The DOI matches its Crossref record; 34 of the 34 references it cites were found in a registry or an index.
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
Open accessAbstract
Deep Learning has recently become hugely popular in machine learning for its ability to solve end-to-end learning systems, in which the features and the classifiers are learned simultaneously, providing significant improvements in classification accuracy in the presence of highly-structured and large databases.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“By definition, FL systems avoid sharing healthcare data among participating institutions.”
From The future of digital health with federated learning (2020) · cites this paper as [63]
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“It is therefore possible to reconstruct parts of the training data from the algorithm weights themselves on a decentralized node [52][53][54] .”
From Secure, privacy-preserving and federated machine learning in medical imaging (2020) · cites this paper as [54]
In the citing paper
“Attackers can recover data from gradients uploaded by customers [4].”
From Privacy-Preserving Blockchain-Based Federated Learning for IoT Devices (2021) · cites this paper as [4]
In the citing paper
“But their experiments confirmed that GAN-based approaches might not work well when the selected privacy parameter was smaller than 10 , which is the upper bound of privacy parameter in our experiment, and we can achieve the accuracy of 97% .”
From Privacy-Preserving Blockchain-Based Federated Learning for IoT Devices (2021) · cites this paper as [4]
In the citing paper
“There are studies discussing potential risks of information leakage in FL [4,66] in which attackers may infer customers' private data from gradients.”
From Privacy-Preserving Blockchain-Based Federated Learning for IoT Devices (2021) · cites this paper as [4]
In the citing paper
“Hitaj et al. [4] demonstrated that a curious server could obtain the confidential information using the generative adversarial network if gradients were protected by a large privacy budget in the collaborative learning.”
From Privacy-Preserving Blockchain-Based Federated Learning for IoT Devices (2021) · cites this paper as [4]
In the citing paper
“A combination of both previously cited defenses [60] identifies negatively impacting updates from clients.”
From Vulnerabilities in federated learning (2021) · cites this paper as [60]
In the citing paper
“The reason why gradients can cause privacy leakage is that the gradients are derived from the participants' private training data, and a learning model can be considered as a representation of the high-level statistics of the dataset it was trained on [75].”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [75]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
The Nature of Statistical Learning Theory
Vapnik, V. (2000) · Statistics for Engineering and Information Science · doi:10.1007/978-1-4757-3264-1 · Cited by 46,387
A logical calculus of the ideas immanent in nervous activity
McCulloch, W. S., & Pitts, W. (1943) · The Bulletin of Mathematical Biophysics · doi:10.1007/bf02478259 · Cited by 18,566
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381
Playing Atari with Deep Reinforcement Learning
Mnih, V., Kavukcuoglu, K., Silver, D., Graves, A., Antonoglou, I., Wierstra, D., & Riedmiller, M. (2013) · arXiv · doi:10.48550/arxiv.1312.5602 · Cited by 9,471
Learning Deep Architectures for AI
Bengio, Y. (2009) · Foundations and Trends® in Machine Learning · doi:10.1561/2200000006 · Cited by 7,330
Asynchronous Methods for Deep Reinforcement Learning
Mnih, V., Badia, A. P., Mirza, M., Graves, A., Lillicrap, T. P., Harley, T., Silver, D., & Kavukcuoglu, K. (2016) · arXiv · doi:10.48550/arxiv.1602.01783 · Cited by 7,132
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
DeepFace: Closing the Gap to Human-Level Performance in Face Verification
Taigman, Y., Yang, M., Ranzato, M., & Wolf, L. (2014) · 2014 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2014.220 · Cited by 6,542
Learning Deep Architectures for AI
Bengio, Y. (2009) · now publishers, Inc. eBooks · doi:10.1561/9781601982957 · Cited by 5,050
WaveNet: a generative model for raw audio
Oord, A. V. D., Dieleman, S., Zen, H., Simonyan, K., Vinyals, O., Graves, A., Kalchbrenner, N., Senior, A., & Kavukcuoglu, K. (2016) · arXiv · doi:10.48550/arxiv.1609.03499 · Cited by 4,911
Research works printed but not linked: 2
- Florian Tramèr Fan Zhang Ari Juels Michael K Reiter and Thomas Ristenpart 2016. Stealing Machine Learning Models via Prediction APIs USENIX Security.
- Weilin Xu, Yanjun Qi, and David Evans 2016. Automatically evading classifiers. In NDSS'16.
Cited by
Sorted by citations
Items 1,001–1,002 of 1,002
Person identity shift for privacy-preserving person re-identification
Dou, S., Jiang, X., Zhao, Q., Wang, Y., Li, D., & Zhao, C. (2026) · Science China Information Sciences · doi:10.1007/s11432-023-4583-x · Cited by 2
Quantifying and Localizing Usable Information Leakage from Neural Network Gradients
Mo, F., Borovykh, A., Malekzadeh, M., Demetriou, S., Gündüz, D., & Haddadi, H. (2021) · arXiv · doi:10.48550/arxiv.2105.13929 · Cited by 1
“These attacks are usually based on training some generative adversarial networks and optimizing an attack objective function [37], [7].”
Background
Metadata
- Authors
- Hitaj, B., Ateniese, G., & Perez-Cruz, F.
- Affiliations
- Stevens Institute of Technology (US)
- Stevens Institute of Technology, Hoboken, NJ, USA
- Venue
- Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2017-10-30
- Pages
- 603-618
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2591882872
- Semantic Scholar
- 44a97f4eaaefaf5338f8aed2913d5debb2459f7e
- Cited by
- 1,377
- References
- 16
- Citations by year
- 2026: 80 · 2025: 192 · 2024: 214 · 2023: 229 · 2022: 176 · 2021: 204 · 2020: 147 · 2019: 93 · 2018: 39 · 2017: 3
- FWCI
- 22.62
- Type
- conference paper
- Language
- en
- Open access
- green
- hdl.handle.net
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- IRIS Research product catalog (Sapienza University of Rome) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Generative Adversarial Networks and Image Synthesis
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Neural Network Applications
- Physical Sciences › Computer Science › Artificial Intelligence › Neural Networks and Applications
- Keywords
- generative adversarial networks, deep learning, end-to-end learning, representation learning, classifier training, structured data
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
