Why are small FT datasets especially vulnerable to membership inference?

A **membership inference** attack tries to answer one question. Was this specific record part of the training set? The attacker does not need the weights. They just probe the model's outputs. The trick is loss. A model that has seen an example during training usually predicts it with unusually low loss, or high confidence. The attacker measures that confidence on a candidate record. If it sits far below what an unseen record would score, the record was probably in the training set. Small fine-tune sets make this easy. With a thousand examples, each one is shown over and over and pulls hard on the weights. The model memorises many of them, so their loss drops well below normal. That widening gap is the leak. A pretrained model is the opposite. It saw trillions of tokens, so no single sentence mattered much, and the memorisation signal is faint. Fine-tuning on a small private dataset re-concentrates all that influence onto a handful of records. The practical worry is privacy. If the fine-tune data contains medical notes or customer messages, an attacker can sometimes confirm that a named person's record was used to train the model.

**Membership inference** asks whether a given record was in the training set. The attacker treats per-example loss as the tell. A trained-on example usually gets unusually low loss, because the model partly memorised it. The attacker compares the candidate's loss against a reference distribution from unseen data. A statistically large gap signals membership. Small fine-tune sets amplify this sharply. Consider per-example influence. In a thousand-example fine-tune, each record contributes roughly one part in a thousand of the gradient signal. In pretraining, a single document contributes something near one part in a billion. The fine-tune share is three to four orders of magnitude larger per example. High influence means the model revisits each example many times across epochs and memorises a real fraction of them. Their loss collapses below the loss on fresh, in-distribution text. That collapse is exactly the separation an attacker exploits. The wrong explanations miss the mechanism. Noise does not drive the leak. LoRA rank is a fixed hyperparameter, not something that collapses on small data. Large learning rates are not forced by small sets and do not surface weights through an API. The single real driver is concentrated per-example influence.