{"id":"dba94e78-35ed-4676-b5b4-ffe441e4628c","arxiv_id":"2507.23291","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Per-sample membership vulnerability is established early in training, especially for hard-to-learn examples, and can be tracked on an FPR-TPR plane.","lead":"This paper watches, over training time, how each example becomes easier for an attacker to identify as having been used in training. It finds that hard-to-learn examples are exposed earliest, which may open a window for early privacy interventions.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Finding 5's 70% early-exposure statistic has no noise baseline: because α_z is estimated from only 20 shadow models, the vulnerability path length used to flag samples may be dominated by per-checkpoint sampling error, so the early curve may reflect measurement noise rather than genuine early…","rationale":"I read the paper as a measurement study: it proposes per-sample vulnerability trajectories on the FPR-TPR plane and uses them to support a strong temporal claim (Finding 5). The framework is coherent, the experiments cover multiple datasets, architectures, and optimizers, and the appendix replication with a second attack is genuine supporting evidence. The central claim, however, rises and falls on the per-sample advantage estimates. Definition 1 gives α_z = TPR_z − FPR_z, and the evaluation uses only 20 shadow models. LiRA's global variance estimate stabilizes the score scale, but it does not remove Monte Carlo error in the per-sample TPR/FPR proportions. With roughly 10 in-models and 10 out-models per sample, the standard error of α under the null is about 0.22, which is large relative to the early-training effects the paper attributes to encoding. Since vulnerability path length L(z) is the sum of absolute successive differences in α_z(t), any checkpoint-to-checkpoint noise accumulates directly into L(z). Selecting high-L(z) samples as high-risk therefore selects, at least in part, samples whose α estimates fluctuated most. The 70% early-exposure statistic is reported as a point estimate with no null baseline and no confidence interval, so it cannot distinguish 'early signal' from 'noisy signal that persists'. This is precisely the weakest link: the early-exposure curve, transition probabilities, and all dynamic metrics inherit the same per-sample noise. The proposed permutation and bootstrap tests would settle whether the curve is distinguishable from sampling noise. If the curve separates from the null and split-half trajectories correlate, the claim would be supported; if not, Finding 5 would collapse to a measurement artifact. The reader's conditional verdict is appropriate: there is no internal contradiction, only an unverified statistical foundation, so the verdict need not change unless the proposed check fails.","tokens_in":16556,"tokens_out":5787,"duration_ms":72243,"concrete_test":"Compute a permutation null for Figure 6b: at each checkpoint, randomly permute the membership labels (in/out) across the 20 shadow models while preserving the marginal in/out counts, recompute α_z(t), L(z), and the cumulative fraction of 'ultimately vulnerable' samples flagged by epoch 150. Repeat at least 100 times. If the observed 70% falls within the null distribution—or if random flagging at epoch 150 already yields a comparable fraction—the early-exposure claim is consistent with estimation noise. Additionally, report a bootstrap confidence interval for the epoch-150 percentage by resampling the 20 shadow models; if the lower bound is near the random-flagging baseline, the claim is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Under Definition 1, α_z(t)=TPR_z(t)−FPR_z(t) is estimated from N=20 shadow models (roughly 10 in-models and 10 out-models per sample). For a null sample with true advantage zero, the standard error of α_z is about sqrt(0.25/10 + 0.25/10) ≈ 0.22, which is large compared with the early-training membership signals the paper attributes to encoding. Finding 5 relies on the vulnerability path length L(z)=Σ|α_{t+1}(z)−α_t(z)| (Eq. 3); high-L(z) samples are flagged as high-risk, and Figure 6b reports that over 70% of samples ultimately vulnerable at the final epoch have revealed this predisposition by epoch 150. Because L(z) is a cumulative sum of absolute differences of noisy per-checkpoint α estimates, samples with large early fluctuations are preferentially selected—and those fluctuations may be sampling noise rather than true vulnerability dynamics. The appendix replicates aggregate qualitative trends with the Shokri et al. attack, but it does not provide a null baseline, bootstrap confidence intervals, or split-half reproducibility for the per-sample trajectories that drive the early-exposure curve. Thus the paper's strongest claim is not yet distinguishable from a measurement-noise artifact.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a dynamic analytical framework for studying membership privacy leakage at the per-sample level throughout training. It tracks each sample's vulnerability as an (FPR, TPR) point on a vulnerability plane across epochs, using LiRA with 20 shadow models to estimate per-sample membership advantage. The framework introduces metrics such as membership encoding speed, center-of-mass displacement, transition probabilities, and vulnerability path length. The experiments cover four datasets (MNIST, Fashion-MNIST, CIFAR-10, CINIC-10), three architectures, and optimizers including SAM, and report five findings: dataset complexity accelerates and amplifies encoding; deeper architectures catalyze memorization; SAM suppresses leakage; sample hardness correlates strongly with vulnerability; and vulnerability trajectories are often established early in training, with 'over 70% of all samples that will ultimately be vulnerable in the final model have already revealed this predisposition by just epoch 150.' The appendix replicates the aggregate trends with the Shokri et al. attack.","tokens_in":16853,"tokens_out":6816,"duration_ms":75196,"significance":"If the central early-exposure claim (Finding 5) held, the paper would make a substantive contribution by shifting privacy auditing from a post-hoc to a proactive, in-training activity, with practical implications for targeted intervention and privacy-aware optimization. The framework itself is a useful conceptual contribution, and the aggregate findings on dataset complexity, architecture, and optimizer choice are internally consistent and partially replicated with a second, methodologically distinct attack. The hardness–vulnerability correlations (Finding 4) are based on quantities that are not circularly defined, and the strongest correlations (epistemic uncertainty ≥ 0.9) are striking. However, the strongest claim—early exposure—currently lacks a noise baseline and statistical support, and the measurement procedure (20 shadow models) makes the per-sample trajectories potentially dominated by sampling noise.","major_comments":[{"comment":"The per-sample advantage α_z(t) is estimated from only 20 shadow models, giving roughly 10 in-models and 10 out-models per sample. Under the null hypothesis, the standard error of α_z(t) is approximately sqrt(0.25/10 + 0.25/10) ≈ 0.22. The Vulnerability Path Length L(z) in Eq. (3) sums absolute differences of these noisy per-epoch estimates over roughly 40 checkpoints, so even a completely non-vulnerable sample will accumulate a substantial expected path length from measurement noise. The selection of 'high-travel' samples therefore preferentially picks samples with large early fluctuation, which may be sampling error rather than genuine vulnerability dynamics. Figure 6b's claim that over 70% of ultimately vulnerable samples are identified by epoch 150 is not accompanied by a null baseline, bootstrap confidence intervals, or split-half reproducibility. The appendix's replication with the Shokri et al. attack covers only aggregate metrics (Tables 4 and 5), not the per-sample trajectories that drive Finding 5. This is a load-bearing gap for the paper's strongest claim.","section":"Evaluation, MIA Method; Early Exposure of Vulnerable Samples, Eq. (3), Fig. 6b"},{"comment":"The flagging rule used to generate Figure 6b is underspecified. The text says 'we can flag the samples with the longest vulnerability path lengths up to that point as high-risk,' but it does not state what fraction of samples is flagged (e.g., top 1%, top 20%, or a threshold on L). Without this, the 70% statistic is not interpretable: if 70% of all samples are flagged at epoch 150, then 70% of the final vulnerable population would be flagged by random chance. The paper should report the selection rate, the precision and recall of the flagging rule, and a comparison against a random-flagging baseline at the same selection rate. It should also state whether the 70% figure refers to the vulnerable population or to the entire dataset.","section":"Early Exposure of Vulnerable Samples, Fig. 6b"},{"comment":"The aggregate dynamic metrics (CoM Displacement, entropy change, transition probabilities, and the 'tipping point' peaks in Fig. 3) are reported as point values without uncertainty from the finite shadow-model population. Since all of these metrics are functions of the same noisy α_z(t) estimates, the quantitative comparisons across datasets and architectures would be more convincing with bootstrap confidence intervals across shadow models or across checkpoint sets. The monotonic trends are suggestive, but the reported magnitudes—such as the 13.9% vs. 10.3% peak transition probabilities—may not be statistically distinguishable under the current noise level.","section":"Evaluation, Tables 1–2 and Fig. 3"}],"minor_comments":[{"comment":"The abstract contains a sentence fragment: 'we discover a robust correlation between a sample's intrinsic learning difficulty, and find that...' This should be 'between a sample's intrinsic learning difficulty and its membership vulnerability, and find that...'","section":"Abstract"},{"comment":"The transition matrix entry a_{ij,kl}(t) is defined as the fraction of samples transitioning between states, but Figure 3 plots a conditional probability P(v_{t+1} ∈ S31 | v_t ∈ S11). These are different quantities; the relationship should be clarified.","section":"The Vulnerability Plane as a Geometric State Space (Transition Matrix)"},{"comment":"The text says '3×3 grid with diving both TPR and FPR axes to intervals'; 'diving' should be 'dividing', and the grid-cut definition could be stated more clearly.","section":"The Vulnerability Plane as a Geometric State Space"},{"comment":"Equation (3) sums from t=0 to T−1, but the vulnerability trajectory is defined as (v_1(z),...,v_T(z)), so the index range should be consistent with the notation, e.g., t=1 to T−1.","section":"Early Exposure of Vulnerable Samples, Eq. (3)"},{"comment":"The heading 'Impact of Dataset Complexity' appears twice; the two paragraphs should be merged or given distinct headings.","section":"Appendix: Consistency of Findings with Alternative MIA Methods"},{"comment":"The caption says 'under different datasets,' but the surrounding text only describes CIFAR-10. Please clarify whether the curve is for CIFAR-10 or for multiple datasets, and specify which datasets are shown.","section":"Figure 6b"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is conceptually interesting and the aggregate empirical trends are plausible, but the major uncertainty is whether the per-sample vulnerability trajectories—and especially the early-exposure claim—survive proper statistical treatment. The authors should be asked to provide a null baseline and noise analysis for the 70% statistic, and to report the flagging threshold and uncertainty intervals. The paper may also benefit from clearer specification of the shadow-model generation process (whether the same 20 models are checkpointed or independently trained per epoch), as this affects the correlation structure of the noise."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know up front. The dynamic per-sample framework is genuinely new--tracking each sample's (FPR, TPR) point across training checkpoints, with metrics like encoding speed and transition probabilities, is a real step beyond static LiRA and the single-signal forgetting/loss-history work. But the headline finding--that over 70% of ultimately vulnerable samples are already flagged by epoch 150--is not yet supported, because the per-sample measurements are too noisy and there is no baseline.\n\nWhat's good: the aggregate trends across dataset complexity, architecture, and optimizer are internally consistent, and the appendix replicates them with a second, methodologically distinct attack. That is the right kind of check. The SAM result--a generalization-promoting optimizer also suppressing membership leakage over time--is a nice confirmation with a dynamic lens. The correlation between epistemic uncertainty and vulnerability is large and, if the measurements can be trusted, a useful lead. The citation pattern is reasonable; the authors locate themselves against Carlini et al., Toneva et al., and the static MIA literature without overclaiming novelty.\n\nWhere it gets soft: alpha_z is estimated from about 10 in-models and 10 out-models per checkpoint. That puts the standard error on a null sample near 0.22, which is large relative to the per-sample signals they attribute to membership encoding. The vulnerability path length L(z) sums absolute differences of these noisy alpha values, so samples with large early random fluctuations get flagged as high-travel. Without a null baseline (random flagging, permutation test) or confidence intervals, the 70% early-exposure curve in Figure 6b is indistinguishable from a noise artifact. Also, the hardness metrics--especially epistemic uncertainty--are not operationally defined in the main text, and the promised code is not linked. These are fixable, not fatal.\n\nThe aggregate findings likely survive better than the per-sample claim because they average over thousands of samples. But the paper's most interesting claim is the per-sample one, and that is the part that needs the most work.\n\nThis paper deserves a serious referee. It is a novel measurement approach with addressable issues, not a desk reject. I'd bring it to reading group, with the noise problem as the discussion topic.","headline":"Novel per-sample trajectory framework with solid aggregate findings; the headline early-exposure claim lacks a noise baseline and is not yet convincing.","tokens_in":17332,"tokens_out":4673,"would_cite":true,"duration_ms":55690,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A sample's membership privacy is largely fixed by epoch 150 of training.","keywords":["membership inference attacks","privacy leakage dynamics","per-sample vulnerability","training dynamics","sample hardness","epistemic uncertainty","sharpness-aware minimization","FPR-TPR vulnerability plane"],"falsifier":"Train the same four configurations but with 100 or more shadow models and per-sample variance estimates, then recompute the vulnerability trajectories and the cumulative early-exposure curve; if the set of samples identified by epoch 150 changes substantially, the early-disclosure result is an artifact of the estimator rather than a property of training.","tokens_in":16385,"feed_emoji":"🕵️","tokens_out":6478,"duration_ms":68724,"temperature":0.7,"pith_summary":"This paper argues that membership-inference vulnerability is not a static property of a finished model but a dynamic process that unfolds during training, sample by sample. The authors track each training point's vulnerability as a (false-positive rate, true-positive rate) coordinate across checkpoints and show that harder-to-learn samples move fastest into a high-risk region. Their headline result is temporal: for complex datasets, over 70% of samples that end up vulnerable have already shown that predisposition by epoch 150 of a 400-epoch run. If this is right, privacy protection can move from auditing a trained model to intervening early in training, on a small set of predictable high-risk samples.","feed_headline":"Over 70% of privacy-vulnerable samples are exposed by epoch 150","feed_subtitle":"A trajectory-based framework shows membership risk appears early and tracks how hard a sample is to learn.","key_machinery":"The central object is the vulnerability plane, the unit square whose x-axis is a sample's false-positive rate and whose y-axis is its true-positive rate under a membership inference attack. A sample's state at epoch $t$ is the coordinate pair $(\\mathrm{FPR}_z(t), \\mathrm{TPR}_z(t))$, estimated by running a population of 20 shadow models and applying LiRA; the membership advantage $\\alpha_z = \\mathrm{TPR}_z - \\mathrm{FPR}_z$ is the scalar field on this plane. The framework converts training into a sequence of such states and defines metrics on them: membership encoding speed (epoch-to-epoch displacement), center-of-mass displacement, transition probabilities between nine discretized cells, spatial entropy, and vulnerability path length. These metrics carry the argument because the early-exposure claim is exactly a statement about the time at which trajectories leave the low-risk cell $S_{11}$ and enter the high-risk cell $S_{31}$.","core_discovery":"The paper's central claim is that per-sample membership encoding follows a vulnerability trajectory on an FPR-TPR plane, and that this trajectory is governed by the sample's intrinsic learning difficulty rather than by chance. Using a population of shadow models at each checkpoint, it estimates each sample's membership advantage $\\alpha_z = \\mathrm{TPR}_z - \\mathrm{FPR}_z$ and records how that advantage evolves. The empirical findings are that dataset complexity, model capacity, and optimizer choice systematically change the speed and heterogeneity of encoding; that cumulative effort and epistemic-uncertainty metrics predict both final and dynamic vulnerability; and that the final vulnerability of high-risk samples is effectively sealed early in training. The paper also shows that Sharpness-Aware Minimization suppresses the transition of samples into the highly vulnerable region throughout training.","pith_inferences":["A natural next step the paper does not develop is an early-exposure predictor: train only to epoch 150, rank samples by path length, and use that ranking to decide which samples to exclude, reweight, or regularize.","The framework should transfer to language models if checkpoints are available; memorization in LLMs is also concentrated on rare or hard tokens, and the same FPR-TPR trajectory machinery applies to token- or sequence-level queries.","The strong correlation with epistemic uncertainty suggests a testable intervention: adding a penalty that discourages rising epistemic uncertainty on the most vulnerable samples could suppress the early transition into the high-risk region.","A sharper test of causality would be to adversarially select samples that are easy yet vulnerable; if such samples exist, hardness is not the whole story and the early-exposure rule would need refinement."],"forward_implications":["Privacy audits can be run on early checkpoints: by epoch 150 the vulnerable population is already identifiable, so post-hoc evaluation can be supplemented or replaced by in-training warning signals.","Hard-to-learn samples, which can be flagged by epistemic uncertainty during training, are the ones that need targeted protection rather than blanket defenses.","Optimizer choice matters for privacy: SAM's flat-minimum bias reduces both the peak transition probability into the high-risk region and the final vulnerability.","The qualitative conclusions are not tied to one attack: the same dynamic trends appear with both the LiRA and the earlier shadow-model attack.","Model capacity has a direct privacy price: deeper models show faster and more heterogeneous membership encoding, creating a privacy-underprivileged subset of samples."],"supporting_citations":[{"why":"Supplies the LiRA attack used to estimate per-sample advantage, including the global variance estimate that makes 20 shadow models workable.","marker":"Carlini et al. 2022"},{"why":"Provides the foundational shadow-model attack used as an alternative measurement method to confirm the dynamic trends are not LiRA-specific.","marker":"Shokri et al. 2017"},{"why":"Defines Sharpness-Aware Minimization, the optimizer whose flat-minimum behavior is shown to suppress membership encoding.","marker":"Foret et al. 2021"},{"why":"Provides the aleatoric and epistemic uncertainty metrics used to quantify sample hardness and predict vulnerability.","marker":"H¨ullermeier and Waegeman 2021"},{"why":"Supplies the iteration-learned (forgetting) metric used as a cumulative learning-effort hardness signal.","marker":"Toneva et al. 2019"},{"why":"Supplies influence functions, the other cumulative effort metric correlated with both static and dynamic vulnerability.","marker":"Koh and Liang 2020"}],"fun_headline_variants":["Privacy risk sealed early: hard-to-learn samples exposed first","Membership risk tracks learning difficulty from first epochs","Early training decides final privacy exposure of samples","Privacy leakage trajectory set by sample learning difficulty"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The per-sample vulnerability signal is estimated from only 20 shadow models with a shared variance estimate; if that is too few, the epoch-by-epoch movements and the early-exposure curve are contaminated by sampling noise.","fun_headline_variants_meta":{"raw":{"variants":["Privacy risk sealed early: hard-to-learn samples exposed first","Membership risk tracks learning difficulty from first epochs","Early training decides final privacy exposure of samples","Privacy leakage trajectory set by sample learning difficulty"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000442,"raw_usage":{"total_tokens":2192,"prompt_tokens":847,"completion_tokens":1345,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":463,"completion_tokens_details":{"reasoning_tokens":1286}},"tokens_in":463,"tokens_out":1345,"duration_ms":11608,"temperature":1.0,"reasoning_tokens":1286,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T10:52:23.885061+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the same four configurations but with 100 or more shadow models and per-sample variance estimates, then recompute the vulnerability trajectories and the cumulative early-exposure curve; if the set of samples identified by epoch 150 changes substantially, the early-disclosure result is an artifact of the estimator rather than a property of training.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the LiRA attack used to estimate per-sample advantage, including the global variance estimate that makes 20 shadow models workable."}],"review_version":1}