Regularization

Adds a penalty term to the loss function proportional to the magnitude of model weights. L2 regularization (ridge) penalizes squared weights, encouraging small, distributed weights. L1 regularization (lasso) penalizes absolute weights, driving irrelevant weights to exactly zero.

• Reduces model capacity to memorize outliers
• L2 decay is standard in DP-SGD training
• Smaller weights produce smoother decision boundaries
• Directly limits the signal available for membership inference

Randomly deactivates a fraction of neurons during each training forward pass, forcing the network to learn redundant representations rather than brittle co-adaptations.

• Acts as an ensemble of subnetworks at inference time
• Prevents individual neurons from memorizing specific training examples
• Typical dropout rates range from 0.2 to 0.5
• Increases prediction entropy on training samples, reducing the confidence gap exploited by membership inference attacks

Halts training when validation loss stops improving, before the model enters the memorization phase where it begins encoding exact training examples.

• Monitors a held-out validation set during training
• Stops before the model fits noise in the training data
• Prevents the double-descent phenomenon where test loss rises after overfitting
• Simple, computationally cheap defense with no hyperparameter tuning overhead

Incorporates a simulated membership inference attacker directly into the training objective. The model is trained to minimize both task loss and the attacker's ability to distinguish training from non-training samples.

• Uses a min-max optimization framework
• The defender minimizes while the simulated attacker maximizes
• Produces models with inherently lower privacy risk scores
• More computationally expensive than standard regularization but provides targeted protection

Replaces hard one-hot training targets with softened probability distributions, preventing the model from assigning extreme confidence to training examples.

• Converts a target of [0,1,0] to [0.05,0.9,0.05]
• Reduces the confidence gap between training and test samples
• A smoothing factor of 0.1 is commonly used
• Degrades the primary signal exploited by confidence-based membership inference attacks

A training principle derived from information theory that encourages the model to compress input representations while preserving only task-relevant mutual information.

• Minimizes I(X;Z) while maximizing I(Z;Y)
• X = input, Z = latent representation, Y = target
• Naturally limits the capacity to memorize individual records
• Provides a theoretical framework connecting compression to privacy guarantees

L1 regularization (Lasso) adds the absolute value of weights to the loss function, driving irrelevant feature weights to exactly zero and producing sparse models. L2 regularization (Ridge) adds the squared magnitude of weights, penalizing large weights without zeroing them out. Both techniques reduce a model's capacity to memorize individual training examples by constraining the parameter space. In the context of membership inference, weight decay prevents the model from assigning disproportionately high confidence to training samples, shrinking the prediction gap between members and non-members.

A stochastic regularization technique that randomly deactivates a fraction of neurons during each training forward pass, forcing the network to learn redundant representations rather than relying on any single neuron. Key effects on privacy:

• Prevents co-adaptation of neurons that could encode specific training examples
• Introduces noise that acts as a weak form of privacy amplification
• Reduces the model's effective capacity to memorize rare or unique records
• At inference time, dropout is disabled, but the ensemble-like effect of training with dropout produces smoother decision boundaries that are harder for membership inference attacks to exploit

A training procedure that halts optimization when validation loss stops improving, preventing the model from entering the memorization phase where it begins encoding individual training examples rather than generalizable patterns. Research shows that membership inference vulnerability increases sharply after the point of optimal generalization. Implementation considerations:

• Monitor validation loss with patience-based stopping criteria
• Combine with model checkpointing to restore the best-performing weights
• Early stopping alone does not provide formal privacy guarantees but empirically reduces attack AUC by 5-15%
• Most effective when paired with other regularization methods like weight decay

A defensive training methodology that incorporates a simulated membership inference attacker directly into the training objective. The model is trained to simultaneously minimize task loss while maximizing the attacker's error rate, creating a minimax game. Architecture:

• An attack model receives the main model's outputs and predicts membership
• The main model's loss includes a term penalizing successful membership inference
• This forces the model to learn representations that are indistinguishable between training and non-training data
• Unlike post-hoc defenses, adversarial regularization proactively shapes the model's internal representations to resist privacy leakage from the start

A training principle derived from information theory that encourages the model to compress input representations while preserving only task-relevant information. Formally, it minimizes the mutual information between inputs and hidden representations while maximizing mutual information between representations and outputs. Privacy implications:

• By discarding input details unnecessary for the task, the model naturally forgets idiosyncratic features of individual training records
• Provides a theoretical framework for understanding why regularization reduces memorization
• Variational information bottleneck implementations add stochastic noise to latent representations
• Empirically reduces membership inference attack success by limiting the information capacity available for storing training data fingerprints

A model compression technique where a smaller student model is trained to replicate the softened probability outputs of a larger teacher ensemble. The student learns from the teacher's class probabilities rather than hard labels, which smooths the decision surface. Privacy benefits:

• The student never directly accesses the original training data
• Temperature-scaled soft labels obscure individual training sample characteristics
• When combined with PATE (Private Aggregation of Teacher Ensembles), provides formal differential privacy guarantees
• The distillation process acts as an information bottleneck, filtering out instance-specific memorization while preserving class-level knowledge