Recent work in the privacy literature shows that sample-targeted membership inference attacks (MIAs) significantly outperform untargeted approaches by a wide margin. Motivated by this observation, we address the following question: can the privacy vulnerability of individual training points be assessed without training shadow models? We show that per-sample exposure to MIA is governed not only by a point's loss, but also by a data-dependent geometric measure. In the linear setting, we derive a closed-form decomposition of individual black-box MIA vulnerability into a population leverage score and a residual loss term, making explicit how sample-dependent geometry translates into privacy exposure. Since the final layer of most modern architectures is linear, we extend this framework to deep networks and propose a surrogate score operating on last-layer representations that requires only a single trained model and no shadow models. Empirical evaluations across diverse datasets and architectures show that our score outperforms loss and gradient-norm baselines at identifying the highest-risk points under state-of-the-art attacks, providing a computationally efficient and theoretically grounded tool for per-sample privacy risk assessment.

翻译：近期隐私研究表明，面向样本的成员推理攻击（MIA）显著优于非定向方法。基于这一发现，我们探讨以下问题：能否在不训练影子模型的情况下评估个体训练点的隐私脆弱性？我们证明，逐样本的MIA暴露不仅受其损失值影响，还取决于数据依赖的几何测度。在线性设定中，我们推导出针对黑盒MIA脆弱性的闭式分解，将其划分为总体杠杆得分与残差损失项，明确揭示了样本依赖几何特征如何转化为隐私暴露。由于现代大多数架构的最后一层为线性层，我们将该框架扩展至深度网络，并提出基于最后一层表示的替代评分——该评分仅需单一训练模型且无需影子模型。跨数据集与架构的实验表明，在面对最先进攻击时，我们的评分在识别高风险点上优于基于损失与梯度范数的基线方法，从而为逐样本隐私风险评估提供了计算高效且理论扎实的工具。