[copybara-service]

Preserve attacker features and loss config on MIA data slices.

dataset_slicing._slice_data_by_indices builds each subgroup slice as a fresh AttackInputData and copies only logits, probabilities, labels, losses, entropies and sample weights. It silently drops extra_features_train and extra_features_test and resets loss_function and loss_function_using_logits to their defaults. Every class, percentile, correctness or custom slice therefore trains attacks without the adversary features the caller supplied, and, when losses are not supplied, derives them with cross-entropy (and from logits) even when the caller configured a squared or custom loss on probabilities. Separately, AttackInputData.get_loss_test resolves the logits default with bool(self.logits_test), which raises ValueError for any multi-element logits array when it is called before get_loss_train.

Per-slice membership-inference results are computed against a different attacker and loss signal than the entire-dataset result, so subgroup privacy risk is mis-reported (typically understated when the dropped features or configured loss carry membership signal) for exactly the slices that subgroup auditing is meant to surface. The get_loss_test defect is a crash rather than a silent mis-measurement.

Slices now carry the sliced extra features and inherit the parent's loss function and logits/probabilities choice, and get_loss_test uses the same is not None check as get_loss_train. Tests check that a class slice keeps the matching extra-feature rows and a custom probability-based loss (with losses equal to the parent's on those rows), and that calling get_loss_test first works with logits, probabilities or both.