用贝叶斯 LoRA 后验替代影子模型，让成员推断攻击在大型 VLM 上可行
Bayesian Low-Rank Posteriors for Scalable Membership Inference
做隐私审计或模型安全研究的可以看看这篇：训练一次 LoRA 就能生成虚拟影子模型，省掉传统 MIA 的模型集成开销，实测在 Document VQA 和 Medical VQA 上比标准攻击更强。
论文提出一种针对成员推断攻击（MIA）的新方法：不再训练昂贵的影子模型集成，而是在 LoRA 子空间内建模不确定性，用单次训练运行构建贝叶斯后验。方法基于 Stochastic Weight Averaging Gaussian（SWAG），从后验中采样生成多样化的虚拟参考模型，用来近似目标条件分数分布。
作者在三个下游微调的视觉语言模型（VLM）上评估该攻击，覆盖 Document VQA 和 Medical VQA 两个隐私敏感任务，并引入受控合成数据集以隔离预训练知识的影响。结果显示，该方法在只需一次参考模型微调运行的条件下，性能超过标准基于参考模型的攻击，大幅降低了在大规模 VLM 上实施 MIA 的计算成本。
Bayesian Low-Rank Posteriors for Scalable Membership Inference
Membership inference attacks (MIAs) aim to determine whether a sample was used during the training of a target model. Strong MIAs rely on reference (or shadow) models to estimate target-conditional score distributions, but training such ensembles is computationally expensive for modern large-scale Vision--Language Models (VLMs). In this work, we propose a scalable alternative that replaces explicit reference-model training with a Bayesian approximation over low-rank adaptation parameters. Specifically, we model uncertainty only within the LoRA subspace and construct a posterior from a single training run, from which we sample a diverse set of \emph{virtual reference models}. We instantiate this approach using Stochastic Weight Averaging Gaussian (SWAG), enabling efficient approximation of target-conditional score distributions at a fraction of the cost of conventional shadow-model ensembles. We evaluate the resulting attack on three downstream-adapted VLMs across two privacy-sensitive visual question answering tasks, namely Document VQA and Medical VQA. To isolate the effect of pretraining knowledge, we additionally introduce a controlled synthetic dataset. Our approach outperforms standard reference-based attacks while requiring only a single reference-model fine-tuning run, making membership inference more practical for large VLMs.
This report is categorized under AITOP's "Papers" desk. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include 成员推断, LoRA, SWAG, VLM.
Source attribution: curated from arXiv cs.LG (@Khanh Nguyen, Antonio Emanuele Cinà, Andrey Barsky, Alejandra Reinares, Fabio Roli, Dimosthenis Karatzas).
