An audit reports membership-inference AUC of 0.51 for a triage model — does that show no leakage?

## What the number is a statement about An averaged attack score is a property of a run, not of a model. "Membership-inference AUC 0.51" decomposes into: *this attack*, at *this vantage*, over *this candidate pool*, scored by *this summary statistic*. Every one of those four is a choice somebody made, and each can be made in a way that produces 0.51 from a model that leaks. ## The four questions to ask **1. What was the attacker allowed to see and do?** A test run against a top-1 track plus one rounded confidence, at one query per record, is a weak adversary by construction. That is a fine adversary to evaluate — it may well be the realistic one for a product feature — but the result bounds *that* adversary. It says nothing about someone who gets the full probability vector, or a per-feature explanation shipped beside the prediction, or many queries per record. A robustness or privacy figure never bounds an attack that was not run. **2. How was the candidate pool composed?** Membership evaluations are usually built with a balanced pool: half real members, half held-out records. That makes AUC easy to interpret and quietly assumes the attacker's candidates are drawn the same way. More importantly, *which* records went in matters enormously. If the pool is a uniform sample of the corpus, it is dominated by typical records — the ones that leak least — and the mean is dragged to chance by them. **3. What happens at the confident end?** This is the substantive objection and the one to lead with. AUC is an average over every operating point, including the useless ones. A privacy attacker does not need to classify a whole pool; they need a small number of records they can be nearly certain about. Those two things are almost unrelated. The right report is the true-positive rate in the very-low-false-positive region — how many records can the attack call as members while almost never being wrong — and that number can be materially above the base rate while the mean AUC reads 0.51. **4. Was anything reported per slice?** Because overfitting is uneven, the interesting result is per cohort: rare categories, small subgroups, records with unusual vocabulary. Averaging them into a large pool is exactly the operation that hides them. ## Why the direction of the claim matters It is worth being explicit about what each possible result establishes: - A *high* attack score establishes leakage. That direction is sound: the attack succeeded, so the signal is there. - A *low* attack score establishes that this attack failed. It does not establish that the model does not leak, any more than a passing scan establishes that a checkpoint is clean. The asymmetry is structural, and it is the same asymmetry that governs every empirical security evaluation. Getting it backwards — reading a near-chance average as a certificate — is the failure mode this question exists to catch. ## What would actually move a reviewer Three things, in rough order of weight: - **A stronger attack, reported at the confident end.** Commission the best attack you can at the most generous vantage you are willing to concede, and report the very-low-false-positive region and per-cohort results, not a single mean. - **A structural argument rather than a measurement.** A training-time guarantee, stated with its parameters, its accounting method and the unit it is stated over, is the only thing that bounds attacks nobody has thought of yet. An empirical number bounds one experiment. - **A description of what the bit would mean.** Whether a confident membership call is a serious disclosure depends on what the corpus is, and that judgment belongs beside the measurement rather than inside it. ## The reviewer's sentence "0.51 tells me the attack you ran, at the access you gave it, averaged to chance on the pool you built. Show me the true-positive rate at a very low false-positive rate, the pool's real composition, and the rare cohorts broken out — then I will know whether this model leaks about the records I care about."