Your API rounds the returned confidence to two decimals — what does that cost a membership attacker?

## What rounding actually does to the signal The adversary here holds a candidate ticket, has ordinary product access, and gets one response per record: a handling track plus one confidence number for that track, rounded to two decimals. The rounding is the stated limit — not a query bill, not a rate limiter — and the question is what it buys. Two decimals over a probability range gives roughly a hundred distinguishable values. The separation the attack lives on — how much more confident the model is on a record it was fit to — is, in a model that overfits enough to be worth attacking, typically far larger than a hundredth. So the member and non-member response distributions remain about as separated after rounding as before. What rounding does produce is ties: many records land in the same bucket, so the ordering within a bucket is lost. That degrades the very fine end of the attack — the ability to rank two records that differ in the third decimal — and leaves the coarse comparison the threshold test depends on untouched. ## The general shape of output coarsening It is worth generalising, because the instinct behind two-decimal rounding usually goes further: "then let us stop returning confidences at all." | what the endpoint returns | what it removes | what survives | | --- | --- | --- | | full probability vector | nothing | everything | | one score for the chosen class | the shape of the rest of the distribution | correctness plus confidence | | a rounded score | fine-grained ranking | the coarse threshold comparison | | the top-1 label only | the whole score-threshold family | whether the model is simply right on this record | That last row is the one candidates miss. Returning nothing but a label feels like it removes the attack, and it removes an entire family of techniques — which is worth something. But a model's accuracy on rows it was fit to exceeds its accuracy on fresh rows; that difference is precisely the generalization gap, and it is readable from correctness alone. The signal is weaker and needs a larger candidate pool to be exploited, and it is not zero. ## Cost control versus boundary This distinction is the point of the question, and it recurs everywhere in this field. A control that makes an attack more expensive, noisier, or reliant on more records is a **cost control**. A control that makes the attack impossible regardless of effort is a **boundary**. Output coarsening is squarely the first. Treating it as the second — writing "we round confidences, so membership inference is mitigated" into a design document — encodes a claim the mechanism does not support. There is also a product cost on the other side of the ledger. If the confidence number is load-bearing for callers — routing rules, human review thresholds, an operator deciding whether to trust a track — then coarsening or removing it degrades the feature. Paying real product value for a control that raises an attacker's price slightly is usually a bad trade, and saying so is the senior judgment here. ## What actually moves the ceiling Since the leak is a consequence of the fit, the levers are on the training side. Anything that makes the model's behaviour on its own corpus resemble its behaviour on fresh data — more data, fewer passes over it, less capacity relative to the corpus — shrinks the average attack, and shrinks it for every technique at once rather than for one family. That is a genuine reduction, and it still bounds nothing, because it does not stop one unusual ticket from being fit tightly. A bound, as opposed to a reduction, requires a guarantee established during training and reported with its parameters, its accounting method and the unit it is stated over. That is a different subject with its own costs, and it is the only kind of answer that speaks about attacks nobody has run. ## How to say it in an interview "Rounding to two decimals costs the attacker fine-grained ranking and essentially nothing else — the gap it reads is much bigger than a hundredth. Removing scores entirely kills the score-threshold family but leaves correctness, which still differs between members and non-members. It is a cost control; if I want the ceiling to move I have to change the fit, and if I want a bound I need a training-time guarantee."