Membership Privacy Risks of Sharpness Aware Minimization
Young In Kim, Andrea Agiollo, Pratiksha Agrawal, Johannes O. Royset, Rajiv Khanna

TL;DR
This paper reveals that Sharpness-Aware Minimization, while improving generalization, increases vulnerability to membership inference attacks due to its tendency to memorize atypical data patterns and reduce prediction confidence variance.
Contribution
It provides the first comprehensive analysis linking SAM's geometric properties to increased membership privacy risks and offers a theoretical model explaining this phenomenon.
Findings
SAM is more susceptible to membership inference attacks than SGD.
SAM captures atypical subpatterns, leading to higher memorization scores.
Theoretical analysis shows sharpness regularization reduces variance, increasing MIA advantage.
Abstract
Optimization algorithms that seek flatter minima, such as Sharpness-Aware Minimization (SAM), are credited with improved generalization and robustness to noise. We ask whether such gains impact membership privacy. Surprisingly, we find that SAM is more prone to Membership Inference Attacks (MIA) than classical SGD across multiple datasets and attack methods, despite achieving lower test error. This suggests that the geometric mechanism of SAM that improves generalization simultaneously exacerbates membership leakage. We investigate this phenomenon through extensive analysis of memorization and influence scores. Our results reveal that SAM is more capable of capturing atypical subpatterns, leading to higher memorization scores of samples. Conversely, SGD depends more heavily on majority features, exhibiting worse generalization on atypical subgroups and lower memorization. Crucially,…
Peer Reviews
Decision·ICLR 2026 Poster
1. The paper first states that SAM increases vulnerability to MIAs. 2. The paper is exceptionally clear, presenting its counter-intuitive finding and complex hypothesis in a logical, well-structured, and easy-to-follow manner.
1. The authors claim to challenge the conventional assumption that improved generalization implies stronger privacy. However, this insight has already been discussed in previous works [1,2,3,4]. 2. The paper's claims are based solely on the original SAM algorithm. It is unclear whether these findings on increased privacy risk generalize to other sharpness-aware optimizers (e.g., ASAM, GSAM). An investigation into these variants is recommended. 3. As a privacy metric, accuracy has been critic
1. The paper offers novel insights into the trade-offs between generalization and privacy, which challenges the conventional belief that better generalization implies lower privacy risk. 2. The authors combine empirical evidence with theoretical guarantees to support their claims. The consistent results across datasets and models strengthen their conclusion. 3. The paper is well-written and easy to follow.
1. While the paper highlights SAM’s privacy vulnerability, it would be good to propose or evaluate defensive strategies to mitigate this risk to improve practical applicability. 2. The theoretical analysis relies on a simplified linear model and strong assumptions (e.g., perfect interpolation). It lacks both theoretical and empirical validations on more advanced non-linear architectures like Transformer-based or diffusion models.
- The paper is well written and easy to follow. - The finding of the relationship between the SAM and memorization is interesting and may shed light to privacy defense. - The theoretical analysis is interesting and insightful.
+ (Major) Experimental Evidence. The central claim regarding SAM's heightened privacy risk is not yet fully convincing. The results in Table 1 show that SAM's privacy risk (measured by ASR) is not consistently or significantly higher than that of SGD (in Purchase-100 and Texas-100). Besides, Table 3 reports only the best attack accuracy, unlike Table 1 which shows results for all MIA methods. + (Major) Uncertain connection between ASR and memorization score. The link between the memorization sc
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsStochastic Gradient Optimization Techniques · Advanced Neural Network Applications · Machine Learning and Data Classification
MethodsSegment Anything Model · Attentive Walk-Aggregating Graph Neural Network · Focus · Stochastic Gradient Descent
