TIER: Trajectory-Invariant Explanation Regularization for Membership Privacy
2026-07-03 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors studied how AI explanations can unintentionally help attackers figure out if certain data was used during training. They found that attackers use patterns in confidence changes caused by small input tweaks to detect membership. To stop this, the authors created a new method called TIER that trains the model to keep these confidence change patterns steady and similar between seen and unseen data. Their experiments show this approach protects privacy without hurting the model’s performance or the quality of its explanations.
ExplainabilityMembership Inference AttackAttribution-Guided PerturbationsConfidence Drop TrajectoriesGradient RegularizationKL-DivergenceAdversarial TrainingModel UtilityPrivacy Protection
Authors
Varun Sharma, Kar Wai Fok, Vrizlynn L. L. Thing
Abstract
Explainability is central to building trustworthy AI, yet explanation interfaces can inadvertently provide adversaries with an expanded privacy-related attack surfaces. Recent studies show that advanced membership-inference attacks succeed by exploiting confidence-drop trajectories, induced through attribution-guided perturbations, as discriminative features, rather than directly using confidence scores or explanation vectors. Existing defenses against membership inference fail to directly mitigate such explanation-driven attacks. In this work, we investigate whether, during training, a model's own gradients can be leveraged as defense signals against such attacks, thereby aligning explanation profiles between members and non-members. To this end, we propose a Trajectory-Invariant Explanation Regularization (TIER) defense that penalizes erratic fluctuations in confidence drops simulated through gradient-guided perturbations and simultaneously minimizes the distributional shifts via KL-divergence. Unlike conventional adversarial training, which emphasizes label robustness, our approach targets explanation robustness by enforcing self-consistency through KL-divergence and reducing the variance of confidence drops between members and non-members. Extensive experiments confirm that our method effectively mitigates these attacks, delivering privacy protection while maintaining model utility and explanation fidelity.