If the title reads like a foreign language, here is the short version.

AI models learn from training data, and that data can include things about real people. A membership inference attack tries to tell, from a model's answers alone, whether a particular record was in the data it learned from. Models tend to be more confident about examples they saw in training than about ones they didn't, and the attack reads that difference.

Quantization shrinks a model by storing its numbers with less precision (for example, 4 bits instead of 16), so it needs less memory and answers faster. Because smaller sounds like less information, it is sometimes treated as if it also protected the training data. This essay checks that idea against the published studies, mostly a 2026 paper by Fu and colleagues that tested it on image-recognition models, and proposes a fairer test that has not yet been run.

Why it matters to you: if a company says your data is safe because its model was compressed, or because it runs on your own device, that is not a privacy guarantee. The essay's answer is a formal one, differential privacy: a mathematical limit on how much any one person's data can change what a model's outputs reveal.

Practical quantization can leave substantial membership-inference risk; equivalence to utility-matched full-precision baselines remains unestablished here. Aggressive quantization (2-bit and below) can reduce measured risk, sometimes with small utility loss, but results vary by algorithm and are unstable at 1.58 bits. Industry compression is primarily for cost and speed reduction, not security. Quantization alone does not remove training data leakage. Whether the measured gains survive a comparison with full- precision models matched for accuracy has not been tested; that comparison is this essay's proposal. Existing vision results do not automatically apply to transformers (the design behind today's language models); LLM evaluations require documented membership provenance to distinguish leakage from distribution shift (an LLM, or large language model, is the kind of AI behind chatbots). Do not audit privacy budgets based on model compression. Use appropriately accounted differential privacy where a participation-level disclosure guarantee is needed, and assess erasure obligations separately.

• Quantization (4–8 bit) is a performance optimization, not a privacy guarantee.
• The studies that report privacy gains did not compare against full-precision models matched for accuracy, so the gains haven't been separated from the accuracy lost. That comparison is proposed here, not yet run.
• Aggressive low-bit quantization (2-bit) can reduce leakage at small utility cost for some PTQ methods (post-training quantization: shrinking a model after it has been trained); at 1.58 bits, utility costs grow and results vary widely between runs.
• LLM privacy evaluations need documented membership provenance and distribution- shift controls; without them, measured separation cannot reliably be attributed to membership.
• A formal membership-privacy guarantee requires a formal privacy mechanism such as differential privacy (DP); weight compression gives none, and practical mitigations can lower measured risk without that assurance. Secure enclaves (sealed-off areas of a computer that shield code and data while it runs) protect against a different threat: they don't limit what outputs reveal.

• Model Owners: Compression alone does not establish compliance with an applicable Article 17 erasure obligation (under the EU's General Data Protection Regulation, the right to have personal data erased); applicability, retained personal data, and exceptions require case-specific assessment 11.
• Security Auditors: Weight quantization is not evidence of data minimization; formal differential privacy accounting is the standard technical way to bound membership leakage 7.
• ML Engineers: Tuning hyperparameters to match test accuracy during the validation phase invalidates held-out evaluation 12.
• Risk Managers: Extreme quantization (2-bit) may reduce attack success rates but introduces instability in model utility and high variance in run-to-run performance 3.
• Policy Makers: Claims that on-device execution prevents data leakage are technically incorrect if the model output allows inference attacks, which need only query access 6.

Drafts here go through the Moot before I read them: a panel of frontier models I call by their lab bosses' first names (Dario for Anthropic's, Sam for OpenAI's, Sundar for Google's), plus Eddie, the house model that writes the first draft and then argues with all of them. The names are a bit. None of those gentlemen work here. In this essay's Long Moot, Dario's reading ran out of room before it finished and Sundar's couldn't be read back, so Sam's list of assumptions carried that round; all three ruled on the review that followed. After publication, three outside readers (Claude, OpenAI's Astra and Google's Gemini, without the nicknames) sent critiques, and this version is the one that came back from them.

The tempting inference is that a smaller model leaks less, and it has made it into print: Famili & Lao's 2023 paper is titled "Deep Neural Network Quantization Framework for Effective Defense against Membership Inference Attacks" 2. That inference misreads what compression actually does. Quantization is everywhere in modern deployment pipelines, and it is there to reduce memory footprint and inference latency 1. Compression work sometimes cites privacy as a benefit of on-device inference, meaning user inputs stay local14; that concerns input privacy, not training-data leakage. From there, the framing suggests that reducing the precision of weights (e.g., from 16-bit floating point to 4-bit integers) removes the signal required to reconstruct training data or infer membership.

The assumption conflates model size with information content. Membership inference attacks (MIA) rely on confidence ranking, and empirical work finds that 4–8 bit quantization preserves it closely in the configurations tested 1. In those configurations, the precision left after 8-bit quantization is enough to keep the confidence gaps between member and non-member predictions 1. Black-box attacks do not require internal gradient access. Some use exposed probabilities; others use only predicted labels, so hiding confidence scores is not a general defense.

The "local inference = privacy" claim is technically false in the context of black-box MIA. If an API or local service returns confidence scores, where the compute runs (cloud vs. edge) does not prevent inference attacks, which work through query access alone 6. An attacker can query the model repeatedly to build a decision boundary. The model's output distribution reflects whatever overfitting happened in the training phase, and quantization alters the weight space without necessarily removing the overfitting signatures that distinguish member samples.

The measurements don't cooperate with the assumption. Fu et al.'s analysis of the Priv- QDNN baselines on CIFAR-100 (a research collection of 60,000 small color photos sorted into 100 categories) reports that 4–8 bit quantization keeps Membership Inference Attack Area Under the Curve (AUC) values (a score on which 0.5 means the attacker does no better than a coin flip and 1.0 means it is never wrong) close to those of the full-precision models it started from 1. That comparison is before and after quantization, not against a full- precision model matched for accuracy. A claim that quantization provides a significant defense has to show that the AUC drops to near 0.5, or that True Positive Rate (TPR) at fixed False Positive Rate (FPR) thresholds (how many real members the attack catches while allowed only a fixed rate of false alarms) falls below acceptable baselines 8.

Marketing quantization as a privacy control is premature, because it ignores how MIA works: models fit training data more closely than non-training data, and the attack exploits that gap. Quantization acts as a regularizer, but in standard configurations the regularization effect is insufficient to erase the membership signal 1. Reading "quantization is a privacy guarantee" out of performance optimization data is an unsupported inference1.

Membership inference attacks rely on a plain observation: models behave differently on data they saw during training than on data they didn't. The difference shows up in the confidence scores or loss values attached to predictions. A member sample typically draws higher confidence or lower loss than a non-member sample 6. For quantization to count as a defense, changing the weight values isn't enough; it has to alter the output distribution enough to disrupt that signal.

8-bit quantization preserves enough numerical precision to maintain confidence gaps 1. Mapping 16-bit float to 8-bit int involves scaling and rounding, but the relative ordering of probabilities for similar inputs is often preserved. If a model is overfitted, its member samples still cluster in the high-confidence region of the output space. Quantization compresses the dynamic range of the weights; the functional behavior that matters for membership classification often stays put.

Black-box attacks work without gradients 6. That matters, because many defense claims assume an attacker needs gradient access (white-box) to succeed. In practice, black-box attacks are sufficient to measure privacy risk in deployed systems. In a shadow-model attack, shadow models imitate the target task; their member and nonmember outputs provide examples for training a separate membership classifier. If quantization does not alter the output probability distribution, the shadow model succeeds.

Quantization-induced privacy reduction is often attributed to reduced overfitting, since compression acts as a form of regularization. But that reduction in overfitting is not specific to quantization: standard regularization techniques (dropout, weight decay) may achieve similar utility/privacy trade-offs; this comparison is untested here. Crediting the privacy gain solely to quantization ignores the utility loss required to get it.

Fu et al. document confidence gaps that survive 4–8 bit quantization in the configurations they tested 1: the information the attack needs is still in the model. Whether the gaps also survive when a full-precision model is given the same accuracy is the open question, and the evaluation below is built to answer it.

There are exceptions where quantization does reduce leakage. They typically occur at bit- widths of 2 bits or lower, or in specific architecture/dataset combinations 1. They are not universal, and they show high variance. The mechanism in those cases is likely aggressive perturbation of the weights, which disrupts the model's ability to generalize, rather than any specific privacy-preserving property of quantization.

Here is how an uncontrolled privacy–utility comparison gets researchers to credit quantization with privacy gains it may not have earned. The common design flaw is failing to match utility between the quantized model and the full-precision baseline. Quantize a model and its accuracy typically drops. That drop is often correlated with a drop in overfitting, which in turn reduces MIA success. Researchers then attribute the reduction in

MIA success to the quantization process itself, rather than to the utility loss that came with it.

Accuracy-matched controls separate compression artifacts from overfitting reduction [This work]. Some prior work does not isolate quantization's contribution from utility loss23. Famili & Lao (2023), for example, report MIA accuracy falling from 67.54% (full precision) to 53.59% (4-bit) on ResNet-20 (an image-recognition network) 2. That is a 13.95 percentage-point drop in attack accuracy. The paper's abstract reports a 14% attack- accuracy reduction and a 37% TPR reduction, consistent with Table 5 TP cells being proportions of all examples 2.

The Famili & Lao Table 5 reports percentages of the total evaluation set (where TN+FP+FN+TP = 100% and positives = 50%). Read that way, the actual True Positive Rate (TPR) drops from approximately 99.96% to 25.64% 2. (That calculation assumes the standard interpretation of confusion matrix proportions, which is the same reading still listed as disputed below.) The table discrepancies remain unresolved, but Section 4.2 explicitly states that the targets are quantized and the shadow models use full precision 2. Quantization-adapted attacks are needed to test whether the reported benefit survives the full-precision-shadow transfer mismatch.

Statistical significance and equivalence are different animals. Non-significance is not equivalence 9. A measured AUC of 0.55 might not be statistically different from 0.50, and it still doesn't prove the model is safe. Equivalence claims require specified bounds and an adequate uncertainty analysis 9. If a quantization method cuts MIA AUC from 0.70 to 0.60, and the full-precision baseline matched for accuracy also achieves 0.60, quantization's incremental gain is nil, even though the deployed model's leakage really did fall.

Two questions hide in that comparison. One is the total effect: what happens to utility and attack success when this model is quantized? The other is the incremental benefit: at the same utility, does quantization leak less than another way of giving up that accuracy, such as stronger regularization? Both are fair questions, and a measured drop answers the first: the quantized model's leakage really did fall under that attack. The claim that quantization is a privacy technique needs the second, and that is the one this essay's evaluation targets.

Isolating the effect of quantization requires validation matching. Tuning hyperparameters to match test accuracy violates train/test separation 12; choosing the control after seeing the test results is afterwit, not method. The correct procedure is to match validation accuracy. That controls one utility statistic; it does not establish equivalent generalization or eliminate all alternative explanations for a privacy difference. If the quantized model achieves 90% validation accuracy, the full-precision baseline must be tuned to achieve 90% validation accuracy. Attribution additionally requires a defined estimand, controlled training and scoring procedures, adapted attacks, and uncertainty analysis.

The accuracy-drop confound produces the "Lazy River" effect. Researchers drift into a zone of lower accuracy, where privacy risk naturally decreases, and assume they have found a privacy-preserving compression method. They arrive at "quantization protects privacy" when what they have shown is that a less accurate model leaks less, which other ways of losing the same accuracy may match. To test this proposal, select full-precision controls using the quantized model's validation accuracy only, leaving test results untouched during selection [Proposed protocol].

Prior work in the field frequently fails to implement this control. The measured benefit in Famili & Lao may persist with quantization-adapted shadow models, or it may vanish 2; finding out requires running the adapted-shadow-model control experiment. If the adversary trains shadow models quantized in the same scheme and bit-width as the target model, the attack accuracy may recover 2.

The plan is to rerun the 4–8 bit experiments with accuracy control. The hypothesis under test: quantization adds noise, but when accuracy is held constant, the noise is not enough to break the membership signal. The Priv-QDNN framework provides the baseline for these experiments. Reproducing the Priv-QDNN scripts requires verifying that the validation split is separate from the test set 13.

ResNet-18 is a common architecture in these evaluations. When moderate quantization is applied to vision models, reported MIA performance stays close to full precision 13; whether this holds under validation-accuracy matching is untested. The noise introduced by quantization does not mask the membership signal enough to prevent attack success. The confidence gaps persist.

There are exceptions. The MobileNetV2/CINIC-10 4-bit configuration is documented as a case where attack accuracy falls near chance 1. That exception is specific to the architecture and dataset, and it does not generalize to all 4-bit quantized models. The Priv- QDNN evaluation includes ResNet-18, MobileNetV2, and a 5-layer MLP on Location and Texas 1, and the scope of these results is limited to those specific configurations.

Raw vs. matched accuracy is the comparison that matters. Raw quantized models often show lower AUC because they have lower accuracy. We hypothesize (C1) that accuracy- matched quantized and full-precision models would show similar AUC; this has not yet been measured.

Zhang et al. (2025) provide counterevidence for aggressive quantization. In BRECQ 2-bit post-training quantization, the accuracy drops are 0.5%, 0.4%, and 0.9% on CIFAR-10, CIFAR-100, and TinyImageNet, while reducing MIA vulnerability 3. At 1.58 bits, though, BRECQ exhibits high run-to-run variance in TPR@0.1%FPR 3. This suggests that at extreme bit-widths quantization can provide a defense, at the cost of stability. The "Bits for Privacy" counterevidence shows that utility drops can be minimal, but the privacy gain is not guaranteed and depends on the specific quantization algorithm (BRECQ vs standard PTQ) 3.

The magnitude and mechanism of quantization-specific attack reductions remain empirical questions. Answering them takes paired checkpoints, multiple validation- matched controls, adapted attacks, documented membership, and prespecified uncertainty analyses, not accuracy matching alone. The Priv-QDNN repository (at commit 0cdc75767569, the head of its main branch on 1 November 2026) pins torch 2.5.1 and contains the identified CIFAR-100 preprocessing path 13. Neither fact establishes that a rerun would succeed or validates the proposed compute budget.

The effect of the traced preprocessing asymmetry requires a pinned-commit rerun with matched scoring transforms. Static inspection identifies the exposure path but does not quantify its influence. The worry is concrete: if training transforms (RandomHorizontalFlip and RandomCrop) are applied to training members but deterministic transforms are applied to nonmembers during MIA scoring, the attack signal may be artificially inflated [This work].

The Priv-QDNN scope is limited to vision models (ResNet-18, MobileNetV2) and MLPs on tabular data 1, and it does not automatically extend to LLMs. The 4-bit MobileNetV2/ CINIC-10 exception is explicitly documented 1. Its existence is settled; its independent reproducibility is not.

So do the CIFAR-100 findings carry over to Llama-3-8B, Meta's 8-billion-parameter language model, released for broad use? Not automatically. LLMs overfit differently, and LLM-specific PTQ methods such as AWQ (activation-aware, weight-only) differ from the PTQ methods used in vision studies 14. LLM studies already exist (Haque et al.) 4, and distribution shift confounds LLM MIA 5.

LLMs are not direct extensions of vision classifiers. The data distributions are different: text is sequential and high-dimensional in a different way than pixels. The quantization methods differ too, and AWQ is not the standard Post-Training Quantization (PTQ) used in vision. It is simultaneously activation-aware and weight-only 14. It protects salient weight channels, identified by activation magnitude, through per-channel scaling before weight quantization. That mechanism may protect privacy differently than standard weight quantization.

Existing LLM privacy evaluations require verified member/nonmember labels. Without them, they measure dataset distribution shift. Duan et al. (2024) demonstrate that distribution shift confounds LLM Membership Inference evaluations 5. If the "nonmember" data comes from a different distribution (e.g., a different corpus), the model will distinguish the two on that basis, not on membership. One of these things is not like the other, and the attack scores the difference as a leak. This creates a false positive for privacy risk.

Settling the Llama experiment's membership validity requires checkpoint-specific inclusion evidence, an established baseline sensitivity, and a fully specified evaluation protocol 5. Haque et al. report reduced membership-attack performance after quantization in code LLMs, including a Pythia-410M reference-attack ROC AUC decrease from 0.6711 to 0.6039 at 4 bits. These results are relevant counterevidence, not a validation-matched Llama result 4.

Whether quantization's effect on leakage points the same way in language models as in vision classifiers is a hypothesis (C3). Raw AUCs from different tasks can't be compared directly, so the test compares within-model effects: each model against its own validation- matched control [This work]. Llama-3-8B's training data isn't documented, which rules it out for this; Pythia, whose models were "all trained on public data seen in the exact same order" 16, is the cleaner test, and Haque et al. already used it 4.

The mechanism of protection in LLMs may differ. Whether a particular weight-only or weight-and-activation quantizer changes membership leakage is an empirical question; activation-aware calibration alone does not determine the direction. Without measured data, this is speculative.

The magnitude of the quantization-specific attack reductions remains empirical, and settling it requires adapted attacks. Standard MIA attacks trained on full-precision shadow models may not transfer to quantized targets, so quantization-adapted shadow experiments are required. Prior literature has not fully resolved this. The conflict between tables in Famili & Lao, and the need for author clarification, remains 2.

The preprocessing path identified in Priv-QDNN may not apply to LLMs, since LLM tokenization introduces its own transforms. The interaction between tokenization, quantization, and MIA is complex.

For model owners, the practical picture looks like this. Aggressive quantization (2-bit) can reduce leakage with small utility cost for some PTQ algorithms (e.g., BRECQ), while 1.58-bit shows larger accuracy drops and high run-to-run variance 3. Quantization keeps a DP guarantee when it uses no private data, because post-processing can't weaken DP; quantization that does use private data (calibration, quantization-aware training) needs its own privacy accounting 7. Enclaves isolate code and data 10; what the model returns still reaches the caller.

Practitioners should not audit privacy budgets based on model compression. Quantization is a performance optimization; compression alone does not demonstrate erasure [This work]. Use differential privacy to bound participation-related disclosure, and address erasure separately through an appropriate deletion and model-remediation process.

Compare TPR at prespecified, threat-relevant low FPRs, with confidence intervals and adequate nonmember sample sizes. DP guarantees are preserved if the quantization step does not reuse private training/calibration data. If private data is used for calibration or Quantization-Aware Training (QAT) without accounting for the privacy budget, the DP guarantee is lost 7. Post-processing preservation is a formal theorem, not an inference from unsuccessful attacks 7.

Enclaves (Trusted Execution Environments) are, in Microsoft's description, "an isolated region of code and data," which only code inside the enclave can reach 10. Nothing about that changes what is returned to callers. If the model inside the enclave returns a confidence score, the enclave does not prevent MIA; it only protects the model weights from being extracted. The output is still vulnerable, and that distinction is critical for compliance. Enclaves isolate execution; they do not limit what outputs reveal, so they do not address output-based inference attacks.

GDPR Article 17 specifies grounds for erasure and exceptions. It does not specify technical MIA thresholds 11. Whether a trained model itself holds personal data, and so what erasure means for it, is decided case by case: the European Data Protection Board says "whether an AI model is anonymous should be assessed on a case by case basis," and counts a model as anonymous only if it is "very unlikely" to let anyone "extract such personal data from the model through queries" 15. Membership inference is one relevant form of that query-based risk, not the whole test: it reveals whether a known record was used, not the record itself, though in a sensitive dataset that alone can disclose something. What is clear is that compression changes how precisely the weights are stored, not what they learned. A smaller filing cabinet is not a shredder. Relying on quantization to satisfy Article 17 is a compliance error.

A formal guarantee against output-based membership inference requires a formal privacy mechanism such as DP, not weight compression; practical mitigations can lower measured risk without giving the same assurance. Enclaves protect execution, not outputs. DP bounds how much an individual's participation can change the output distribution, according to the stated privacy parameters. Quantization does neither effectively without utility loss.

The resource budget for measuring these effects is high. Independent audit of the Priv- QDNN repository requires fetching raw files and tracing the attack-scoring call path 13.

Quantization is a performance optimization; compression alone does not demonstrate erasure [This work].

No result we found shows quantization reducing membership risk beyond what its accuracy loss alone would; the studies that report reductions did not compare against full- precision models matched for utility. Our hypothesis is that, when utility is matched, 4–8 bit quantization adds no meaningful reduction. It is a hypothesis, and the evaluation above is how to test it. Aggressive quantization (2-bit) may reduce risk at modest utility cost for some algorithms; at 1.58 bits, accuracy drops grow and privacy results vary widely between runs.

LLM evaluations require careful design to avoid distribution shift confounds, and vision results do not automatically apply to transformers. A formal membership-privacy guarantee requires a formal mechanism such as DP; secure execution environments protect against a different threat, and weight compression against neither.

Auditor claims against measured AUC thresholds must account for validation matching. If a vendor claims a 4-bit model is private because its AUC is 0.65, but a full-precision model matched to the same accuracy also scores 0.65, quantization has added nothing the accuracy loss didn't.

Quantization made the model smaller and faster. That was the job.

• C1: The Confound Hypothesis
  • Claim: At 4–8 bits, a post-training-quantized model shows no meaningful reduction in membership-attack success relative to full-precision controls selected to match its validation accuracy.
  • Falsifier: For a prespecified quantizer, benchmark and attack suite, the benefit B = (control − quantized) exceeds a margin δ fixed before the run, in the sense that the lower confidence bound of B is above δ, not merely above zero; and it does so for both TPR at 1% FPR and AUC, against controls matched within 0.5 percentage points of validation accuracy and built with each of two prespecified regularizers (weight decay, dropout). Uncertainty comes from at least five independently trained seeds, not only from resampling one model's examples, and the nonmember audit set is large enough that the 1% FPR threshold rests on at least 100 false positives (10,000 nonmembers).
• C2: The Low-Bit Hypothesis
  • Claim: The reductions reported at 2 bits 3 shrink when the comparison is a full- precision model matched for validation accuracy rather than the original full- precision model.
  • Falsifier: Let G_original be the gain against the full-precision parent (parent − quantized) and G_matched the gain against the validation-matched control (control − quantized), for TPR at 1% FPR and for AUC. C2 fails if, across at least five seeds, the paired shrinkage G_original − G_matched has a confidence interval entirely below a shrinkage margin fixed before the run: the 2-bit model's advantage is about as large against the matched control as against its parent. (A surviving, significant gain does not falsify C2 if it has shrunk: from 0.20 to 0.10 AUC points supports it.)
• C3: The LLM Generalization Hypothesis
  • Claim: Within each system, the effect of 4-bit quantization on membership leakage, measured against a validation-matched control, points the same way in a language model as in a vision classifier.
  • Falsifier: On a language model with documented training membership (Pythia, trained on public data seen in a fixed order 16 ), the within-model change in TPR at 1% FPR, against a validation-matched control, has the opposite sign from ResNet-18's, with a confidence interval excluding zero. Different magnitudes in the same direction don't falsify it. Raw AUCs across different tasks are not compared.

• How to: Select full-precision controls using validation data only. Evaluate final utility on untouched task-test data and evaluate membership using separately specified member and nonmember audit samples.
• How not to: Do not tune hyperparameters or regularization to match test accuracy (violates train/test separation). Do not use AUC > 0.5 alone as failure metric; use TPR@1% FPR with uncertainty bounds.
• Pseudocode:

Algorithm: Validation-Matched Baseline (PTQ)
1. Fix the train, validation and audit splits,
   the architecture, the seeds and the attack
   protocol before training anything.
2. Train a full-precision parent M_fp on Train.
   Save its checkpoint.
3. Apply the prespecified PTQ method Q to M_fp,
   with no retraining. Record the calibration
   data used and whether any of it is private.
   Record the result M_q and its Val Acc V_q.
4. Train separate full-precision controls on
   Train, each with one prespecified regularizer
   (L2; dropout), tuned until Val Acc is within
   0.5 points of V_q. Select on validation only.
5. Freeze checkpoints, attacks and thresholds.
   Score members and nonmembers with matched
   transforms; fit attacks apart from evaluation.
6. Compare M_q with its parent M_fp (total
   effect) and with the matched controls
   (incremental benefit): paired estimates,
   confidence intervals, seed-to-seed variance.
QAT is a different experiment; report it apart.

• Claim: "On-device execution protects training data."
  • Check: Verify if MIA uses outputs. If API returns confidence scores, location of compute (cloud vs. edge) does not prevent black-box inference 6.
• Claim: "Quantized models satisfy GDPR Article 17 (Right to Erasure)."
  • Check: Article 17 specifies grounds for erasure, not technical MIA thresholds 11; whether a model holds personal data is assessed case by case 15. Compression changes how precisely the weights are stored, not what they learned.
• Claim: "Low-bit quantization provides DP guarantees."
  • Check: Quantization that uses no private data is post-processing and keeps the DP guarantee; PTQ/QAT that uses private data keeps it only if that use is counted in the privacy budget 7.
• Claim: "MIA AUC is 0.5 (chance)."
  • Check: Verify TPR@1% FPR. Aggregate AUC can hide reliable identification of specific members at low false-positive rates 8.

• What we couldn't find out: Whether Famili & Lao's measured defense benefit persists with quantization-adapted shadow models (requires running adapted-shadows) 2.
• What we couldn't measure: Run-to-run variance in TPR@0.1% FPR for 2-bit models (high variance observed in literature, requires more seeds) 3.
• Who could settle it: Independent audit of Priv-QDNN repository to confirm preprocessing path (training vs. test transforms) and exact membership provenance for LLM experiments 13.
• Disputed Points:
  • Famili & Lao's tables. Tables 3 and 5 conflict, and whether Table 5's TP cells are proportions of all examples decides the TPR reading above. Settle by author clarification or the underlying outputs 2.
  • Attack transfer. Famili & Lao's Section 4.2 attacks quantized targets with full- precision shadow models. Whether their reduced attack accuracy survives shadow models quantized with the same scheme and bit-width as the target needs that experiment run 2.
  • The MobileNetV2/CINIC-10 exception in Fu et al., with a large attack reduction at 4 bits. Settle by checking Fu's result tables and rerunning it 1.
  • BRECQ's 2-bit utility. The reported drops (0.5/0.4/0.9 points) against the abstract's "decreased utility." Settle by reading the results tables 3.
  • Fu's increment. Section V-B and Table IV compare quantized defended models with their defended full-precision counterparts; the limited additional benefit is the increment from quantization 1.
  • Priv-QDNN's preprocessing. Static inspection of the default CIFAR-100 path shows member features inheriting training augmentation (RandomHorizontalFlip, RandomCrop in data/load_data.py) while nonmembers get deterministic transforms, and the split can materialize augmented examples before scoring. The effect on attack metrics is unmeasured; it needs a rerun at the pinned commit with matched scoring transforms 13.
  • Language-model membership. A valid LLM test needs documented training membership, a baseline sensitivity check and a fully specified protocol 516.
  • Erasure. The checked Article 17 text supplies grounds and exceptions, not a technical compliance verdict; whether a model holds personal data is assessed case by case 1115.
• Right of reply: The questions above for Famili & Lao (their tables, and the shadow- model choice) and for the Priv-QDNN authors (the preprocessing path) have not yet been put to them. When they are, their answers will be recorded here.