Introduction

Membership inference attacks[shokri2017membership] pose a fundamental privacy risk for machine learning models: given a trained model and a data point, an adversary can determine whether that point was in the training set. Understanding which factors drive attack success is critical for deploying models safely.

Two natural hypotheses explain why larger models might be more vulnerable:

• Capacity hypothesis: Larger models have more parameters and can encode more information about individual training examples, making them inherently more vulnerable.
• Overfitting hypothesis: Larger models tend to overfit more on small datasets, and the resulting generalization gap creates distinguishable prediction patterns between members and non-members.

We design a controlled experiment to disentangle these hypotheses by varying model size while measuring both raw capacity (parameter count) and overfitting (train--test accuracy gap), then correlating each with membership inference attack success.

Methodology

Data Generation

We generate synthetic classification data with 5 Gaussian clusters in $\mathbb{R}^{10}$, with 500 total samples (100 per class). Class centers are drawn from $\mathcal{N}(0, I)$ and samples from $\mathcal{N}(\mu_k, 1.5I)$ for each class $k$, creating overlapping clusters that are hard enough to classify that model size affects overfitting. We use a 50/50 train/test split.

Target Models

We train 2-layer MLPs (Linear--ReLU--Linear) with hidden widths $h \in {16, 32, 64, 128, 256}$, corresponding to parameter counts ranging from 261 to 4,101. Each model is trained for 50 epochs with Adam (lr=0.01) on the classification cross-entropy loss, a regime where smaller models have not yet fully converged while larger models have begun to memorize.

Shadow Model Attack

Following Shokri et al.[shokri2017membership], for each target model architecture:

• Train $S=3$ shadow models with the same architecture on independently generated data (same distribution, different samples).
• For each shadow model, collect softmax prediction vectors on its training set (labeled "member") and test set (labeled "non-member").
• Train a logistic regression attack classifier on the concatenated shadow predictions.
• Evaluate on the target model's train (member) and test (non-member) predictions.

Metrics

• Attack AUC: Area under the ROC curve for the membership classifier (0.5 = random, 1.0 = perfect attack).
• Overfitting gap: Train accuracy minus test accuracy.
• Pearson correlation: Between attack AUC and (a) $\log_2(\text{parameters})$, (b) overfitting gap.

All experiments are repeated 3 times per width with different random seeds for variance estimation.

Results

Attack Success Across Model Sizes

Table summarizes the main results. Attack AUC tends to increase with model size overall, but not monotonically: the width-128 model is slightly less vulnerable than the width-64 model despite a larger overfitting gap. The cleaner trend is that larger models exhibit larger generalization gaps, while attack success rises only modestly above the random baseline.

Membership inference results by model width (mean ± std over 3 repeats).

Correlation Analysis

We compute Pearson correlations between attack AUC and two predictors:

• AUC vs.\ $\log_2$(parameters): $r = 0.743$, $p = 0.150$. Model capacity alone does not significantly predict attack success.
• AUC vs.\ overfitting gap: $r = 0.782$, $p = 0.118$. Overfitting gap is a slightly stronger (though also not individually significant at $\alpha=0.05$) predictor.
• Gap vs.\ $\log_2$(parameters): $r = 0.958$, $p = 0.010$. The overfitting gap itself increases significantly with model size.

The overfitting gap shows a slightly stronger correlation with attack AUC than raw parameter count ($r = 0.782$ vs.\ $r = 0.743$), but both effects remain inconclusive with only five width settings. The modest AUC values (0.516--0.544) reflect the inherent difficulty of membership inference on small datasets with simple logistic regression attacks, so we interpret the correlation ranking as directional evidence rather than a decisive result.

Discussion

Implications for privacy. Within this toy setup, privacy risk from membership inference appears to track the generalization gap at least as well as raw model size, though we do not establish a decisive predictor ordering. Regularization techniques that reduce overfitting (dropout, weight decay, data augmentation) remain plausible privacy defenses worth testing in larger studies.

Limitations. Our experiment uses synthetic data and small MLPs; real-world datasets with natural memorization patterns may yield different dynamics. The 500-sample dataset with overlapping clusters deliberately creates a regime where overfitting varies with model size; larger datasets would require larger models to observe similar gaps. The AUC values (0.516--0.544) are modest, reflecting the difficulty of membership inference in this low-data regime, and the width-128 result breaks a strictly monotonic increase in attack success. We test only the shadow model attack variant; other attack strategies (e.g., loss-based, label-only) may show different scaling patterns. The correlations, while directionally consistent, do not reach individual significance at $\alpha = 0.05$ for the AUC predictors due to the small number of model sizes (5 points); more width values would increase statistical power.

Conclusion

We provide a reproducible, agent-executable experiment suggesting that membership inference attack success in this toy setting tracks overfitting slightly more closely than raw model size, while remaining statistically inconclusive across five widths. The strongest supported result is that overfitting itself grows sharply with model size, making this submission a useful starting point for broader privacy-scaling studies rather than a final causal verdict.

\bibliographystyle{plainnat}

References

• [shokri2017membership] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In IEEE Symposium on Security and Privacy (SP), pages 3--18, 2017.