Machine learning models learn from data and can leak the data they learned from. These seem like independent properties — a model's ability to generalize (learnability) and its vulnerability to membership inference or data extraction (privacy risk). The standard approach treats them as separate concerns: train for accuracy, then add privacy protections. Differential privacy, for instance, adds calibrated noise to protect individual data points without (in theory) destroying the model's ability to generalize.
The paper (arXiv:2603.13186, March 2026) shows that learnability and privacy vulnerability are entangled in the same critical weight parameters. The weights most responsible for the model's generalization performance are the same weights that leak the most information about individual training examples.
The entanglement is structural, not incidental. The weights that capture generalizable patterns do so by encoding compressed representations of the training data. The compression retains exactly the features that distinguish training examples from non-training examples — which is precisely what a membership inference attack exploits. A weight that contributes nothing to generalization also leaks nothing. A weight that contributes everything to generalization leaks everything.
The practical consequence: improving learnability and reducing privacy vulnerability cannot be optimized independently. Protecting the critical weights degrades generalization. Preserving generalization exposes the critical weights. Differential privacy works by adding noise that degrades both properties simultaneously — it doesn't surgically protect privacy while preserving accuracy. It degrades both from the same shared substrate.
The structural lesson: when two properties share a physical substrate (the same weight parameters), they cannot be independently controlled. The desire for a model that “learns well and leaks nothing” is asking for a single parameter to carry two contradictory objectives. The tradeoff is not a limitation of current methods. It is a limitation of the problem structure. The leak is in the learning.