Curation Leaks: Membership Inference Attacks Targeting Machine Learning Data Curation

The researchers propose a new membership inference attack targeting machine learning data curation, showing that models trained only on curated public data still leak membership information about the private dataset that guided the curation. In this setting, the private data is used only to guide the selection of public data, and the model is never directly trained on it; without additional protection, the attack covers every major stage—the curation score computation, the selection of the curated subset, and the final trained model—and each stage exposes information about the private dataset. The authors also present a differentially private variant of the curation method that effectively mitigates the leakage, indicating that establishing formal privacy guarantees for data curation is a promising direction.