READ-OUTS ARE FILTERS, NOT FIREWALLS: MANIFOLD HEALTH SETS THE CEILING OF MEMBERSHIP INFERENCE PRIVACY

Membership inference attacks (MIAs) exploit distinct channels of a trained model: representations, gradients, outputs, decision boundaries, and the per-sample training loss. Why do defenses that survive adaptive auditing on one dataset collapse on another? We attribute the surviving signal to a three-stage pipeline: data fingerprintability creates memorizable training samples; the representation encodes them; and the read-out decides how visibly the memorization surfaces in the observable scalar. One geometric property, the manifold health of the class-conditional distributions, splits datasets into three regimes and drives two degradation paths. In the fingerprint regime (scattered distributions: high intrinsic dimension, few samples per class), leakage resurfaces through any read-out as the shadow budget grows: on Location30 a density head read at 0.58 AUC with four shadows is read at 0.79 with eight. In the low-signal regime (mixed distributions), utility collapses faster than any defense can act: head-only DP-SGD on Texas100 falls from 61.9% to 12.6% accuracy. Within the manifold regime the read-out is decisive: linear logit heads carry a per-sample parameter imprint that LiRA amplifies (0.939 at 64 shadows vs. 0.832 with no defense), while a frozen-anchor density head suppresses the same channel to chance (0.5213 AUC at 94.9% accuracy on CIFAR-10; 0.4984 at 88.1% on PathMNIST) at zero ε cost. Read-outs are filters, not firewalls. Coarsening Location’s features from 446 to 112 dimensions confirms the fingerprint mechanism causally: leakage drops (0.885 → 0.811) as fingerprintability falls. We contribute a pre-deployment manifold audit (intrinsic dimension, class separation, samples per class) and a mechanism-matched, noise-matched, multi-seed protocol under which the three regimes (and the defense each one demands) become a measurement problem rather than trial and error.