[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83694-en":3,"doc-seo-83694-105":30,"detail-sidebar-cat-0-en-105":83},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83694,4810365810221,"Aurora","https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d",8,"Research & Report","TIER Trajectory-Invariant Explanation Regularization for Membership Privacy","Explainability is vital for trustworthy AI, but explanation interfaces can also expose privacy through stronger membership-inference attack surfaces. Recent work shows that adversaries use confidence-drop trajectories induced by attribution-guided perturbations, targeting discriminative patterns beyond raw confidence or explanation vectors. Existing defenses do not directly address this explanation-driven leakage. This paper proposes TIER, a trajectory-invariant explanation regularization that penalizes erratic confidence-drop fluctuations from gradient-guided perturbations while reducing distributional shifts via KL-divergence. Experiments show improved membership privacy with maintained utility and explanation fidelity.","TIER: Trajectory-Invariant Explanation Regularization for Membership Privacy  \nVarun Sharma , [varun.sharma@stengg.com](varun.sharma@stengg.com)[ ](varun.sharma@stengg.com)Kar Wai Fok , [fok.karwai@stengg.com](fok.karwai@stengg.com)[ ](fok.karwai@stengg.com)Vrizlynn L. L. Thing , [vriz@ieee.org](vriz@ieee.org)  \nST Engineering, Singapore  \narXiv :2607 .02903v 1 [ cs .CR] 3 Jul 2026  \nAbstract—Explainability is central to building trustworthy AI, yet explanation interfaces can inadvertently provide adversaries with an expanded privacy-related attack surfaces. Recent studies show that advanced membership-inference attacks succeed by exploiting confidence-drop trajectories, induced through attribution-guided perturbations, as discriminative features, rather than directly using confidence scores or explanation vectors. Existing defenses against membership inference fail to directly mitigate such explanation-driven attacks. In this work, we investigate whether, during training, a model’s own gradients can be leveraged as defense signals against such attacks, thereby aligning explanation profiles between members and non-members. To this end, we propose a Trajectory-Invariant Explanation Regularization (TIER) defense that penalizes erratic fluctuations in confidence drops simulated through gradient-guided perturbations and simultaneously minimizes the distributional shifts via KL-divergence. Unlike conventional adversarial training, which emphasizes label robustness, our approach targets explanation robustness by enforcing self-consistency through KL-divergence and reducing the variance of confidence drops between members & non-members. Extensive experiments confirm that our method effectively mitigates these attacks, delivering privacy protection while maintaining model utility and explanation fidelity.  \nIndex Terms—Privacy-preserving machine learning, membership inference, deep learning, privacy attacks, model explanations.  \nI. INTRODUCTION  \nMEMBERSHIP inference attacks compromise privacy by  \nallowing adversaries to probe machine learning models and infer whether particular records were included in training. Unlike conventional breaches that involve direct file theft, these attacks exploit subtle statistical traces embedded in the model’s behavior. When such traces reveal the presence of sensitive data—such as medical images, payroll records, or personal conversations—the confidentiality of that information is undermined raising serious legal and ethical concerns. Such traces often stem from overfitting: when a model memorizestraining data, it tends to assign unusually high confidence or low loss to familiar inputs, leaving detectable patterns that adversaries can exploit. Among the various strategies adversaries employ, one common approach is to construct shadow models on publicly available data and train attack classifiers to distinguish members from non-members based on the shadow model’s confidence vectors.  \nHowever, recent attacks have advanced beyond using confidence score vectors or loss trajectories as features, instead  \nleveraging explanatory maps to exploit privacy leakage via guided perturbations. In particular, [13] demonstrate that this leakage intensifies when attributions are used to steer input modifications, since perturbing semantically important features identified by attribution maps produces a larger confidence drop for member samples than for non-members. By applying MoRF (Most Relevant Features, i.e., masking pixels ranked highest in importance) and LeRF (Least Relevant Features, i.e., masking pixels ranked lowest in importance) with distribution-preserving operators, the authors demonstrate that attribution-guided perturbations produce distinctive confidence-drop trajectories, which serve as the primary features driving privacy leakage. They further show that existing defense approaches are either ineffective against attributionguided perturbation attacks or impose severe utility constraints on the tar","cbCaisD6AmTPUMzZ","https://ap.wps.com/l/cbCaisD6AmTPUMzZ","pdf",1265904,4,1,13,"English","en",105,"# Introduction\n## Membership inference and privacy leakage\n## Attribution-guided perturbations and trajectory features\n## Research questions and contributions","[{\"question\":\"What outcomes does the paper report for privacy and model quality?\",\"answer\":\"Extensive experiments show the method mitigates membership-inference attacks, delivering privacy protection while maintaining model utility and explanation fidelity.\"}]",1784189776,33,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":78,"head_meta":80,"extra_data":82,"updated_unix":28},"tier-trajectory-invariant-explanation-regularization-for-membership-privacy","",{"@graph":36,"@context":77},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":20},"https://docshare.wps.com/document/tier-trajectory-invariant-explanation-regularization-for-membership-privacy/83694/",{"url":52,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-25","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71],{"name":72,"@type":73,"acceptedAnswer":74},"What outcomes does the paper report for privacy and model quality?","Question",{"text":75,"@type":76},"Extensive experiments show the method mitigates membership-inference attacks, delivering privacy protection while maintaining model utility and explanation fidelity.","Answer","https://schema.org",{"og:url":52,"og:type":79,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":81,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":84},[85,89,93,97,102,107,112,115,120,123,127],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":86,"show_sort_weight":87,"slug":88},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":90,"show_sort_weight":91,"slug":92},"Literature",80,"literature",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Exam",70,"exam",{"id":98,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},5,"Comic",60,"comic",{"id":103,"doc_module":4,"doc_module_name":46,"category_name":104,"show_sort_weight":105,"slug":106},6,"Technology",50,"technology",{"id":108,"doc_module":4,"doc_module_name":46,"category_name":109,"show_sort_weight":110,"slug":111},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":113,"slug":114},30,"research-report",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":46,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":124,"slug":126},10,"Lifestyle","lifestyle",{"id":128,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":98,"slug":130},19,"General","general"]