Revisiting privacy risks in quantized deep neural networks

Researchers conducted a systematic empirical study of the privacy risks of quantized deep neural networks, evaluating eight state-of-the-art membership inference attacks (MIAs) on six representative quantization methods. The results show that practical 4-8 bit quantization has limited impact on membership privacy risk, and quantized models are just as vulnerable to membership inference attacks as full-precision models; although aggressive low-bit quantization such as 2-bit can bring considerable privacy benefits, the cost is a significant drop in utility. The study also systematically analyzed how different quantization strategies change model behavior and outputs and thereby affect privacy vulnerability, and found that existing privacy defenses designed for full-precision models provide only limited additional protection when applied to quantized models and further exacerbate the utility drop. The paper's code and datasets are open-sourced on GitHub (https://github.com/JeffffffFu/Priv-QDNN）。