The DOI matches its Crossref record; 42 of the 42 references it cites were found in a registry or an index.
Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations
Open accessAbstract
With the growing adoption of machine learning, sharing of learned models is becoming popular. However, in addition to the prediction properties the model producer aims to share, there is also a risk that the model consumer can infer other properties of the training data the model producer did not intend to share. In this paper, we focus on the inference of global properties of the training data, such as the environment in which the data was produced, or the fraction of the data that comes from a certain class, as applied to white-box Fully Connected Neural Networks (FCNNs). Because of their complexity and inscrutability, FCNNs have a particularly high risk of leaking unexpected information about their training sets; at the same time, this complexity makes extracting this information challenging. We develop techniques that reduce this complexity by noting that FCNNs are invariant under permutation of nodes in each layer. We develop our techniques using representations that capture this invariance and simplify the information extraction task. We evaluate our techniques on several synthetic and standard benchmark datasets and show that they are very effective at inferring various data properties. We also perform two case studies to demonstrate the impact of our attack. In the first case study we show that a classifier that recognizes smiling faces also leaks information about the relative attractiveness of the individuals in its training set. In the second case study we show that a classifier that recognizes Bitcoin mining from performance counters also leaks information about whether the classifier was trained on logs from machines that were patched for the Meltdown and Spectre attacks.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“In order to better capture the level of confidence of the model, one may also sort the posteriors before the difference or concatenation operations [20].”
From When Machine Unlearning Jeopardizes Privacy (2021) · cites this paper as [20]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Adam: A Method for Stochastic Optimization
Kingma, D. P., & Ba, J. (2014) · arXiv · doi:10.48550/arxiv.1412.6980 · Cited by 98,946
Semi-supervised classification with graph convolutional networks
Kipf, T. N., & Welling, M. (2016) · arXiv · doi:10.48550/arxiv.1609.02907 · Cited by 24,853
FaceNet: A unified embedding for face recognition and clustering
Schroff, F., Kalenichenko, D., & Philbin, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298682 · Cited by 15,267
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280
A Stochastic Approximation Method
Robbins, H., & Monro, S. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729586 · Cited by 9,643
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
DeepFace: Closing the Gap to Human-Level Performance in Face Verification
Taigman, Y., Yang, M., Ranzato, M., & Wolf, L. (2014) · 2014 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2014.220 · Cited by 6,542
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
(2018) · Cited by 3,510
Research works printed but not linked: 9
- Amazon. 2018. Machine Learning at AWS. https://aws.amazon.com/machine-learning/ Retrieved August 15, 2018 from Amazon. 2018. Machine Learning at AWS. https://aws.amazon.com/machine-learning/ Retrieved August 15, 2018 from
- BigML Inc. 2018. BigML. https://bigml.com/ Retrieved August 15, 2018 from BigML Inc. 2018. BigML. https://bigml.com/ Retrieved August 15, 2018 from
- Eric Florenzano . 2016. Gadientzoo. https://www.gradientzoo.com/ Retrieved August 15, 2018 from Eric Florenzano. 2016. Gadientzoo. https://www.gradientzoo.com/ Retrieved August 15, 2018 from
- Google Cloud . 2018. Cloud Machine Learning Engine. https://cloud.google.com/ml-engine/ Retrieved August 15, 2018 from Google Cloud. 2018. Cloud Machine Learning Engine. https://cloud.google.com/ml-engine/ Retrieved August 15, 2018 from
- Jamie Hayes , Luca Melis , George Danezis , and Emiliano De Cristofaro . 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 ( 2017 ). Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). · arXiv
- Zhiqiang Lin , Xiangyu Zhang , and Dongyan Xu . 2010 . Automatic reverse engineering of data structures from binary execution . In Proceedings of the 11th Annual Information Security Symposium. CERIAS-Purdue University, 5. Zhiqiang Lin, Xiangyu Zhang, and Dongyan Xu. 2010. Automatic reverse engineering of data structures from binary execution. In Proceedings of the 11th Annual Information Security Symposium. CERIAS-Purdue University, 5.
- PyTorch core team. 2018. Pytorch . http://pytorch.org/ Retrieved August 15, 2018 from PyTorch core team. 2018. Pytorch. http://pytorch.org/ Retrieved August 15, 2018 from
- Perf Wiki . 2018. Linux profiling with performance counters. https://perf.wiki.kernel.org/index.php/Main_Page Retrieved August 15, 2018 from Perf Wiki. 2018. Linux profiling with performance counters. https://perf.wiki.kernel.org/index.php/Main_Page Retrieved August 15, 2018 from
- Manzil Zaheer Satwik Kottur Siamak Ravanbakhsh Barnabas Poczos Ruslan R Salakhutdinov and Alexander J Smola. 2017. Deep sets. In Advances in Neural Information Processing Systems. 3394--3404. Manzil Zaheer Satwik Kottur Siamak Ravanbakhsh Barnabas Poczos Ruslan R Salakhutdinov and Alexander J Smola. 2017. Deep sets. In Advances in Neural Information Processing Systems. 3394--3404.
Cited by
Sorted by citations
Items 201–300 of 471
SeqMIA: Sequential-Metric Based Membership Inference Attack
Li, H., Li, Z., Wu, S., Hu, C., Ye, Y., Zhang, M., Feng, D., & Zhang, Y. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690335 · Cited by 18
“Unfortunately, existing studies [15, 16, 50] have shown that ML models can leak private information about their training set.”
Fed-DFE: A Decentralized Function Encryption-Based Privacy-Preserving Scheme for Federated Learning
Habib, S., Kiani, G. I., Butt, M. F. U., Abbas, S. M., Aljohani, A. J., & Ng, S. X. (2021) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2022.022290 · Cited by 14
Machine Learning Based Resilience Testing of an Address Randomization Cyber Defense
Mani, G., Haliem, M., Bhargava, B., Manickam, I., Kochpatcharin, K., Kim, M., Vugrin, E. D., Wang, W., Jenkins, C., Angın, P., et al. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3234561 · Cited by 13
“Neural networks have been shown to be efficient in training and effective in classification for machine learning based attacks [59], [60], [61].”
BackgroundDifferentially Private Learning Does Not Bound Membership Inference.Preprint
Humphries, T., Rafuse, M., Tulloch, L., Oya, S., Goldberg, I., & Kerschbaum, F. (2020) · arXiv (Cornell University) · Cited by 13
An Empirical Evaluation of the Data Leakage in Federated Graph Learning
Chen, J., Ma, M., Ma, H., Zheng, H., & Zhang, J. (2023) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2023.3326359 · Cited by 16
“Although there have been many studies focusing on privacy leakage in other fields that use common models (like CNN, LSTM), these attack methods [24], [25] cannot be directly applied to FGL scenarios mainly because graph data has irregular network structure information.”
BackgroundLiu, T., Hu, X., Xu, H., Shu, T., & Nguyen, D. N. (2022) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2022.103309 · Cited by 12
Accuracy-Privacy Trade-off in Deep Ensemble: A Membership Inference Perspective
Rezaei, S., Shafiq, Z., & Liu, X. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179463 · Cited by 15
Deng, S., Zhang, J., Li, T., Jiang, X., & Wang, F. (2023) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2023.108986 · Cited by 13
Parisot, M., Pejó, B., & Spagnuelo, D. (2021) · International Conference on Security and Cryptography · doi:10.5220/0010555600002998 · Cited by 23
A Comprehensive Analysis of Information Leakage in Deep Transfer LearningPreprint
Chen, C., Wu, B., Qiu, M., Wang, L., & Zhou, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.01989 · Cited by 14
“Pioneer works of [2, 6, 7] conducted the property attacks that characterize the entire training dataset.”
BackgroundInfluentialCovert Channel Attack to Federated Learning Systems.Preprint
Costa, G., Pinelli, F., Soderi, S., & Tolomei, G. (2021) · arXiv (Cornell University) · Cited by 12
A new approach for cross-silo federated learning and its privacy risks
Fontana, M., Naretto, F., & Monreale, A. (2021) · Conference on Privacy, Security and Trust · doi:10.1109/pst52912.2021.9647753 · Cited by 12
Cryptographically Secure Private Record Linkage using Locality-Sensitive Hashing
Wei, R., & Kerschbaum, F. (2023) · Proceedings of the VLDB Endowment · doi:10.14778/3626292.3626293 · Cited by 11
Optimizing Privacy in Federated Learning with MPC and Differential Privacy
Zheng, C., Wang, L., Xu, Z., & Li, H. (2024) · Asia Conference on Algorithms, Computing and Machine Learning (CACML) · doi:10.1145/3654823.3654854 · Cited by 12
Decamouflage: A Framework to Detect Image-Scaling Attacks on CNN
Kim, B., Abuadbba, A., Gao, Y., Zheng, Y., Ahmed, M. E., Nepal, ., & Kim, H. (2021) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn48987.2021.00023 · Cited by 12
“Hence, significant research efforts have been directed to defeat the mainstream of adversarial attacks such as adversarial samples [6], [7], backdooring [8], [9], and inference [10], [11].”
BackgroundLiu, T., Hu, X., & Shu, T. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3237806 · Cited by 10
Hamida, S. B., Hamida, S. B., Snoun, A., Jemai, O., & Jemai, A. (2023) · Multimedia Tools and Applications · doi:10.1007/s11042-023-16126-x · Cited by 10
“…recent research has demonstrated that ML are prone to memorizing of training data information making them susceptible to a few privacy attacks, such us model extraction attacks [13], attribute inference attacks [26], property inference attacks [12] and membership inference attacks (MIA) [34].”
DGGI: Deep Generative Gradient Inversion with diffusion model
Wu, L., Liu, Z., Pu, B., Wei, K., Cao, H., & Yao, S. (2024) · Information Fusion · doi:10.1016/j.inffus.2024.102620 · Cited by 14
Analyzing Inference Privacy Risks Through Gradients In Machine Learning
Li, Z., Lowy, A., Liu, J., et al. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690304 · Cited by 11
“The majority of current literature on DIA [16, 30, 65, 85] is in the space of centralized learning, which captures leakage from model parameters.”
Federated Knowledge Recycling: Privacy-preserving synthetic data sharing
Lomurno, E., & Matteucci, M. (2025) · Pattern Recognition Letters · doi:10.1016/j.patrec.2025.02.030 · Cited by 10
Protect privacy of deep classification networks by exploiting their generative power
Chen, J., Guo, Y., Zheng, Q., & Chen, H. (2021) · Machine Learning · doi:10.1007/s10994-021-05951-6 · Cited by 10
“For example, attribute inference attacks aim to infer properties that should not be exposed to the public, such as background environment or gender information of a target in human face recognition systems.”
BackgroundMethodInfluentialSong, Y., Wei, F., Zhu, K., et al. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3215006 · Cited by 10
“Meanwhile, adversaries’ interference attacks [10], [11], [12], [13] against the detection model make the situation even worse.”
BackgroundChen, Z., Wu, J., Fu, A., Su, M., & Deng, R. H. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2023.110527 · Cited by 9
Disparate Vulnerability in Link Inference Attacks against Graph Neural Networks
Zhong, D., Yu, R., Wu, K., Wang, X., Xu, J. L., & Wang, H. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2023-0103 · Cited by 10
“Recent studies [34, 35] have shown that GNNs are vulnerable to several privacy attacks, such as model extraction attacks [61, 75], property inference attacks [26, 76], and membership inference attacks [34, 35, 54].”
BackgroundHP-MIA: A novel membership inference attack scheme for high membership prediction precision
Chen, S., Wang, W., Zhong, Y., Ying, Z., Tang, W., & Pan, Z. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103571 · Cited by 10
Neural networks memorise personal information from one sample
Hartley, J., Sanchez, P. P., Haider, F., & Tsaftaris, S. A. (2023) · Scientific Reports · doi:10.1038/s41598-023-48034-3 · Cited by 10
FLPM: A property modification scheme for data protection in federated learning
Xu, S., Xia, H., Liu, P., Zhang, R., Chi, H., & Gao, W. (2023) · Future Generation Computer Systems · doi:10.1016/j.future.2023.12.030 · Cited by 13
Multi-Agent Reinforcement Learning-Based Passenger Spoofing Attack on Mobility-as-a-Service
Chu, K.-F., & Guo, W. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3379283 · Cited by 11
Staged Noise Perturbation for Privacy-Preserving Federated Learning
Li, Z., Chen, H., Gao, Y., Ni, Z., Xue, H., & Shao, H. (2024) · IEEE Transactions on Sustainable Computing · doi:10.1109/tsusc.2024.3381812 · Cited by 11
Ding, H., Tian, Y., Peng, C., Zhang, Y., & Xiang, S. (2019) · Information Sciences · doi:10.1016/j.ins.2019.09.036 · Cited by 10
Recover User’s Private Training Image Data by Gradient in Federated Learning
Gong, H., Jiang, L., Liu, X., Wang, Y., Wang, L., & Zhang, K. (2022) · Sensors · doi:10.3390/s22197157 · Cited by 11
“Researchers [32] explore to infer properties of training data using the model parameters.”
BackgroundDistribution Inference Risks: Identifying and Mitigating Sources of Leakage
Hartmann, V., Meynent, L., Peyrard, M., Dimitriadis, D., Tople, S., & West, R. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00018 · Cited by 12
“bution inference (also called property inference) attacks [4], [14], [33], [39].”
BackgroundMethodInfluentialScionFL: Efficient and Robust Secure Quantized Aggregation
Ben-Itzhak, Y., Möllering, H., Benny Pinkas, B., Schneider, T. H., Suresh, A., Tkachenko, O., Vargaftik, S., Weinert, C., Yalame, H., & Yanai, A. (2024) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml59370.2024.00031 · Cited by 17
Attacking Graph-based Classification via Manipulating the Graph StructurePreprint
Wang, B., & Gong, N. Z. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1903.00553 · Cited by 10
“…examples [7,12,27,30,37,40,43,46,51,53,56, 68], poisoning attacks [8,18,31,38,67,70], privacy attacks for users (e.g., model inversion attacks [19,20], membership inference attacks [49,52], property inference attacks [3,21]), as well as model parameter and hyperparameter stealing attacks [60,61].”
BackgroundResultImage Obfuscation for Privacy-Preserving Machine LearningPreprint
Raynal, M., Achanta, R., & Humbert, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.10139 · Cited by 10
“In-ferring other information than the label is equivalent to property inference as defined in [7, 20, 48] but at the individual data level instead of aggregate.”
BackgroundLearned Parameter Compression for Efficient and Privacy-Preserving Federated Learning
Chen, Y., Abrahamyan, L., Hichem Sahli, B., & Deligiannis, N. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3409191 · Cited by 9
“Moreover, recent studies have shown that the sensitive information of user’s training data, such as gender and age, can still be inferred from the exchanged updates of model parameters [6], [7].”
BackgroundPrivacy Auditing in Differential Private Machine Learning: The Current Trends
Namatēvs, I., Sudars, K., Ņikuļins, A., & Ozols, K. (2025) · Applied Sciences · doi:10.3390/app15020647 · Cited by 14
FSRPCL: Privacy-Preserve Federated Social Relationship Prediction with Contrastive Learning
Liu, H., Li, N., Kou, H., et al. (2025) · Tsinghua Science & Technology · doi:10.26599/tst.2024.9010077 · Cited by 9
Nocerino, E. (2025) · Journal of Physics D Applied Physics · doi:10.1088/1361-6463/ae0344 · Cited by 12
“The first wave of ML applications in physics and materials science relied on fully connected neural networks for regression and classification tasks [371].”
FilterFL: Knowledge Filtering-based Data-Free Backdoor Defense for Federated Learning
Yang, Y., Hu, M., Xie, X., Cao, Y., Zhang, P., Huang, Y., & Chen, M. (2025) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3719027.3744883 · Cited by 11
Benabderrahmane, F., Kerkouche, E., & Bouchemal, N. (2025) · Applied Sciences · doi:10.3390/app16010029 · Cited by 9
Evaluating the Privacy Exposure of Interpretable Global Explainers
Naretto, F., Monreale, A., & Giannotti, F. (2022) · IEEE International Conference on Cognitive Machine Intelligence (CogMI) · doi:10.1109/cogmi56440.2022.00012 · Cited by 9
“…[8], [21], in which the goal of the attacker is to reconstruct one or more training samples and/or their respective training labels, property inference attacks [22], in which the goal is to extract information that the model learned unintentionally and hence are not explicitly encoded as features.”
BackgroundMa, H., Li, Q., Zheng, Y., Zhang, Z., Liu, X., Gao, Y., Al-Sarawi, S. F., & Abbott, D. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103406 · Cited by 14
Towards Privacy-Preserving Federated Neuromorphic Learning via Spiking Neuron Models
Han, B., Fu, Q., & Zhang, X. (2023) · Electronics · doi:10.3390/electronics12183984 · Cited by 9
Subject-Level Membership Inference Attack via Data Augmentation and Model Discrepancy
Liu, Y., Jiang, P., & Zhu, L. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3318950 · Cited by 10
“To better capture the level of confidence of the model, we sort both posteriors before the direct connection or difference [28].”
MethodEfficient Membership Inference Attacks against Federated Learning via Bias Differences
Zhang, L., Li, L., Li, X., et al. (2023) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3607199.3607204 · Cited by 9
“At present, inference attacks can be divided into three categories according to the purpose of the attack: attribute inference attacks [10], model inversion attacks [8] and membership inference attacks [15, 34, 36].”
BackgroundExploring Privacy and Fairness Risks in Sharing Diffusion Models: An Adversarial Perspective
Luo, X., Jiang, Y., Wei, F., Wu, Y., Xiao, X., & Ooi, B. C. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3453555 · Cited by 9
“For the property inference attack, it is worth noting that existing methods in the literature [21], [24] have mainly focused on inferring the presence of the target property in white-box settings, which significantly differ from our attacks.”
BackgroundMethodResultInfluentialTEE-based decentralized recommender systems: The raw data sharing redemption
Dhasade, A., Dresevic, N., Kermarrec, A.-M., & Pires, R. P. (2022) · IEEE International Parallel and Distributed Processing Symposium (IPDPS) · doi:10.1109/ipdps53621.2022.00050 · Cited by 9
“It has been shown that sharing model parameters across the network reveals some information about user profiles and yields privacy breaches [9]–[11].”
BackgroundNa, S. H., Hong, H. G., Kim, J., & Shin, S. (2022) · Annual Computer Security Applications Conference · doi:10.1145/3564625.3564657 · Cited by 10
“Although the server does not have direct access to the clients’ data, the model may leak information regarding membership or unseen attribute information [21, 44, 49, 56, 58].”
BackgroundDeep Quaternion Features for Privacy ProtectionPreprint
Zhang, H., Chen, Y.-T., Xiang, L., Ma, H., Shi, J., & Zhang, Q. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.08365 · Cited by 9
“Many works such as (Dosovitskiy & Brox, 2016; Zeiler & Fergus, 2014; Mahendran & Vedaldi, 2015; Shokri et al., 2017; Ganju et al., 2018; Melis et al., 2018; Zhang et al., 2019) have pointed out that, attackers can recover significant amount of sensitive input information from the intermediate-layer…”
BackgroundSecure Watermark for Deep Neural Networks with Multi-task LearningPreprint
Li, F., & Wang, S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.10021 · Cited by 9
“As an illustration of the security against watermark detection, we illustrated the property inference attack [15].”
BackgroundMethodInfluentialFEDL: Confidential Deep Learning for Autonomous Driving in VANETs Based on Functional Encryption
Tang, M., Huang, Z., & Deng, G. (2024) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2024.3454711 · Cited by 8
“Direct data submission to TCC for deep learning risks severe privacy breaches, enabling attackers to exploit this information for vehicle surveillance, tracking, and even launch further attacks [14].”
Hard-Label Cryptanalytic Extraction of Neural Network Models
Chen, Y., Dong, X., Guo, J., Shen, Y., Wang, A., & Wang, X. (2024) · Lecture notes in computer science · doi:10.1007/978-981-96-0944-4_7 · Cited by 14
Privacy Assessment of Federated Learning Using Private Personalized Layers
Jourdan, T., Boutet, A., & Frindel, C. (2021) · Machine learning for signal processing ... · doi:10.1109/mlsp52302.2021.9596237 · Cited by 9
FedVLN: Privacy-Preserving Federated Vision-and-Language Navigation
Zhou, K., & Wang, X. E. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-20059-5_39 · Cited by 13
Dissecting Distribution Inference
Suri, A., Lu, Y., Chen, Y., & Evans, D. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00019 · Cited by 12
“The main previous white-box distribution inference attacks are based on permutation-invariant networks [2].”
BackgroundMethodInfluentialPrivacy Leakage in Text Classification A Data Extraction Approach
Elmahdy, A., Inan, H. A., & Sim, R. (2022) · Workshop on Privacy in Natural Language Processing (PrivateNLP) · doi:10.18653/v1/2022.privatenlp-1.3 · Cited by 20
Introducing model inversion attacks on automatic speaker recognition
Pizzi, K., Boenisch, F., Şahin, U., & Böttinger, K. (2022) · Symposium on Security and Privacy in Speech Communication (SPSC) · doi:10.21437/spsc.2022-3 · Cited by 8
“However, recent research [2, 3, 4] suggests that ML models are, in general, vulnerable to privacy attacks.”
BackgroundExploring Model Inversion Attacks in the Black-box Setting
Dionysiou, A., Vassiliades, V., & Athanasopoulos, E. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2023-0012 · Cited by 8
“For example, a number of white-box MI attacks have been successfully conducted on a wide-range of targets [6, 19, 21, 55, 58, 62].”
BackgroundTheory-Oriented Deep Leakage from Gradients via Linear Equation Solver.Preprint
Pan, X., Zhang, M., Yan, Y., Zhu, J., & Yang, M. (2020) · arXiv (Cornell University) · Cited by 8
FaceLeaks: Inference Attacks against Transfer Learning Models via Black-box QueriesPreprint
Liew, S. P., & Takahashi, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.14023 · Cited by 7
“Similar to attribute inference, property inference is an attack that infers whether or not an model includes a particular property in the training inputs, such as the environment in which the data was produced [19].”
BackgroundAnalyze and Improve Differentially Private Federated Learning: A Model Robustness Perspective
Zhang, S., Huang, J., & Li, P. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3518058 · Cited by 8
DPlis: Boosting Utility of Differentially Private Deep Learning via Randomized Smoothing
Wang, W., Wang, T., Wang, L., Luo, N., Zhou, P., Song, D. X., & Jia, R. (2021) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2021-0065 · Cited by 12
“Additionally, model inversion attack can be further refined into property inference attack, where the attacker can speculate whether there is a certain statistical property in the training dataset [3, 18, 57].”
BackgroundLiu, T., Hu, X., & Shu, T. (2022) · IEEE International Conference on Sensing, Communication, and Networking (SECON) · doi:10.1109/secon55815.2022.9918550 · Cited by 7
“The authors in [14] designed a property inference attack on fully connected networks, in which the adversary trains a meta-classifier to classify the target classifier depending on whether it possesses the property of interest or not.”
BackgroundMILSA: Model Interpretation Based Label Sniffing Attack in Federated Learning
Manna, D., Kasyap, H., & Tripathy, S. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-23690-7_8 · Cited by 7
Manipulating Transfer Learning for Property Inference
Tian, Y., Suya, F., Suri, A., Xu, F., & Evans, D. M. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01533 · Cited by 9
“A possible reason for this is that the white-box attack mainly uses the fully-connected layers [12, 29] and hence, performs worse when the updatable downstream module also contains convolutional layers (adapting this attack to convolutional networks was not very successful).”
BackgroundMethodInfluential10 Security and Privacy Problems in Large Foundation Models
Jia, J., Liu, H., & Gong, N. Z. (2023) · Springer eBooks · doi:10.1007/978-3-031-42637-7_8 · Cited by 8
DAMIA: Leveraging Domain Adaptation as a Defense against Membership Inference AttacksPreprint
Huang, H., Luo, W., Zeng, G., Weng, J., Zhang, Y., & Yang, A. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.08016 · Cited by 7
“the security setting in DL, which has been widely discussed in previous efforts [7], [8], [9], [10].”
State-of-the-Art Approaches to Enhancing Privacy Preservation of Machine Learning Datasets: A SurveyPreprint
Zhang, C. (2024) · doi:10.36227/techrxiv.170956580.07799070/v1 · Cited by 21
Efficient Model Stealing Defense with Noise Transition Matrix
Wu, D., Fu, C., Wu, W., Xia, W., Zhang, X., Zhou, J., & Zhang, M.-L. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02294 · Cited by 10
“…property of MLaaS; (b) extracting confidential data through membership inference attacks [47], model inversion attack [6] and property inference attack [7]; (c) conducting adversarial attacks [31, 33, 35, 36, 49, 55] by creating malicious examples based on the white-box substitute model [42].”
BackgroundTaking Away Both Model and Data: Remember Training Data by Parameter Combinations
Luo, W., Zhang, L., Han, P., Liu, C., & Zhuang, R. (2022) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2022.3182415 · Cited by 7
“(cid:2) Property inference attack: is to infer confidential information about the training dataset which the model provider does not prefer to release [22].”
BackgroundDefending against membership inference attacks: RM Learning is all you need
Zhang, Z., Ma, J., Ma, X., Yang, R., Wang, X., & Zhang, J. (2024) · Information Sciences · doi:10.1016/j.ins.2024.120636 · Cited by 8
CrowdTransfer: Enabling Crowd Knowledge Transfer in AIoT Community
Liu, Y., Guo, B., Li, N., Ding, Y., Zhang, Z., & Yu, Z. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3423319 · Cited by 13
“For example, for the attribute inference attack [318], the attacker can infer the characteristics of the training dataset, including the age distribution, gender distribution,and other related features.”
Protecting Against Data Leakage in Federated Learning: What Approach Should You Choose?
Baracaldo, N., & Xu, R. (2022) · Springer eBooks · doi:10.1007/978-3-030-96896-0_13 · Cited by 6
SafeNet: The Unreasonable Effectiveness of Ensembles in Private Collaborative Learning
Chaudhari, H., Jagielski, M., & Oprea, A. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00021 · Cited by 8
“For this reason, we also consider adversaries seeking to learn information about data owners’ local datasets by observing the output of the model, as done in membership inference [17], [81], [94] and property inference attacks [39], [83], [97].”
BackgroundSecuring Federated GANs: Enabling Synthetic Data Generation for Health Registry Consortiums
Veeraragavan, N. R., & Nygård, J. F. (2023) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3600160.3605041 · Cited by 6
“In the near future, we plan to adapt our architecture to address the following privacy threats such as membership inference attacks [21], reconstruction attacks [25] and property inference attacks [9] within a decentralised setting.”
BackgroundAttesting Distributional Properties of Training Data for Machine Learning
Duddu, V., Das, A., Khayata, N., Yalame, H., Schneider, T. H., & Asokan, N. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-70879-4_1 · Cited by 6
Combing for Credentials: Active Pattern Extraction from Smart Reply
Jayaraman, B., Ghosh, E., Chase, M., Roy, S., Dai, W., & Evans, D. M. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00041 · Cited by 18
“Prior work has also investigated other leakage forms such as membership inference [45] in both vision and text domains [56], [34], [50], [46], [37], [42], [19], [43], [26], [31], [12], [7] and property inference [18], [59], [36].”
BackgroundDataset-Level Attribute Leakage in Collaborative Learning.Preprint
Zhang, W., Tople, S., & Ohrimenko, O. (2020) · arXiv (Cornell University) · Cited by 8
Quantifying Information Leakage from Gradients.Preprint
Mo, F., Borovykh, A., Malekzadeh, M., Haddadi, H., & Demetriou, S. (2021) · arXiv (Cornell University) · Cited by 6
Graves, L., Nagisetty, V., & Ganesh, V. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i13.17371 · Cited by 5
“Property inference attacks are a subset of membership inference attacks that determine a general property of the training data, such as the ratio of training examples in each class (Ganju et al. 2018).”
BackgroundDifferentially private federated learning with local momentum updates and gradients filtering
Zhang, S., Huang, J., Li, P., & Liang, C. (2024) · Information Sciences · doi:10.1016/j.ins.2024.120960 · Cited by 5
Revealing the Risk of Hyper-Parameter Leakage in Deep Reinforcement Learning Models
Du, L., Zhang, Z., Chen, M., Sun, M., Ji, S., Cheng, P., Chen, J., Michael Backes, A., & Zhang, Y. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3611881 · Cited by 5
“…[40], [60], [70]; (2) Reconstruction attacks aim to recover training samples or features [19], [57], [73], [86]; (3) Property inference extracts latent dataset-level attributes [15], [29], [45], [62]; (4) Model extraction builds surrogate models to replicate decision boundaries [31], [50], [64].”
Adversarial Machine Learning: A 20-Year Survey of Attacks, Defenses, and Standards
Tekeste, B., Al-Hussaeni, K., Fung, B. C. M., Alawadhi, I. M., & Fachkha, C. (2026) · IEEE Access · doi:10.1109/access.2026.3690620 · Cited by 7
Toward Scalable and Privacy-preserving Deep Neural Network via Algorithmic-Cryptographic Co-design
Zhou, J. W., Zheng, L., Chen, C., Wang, Y., Zheng, X., Wu, B., Chen, C., Wang, L., & Yin, J. (2022) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3501809 · Cited by 8
“, membership and property information [16, 34, 47]).”
MethodCui, Y., Meerza, S. I. A., Li, Z., Liu, L., Zhang, J., & Liu, J. (2023) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3579856.3582819 · Cited by 7
“This type of attack was first formulated in centralized learning against Hidden Markov Models (HMMs) and Support Vector Machine (SVM) classifiers [6] and then was extended to work on fully connected neural networks (FCNNs) [14] to determine whether the training data has a certain set of properties.”
BackgroundMethodComprehension from Chaos: Towards Informed Consent for Private Computation
Kacsmar, B., Duddu, V., Tilbury, K., Ur, B., & Kerschbaum, F. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623152 · Cited by 6
“For example, for a face recognition model this can be a picture of the recognized person.”
BackgroundOvi, P. R., & Gangopadhyay, A. (2024) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp48485.2024.10445809 · Cited by 5
Summary Statistic Privacy in Data Sharing
Lin, Z., Wang, S., Sekar, V., & Fanti, G. C. (2024) · IEEE Journal on Selected Areas in Information Theory · doi:10.1109/jsait.2024.3403811 · Cited by 7
“For example, property inference attacks allow an attacker to infer properties about the individuals in the training dataset of a released machine learning model [9], [10], [11], [12], [13].”
BackgroundFeng, S., Mohammady, M., Hong, H., Yan, S., Kundu, A., Wang, B., & Hong, Y. (2024) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3714393.3726517 · Cited by 8
Data Stealing Attack on Medical Images: Is It Safe to Export Networks from Data Lakes?
Li, H., Ayache, N., & Delingette, H. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-18523-6_3 · Cited by 5
Privacy-preserving spam filtering using homomorphic and functional encryption
Nguyen, T., Karunanayake, N., Wang, S., et al. (2022) · Computer Communications · doi:10.1016/j.comcom.2022.11.002 · Cited by 5
Tang, K., Li, P., Song, Y., & Luo, T. Y. (2022) · Machine Learning · doi:10.1007/s10994-022-06279-5 · Cited by 5
“These attack method were successfully performed on HMM, SVM models and the Neural Networks (Ateniese et al., 2015; Ganju et al., 2018).”
MethodAgnostic Label-Only Membership Inference Attack
Monreale, A., Naretto, F., & Rizzo, S. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-39828-5_14 · Cited by 5
Robustness Threats of Differential PrivacyPreprint
Tursynbek, N., Petiushko, A., & Oseledets, I. V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.07828 · Cited by 20
“Privacy attacks also include the learning global properties of private training data [20], inferring missing information using a model and incomplete information [19], obtaining meaningful data from models [3].”
BackgroundMansouri-Benssassi, E., Rogers, S., Smith, J., Ritchie, F., & Jefferson, E. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.05628 · Cited by 5
Research on Machine Unlearning Verification Based on Predictive Cross-Entropy
Yue, X., Peng, J., Liu, M., He, H., & Zhang, Y. (2024) · IEEE Smart World Congress (SWC) · doi:10.1109/swc62898.2024.00139 · Cited by 4
“However, the model ’ s unconscious retention of training data information makes them susceptible to various privacy attacks[5], including membership inference attacks[6], feature inference attacks[7], model inversion attacks, and model extraction attacks[8].”
ProVFL: Property Inference Attacks Against Vertical Federated Learning
Bai, L., Zhang, X., Zhang, S., Ye, Q., & Hu, H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3581743 · Cited by 4
QueryCheetah: Fast Automated Discovery of Attribute Inference Attacks Against Query-Based Systems
Stevanoski, B., Creţu, A.-M., & de Montjoye, Y.-A. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690272 · Cited by 4
Casella, B. (2025) · Euromicro International Conference on Parallel, Distributed and Network-Based Processing (PDP) · doi:10.1109/pdp66500.2025.00035 · Cited by 6
Metadata
- Authors
- Ganju, K., Wang, Q., Yang, W., Gunter, C. A., & Borisov, N.
- Affiliations
- University of Illinois Urbana-Champaign (US)
- The University of Texas at Dallas (US)
- Venue
- Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2018-10-15
- Pages
- 619-633
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2897830718
- Semantic Scholar
- 490c30b1d6b680be3c5a13552073e4fc10a850dc
- Cited by
- 475
- References
- 37
- Citations by year
- 2026: 27 · 2025: 58 · 2024: 89 · 2023: 98 · 2022: 74 · 2021: 69 · 2020: 39 · 2019: 19 · 2018: 2
- FWCI
- 13.11
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- U.S. Department of Energy (DE-OE0000780)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- property inference attacks, fully connected neural network, permutation invariance, training data leakage, white-box attacks, model sharing, performance counters
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
