Joint Defense against Membership Inference and Adversarial Attacks via Quantization-Aware Robust Training

Abstract

Deep neural networks (DNNs) are increasingly deployed in privacy-sensitive domains, where they face two critical threats: adversarial examples and membership inference attacks (MIAs). While adversarial training enhances model robustness against input perturbations, it inadvertently increases susceptibility to MIAs by amplifying memorization. In this paper, we propose a unified defense framework that combines adversarial training with weight-only quantization to simultaneously improve robustness and privacy. Our method constrains model capacity through quantization-aware fine-tuning, reducing overfitting and narrowing the confidence gap between training and non-training samples. We further introduce a posterior flattening regularizer to suppress membership-specific signals. Experimental results on benchmark datasets demonstrate that our approach significantly lowers attack success rates while maintaining competitive accuracy, offering an effective and efficient solution for deploying secure and privacy-preserving DNNs in real-world settings.