---
title: "CoLA Exposes How AI Data Pruning Leaks Private Info With 97% Accuracy"
subtitle: "A new attack framework shows that filtering datasets before training exposes both included and excluded samples, expanding the privacy attack surface across the entire ML pipeline."
url: "https://alphasignal.ai/news/cola-exposes-how-ai-data-pruning-leaks-private-info-with-97-accuracy"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-04-14T00:00:00.000Z"
updated: "2026-08-24T00:25:49.906Z"
type: "Paper"
topics:
  - "Security"
  - "Data"
subtopics:
  - "Prompt Injection"
  - "Red Teaming"
  - "Data Curation"
upvotes: 1870
source_url: "https://arxiv.org/abs/2604.12342"
comments: 0
truncated: true
---

# CoLA Exposes How AI Data Pruning Leaks Private Info With 97% Accuracy

> A new attack framework shows that filtering datasets before training exposes both included and excluded samples, expanding the privacy attack surface across the entire ML pipeline.

The standard playbook for training modern models includes an obvious efficiency trick: don't train on all your data. Coreset selection, dataset pruning, deduplication, and quality filtering are now routine steps that trim datasets down to a manageable, high-quality subset before a single gradient step is taken. The comforting side effect, most practitioners assume, is that fewer training samples means less memorization and therefore less privacy leakage.

A new paper titled [CoLA: A Choice Leakage Attack Framework](https://arxiv.org/abs/2604.12342) argues that this intuition is dangerously wrong. The authors take the first step toward systematically understanding the privacy risks of subset training and demonstrate that the very choices made during selection can become exploitable signals, exposing both included and excluded data to membership inference.

## The blind spot in the data pipeline

Membership inference attacks (MIAs) traditionally ask a single question: was this exact sample in the model's training set? The classical attacker exploits overfitting, since trained samples usually get higher confidence than unseen ones. Subset training complicates that clean split by producing three groups instead of two: **included** data that trained the model, **excluded** data that was collected and evaluated by the selector but discarded, and **outside** data that never entered the pipeline at all.

![Diagram of SP-MIA and TM-MIA classifying included, excluded, and outside data](https://arxiv.org/html/2604.12342v1/mia_setting.png) 

That third bucket, the excluded data, is where things get uncomfortable. The paper defines two distinct privacy surfaces:

* **Training-membership MIA (TM-MIA)**: the classical formulation. A sample is a member only if it was in the training set.
* **Selection-participation MIA (SP-MIA)**: a broader definition where a sample counts as a member if it participated in the selection process at all, even if it was ultimately thrown out.

SP-MIA is the more disturbing threat, enlarging the notion of membership from model training to the entire data-model supply chain. Knowing that someone's record was in a candidate pool for, say, an HIV screening dataset or a credit pre-approval list is itself sensitive information, regardless of whether the final model was trained on it.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [CoLA: A Choice Leakage Attack Framework to Expose Privacy Risks in Subset Training](https://arxiv.org/abs/2604.12342)
- [CoLa: A Choice Leakage Attack Framework To Expose Privacy Risks In Subset Training (OpenReview)](https://openreview.net/forum?id=SWA4zSrv6R)
- [CoLA full paper PDF](https://arxiv.org/html/2604.12342)