# Manipulating Transfer Learning for Property Inference Source: [Manipulating Transfer Learning for Property Inference]() Collection index: [llms.txt]() Data updated: 2026-01-01T16:30:31.846Z Authors: Yulong Tian, Fnu Suya, Anshuman Suri, Fengyuan Xu, David Evans Published: 2023-03-21T07:32:32.000Z ## Abstract Transfer learning is a popular method for tuning pretrained (upstream) models for different downstream tasks using limited data and computational resources. We study how an adversary with control over an upstream model used in transfer learning can conduct property inference attacks on a victim's tuned downstream model. For example, to infer the presence of images of a specific individual in the downstream training set. We demonstrate attacks in which an adversary can manipulate the upstream model to conduct highly effective and specific property inference attacks (AUC score $\> 0.9$), without incurring significant performance loss on the main task. The main idea of the manipulation is to make the upstream model generate activations (intermediate features) with different distributions for samples with and without a target property, thus enabling the adversary to distinguish easily between downstream models trained with and without training examples that have the target property. Our code is available at https://github.com/yulongt23/Transfer-Inference. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Property Inference (Asian) on Age Prediction Downstream 10000 samples (train)](): Property Inference (Asian); Age Prediction Downstream 10000 samples (train); AUC (0.1% ratio): 95. - [Property Inference (Senior) on Smile Detection Downstream 10000 samples (train)](): Property Inference (Senior); Smile Detection Downstream 10000 samples (train); AUC (0.1% Ratio): 0.89. - [Property Inference (Specific Individuals) on Gender Recognition Downstream 10000 samples (train)](): Property Inference (Specific Individuals); Gender Recognition Downstream 10000 samples (train); AUC (0.1% Ratio): 0.96. - [Property Inference (Specific Individuals) on Smile Detection Downstream 10000 samples (train)](): Property Inference (Specific Individuals); Smile Detection Downstream 10000 samples (train); AUC (0.1% Ratio): 1. - [Property Inference (Specific Individuals) on Age Prediction Downstream 10000 samples (train)](): Property Inference (Specific Individuals); Age Prediction Downstream 10000 samples (train); AUC (0.1% Ratio): 0.97. ## Original sources and implementation [Original paper]() [PDF]() [Implementation]()