayesian gradient-norm reconstruction attack that the paper recovers as a special case and explains through the MMD characterization."},{"cited_title":"posteriordb: a set of posteriors for Bayesian inference and probabilistic programming , October 2023","cited_arxiv_id":null,"evidence_quote":"Supplies the benchmark model and reference posterior samples used in the numerical validation of the Bayesian reconstruction method."},{"cited_title":"and Berger, R","cited_arxiv_id":null,"evidence_quote":"Supplies the notion of sufficient statistics used to interpret which features of the training data are recoverable from a given model."}],"review_version":2}