The DOI matches its Crossref record; 42 of the 42 references it cites were found in a registry or an index.
Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations
Open accessAbstract
With the growing adoption of machine learning, sharing of learned models is becoming popular. However, in addition to the prediction properties the model producer aims to share, there is also a risk that the model consumer can infer other properties of the training data the model producer did not intend to share. In this paper, we focus on the inference of global properties of the training data, such as the environment in which the data was produced, or the fraction of the data that comes from a certain class, as applied to white-box Fully Connected Neural Networks (FCNNs). Because of their complexity and inscrutability, FCNNs have a particularly high risk of leaking unexpected information about their training sets; at the same time, this complexity makes extracting this information challenging. We develop techniques that reduce this complexity by noting that FCNNs are invariant under permutation of nodes in each layer. We develop our techniques using representations that capture this invariance and simplify the information extraction task. We evaluate our techniques on several synthetic and standard benchmark datasets and show that they are very effective at inferring various data properties. We also perform two case studies to demonstrate the impact of our attack. In the first case study we show that a classifier that recognizes smiling faces also leaks information about the relative attractiveness of the individuals in its training set. In the second case study we show that a classifier that recognizes Bitcoin mining from performance counters also leaks information about whether the classifier was trained on logs from machines that were patched for the Meltdown and Spectre attacks.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“In order to better capture the level of confidence of the model, one may also sort the posteriors before the difference or concatenation operations [20].”
From When Machine Unlearning Jeopardizes Privacy (2021) · cites this paper as [20]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Adam: A Method for Stochastic Optimization
Kingma, D. P., & Ba, J. (2014) · arXiv · doi:10.48550/arxiv.1412.6980 · Cited by 98,946
Semi-supervised classification with graph convolutional networks
Kipf, T. N., & Welling, M. (2016) · arXiv · doi:10.48550/arxiv.1609.02907 · Cited by 24,853
FaceNet: A unified embedding for face recognition and clustering
Schroff, F., Kalenichenko, D., & Philbin, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298682 · Cited by 15,267
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280
A Stochastic Approximation Method
Robbins, H., & Monro, S. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729586 · Cited by 9,643
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
DeepFace: Closing the Gap to Human-Level Performance in Face Verification
Taigman, Y., Yang, M., Ranzato, M., & Wolf, L. (2014) · 2014 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2014.220 · Cited by 6,542
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
(2018) · Cited by 3,510
Flagged first, then by citations
Research works printed but not linked: 9
- Amazon. 2018. Machine Learning at AWS. https://aws.amazon.com/machine-learning/ Retrieved August 15, 2018 from Amazon. 2018. Machine Learning at AWS. https://aws.amazon.com/machine-learning/ Retrieved August 15, 2018 from
- BigML Inc. 2018. BigML. https://bigml.com/ Retrieved August 15, 2018 from BigML Inc. 2018. BigML. https://bigml.com/ Retrieved August 15, 2018 from
- Eric Florenzano . 2016. Gadientzoo. https://www.gradientzoo.com/ Retrieved August 15, 2018 from Eric Florenzano. 2016. Gadientzoo. https://www.gradientzoo.com/ Retrieved August 15, 2018 from
- Google Cloud . 2018. Cloud Machine Learning Engine. https://cloud.google.com/ml-engine/ Retrieved August 15, 2018 from Google Cloud. 2018. Cloud Machine Learning Engine. https://cloud.google.com/ml-engine/ Retrieved August 15, 2018 from
- Jamie Hayes , Luca Melis , George Danezis , and Emiliano De Cristofaro . 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 ( 2017 ). Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). · arXiv
- Zhiqiang Lin , Xiangyu Zhang , and Dongyan Xu . 2010 . Automatic reverse engineering of data structures from binary execution . In Proceedings of the 11th Annual Information Security Symposium. CERIAS-Purdue University, 5. Zhiqiang Lin, Xiangyu Zhang, and Dongyan Xu. 2010. Automatic reverse engineering of data structures from binary execution. In Proceedings of the 11th Annual Information Security Symposium. CERIAS-Purdue University, 5.
- PyTorch core team. 2018. Pytorch . http://pytorch.org/ Retrieved August 15, 2018 from PyTorch core team. 2018. Pytorch. http://pytorch.org/ Retrieved August 15, 2018 from
- Perf Wiki . 2018. Linux profiling with performance counters. https://perf.wiki.kernel.org/index.php/Main_Page Retrieved August 15, 2018 from Perf Wiki. 2018. Linux profiling with performance counters. https://perf.wiki.kernel.org/index.php/Main_Page Retrieved August 15, 2018 from
- Manzil Zaheer Satwik Kottur Siamak Ravanbakhsh Barnabas Poczos Ruslan R Salakhutdinov and Alexander J Smola. 2017. Deep sets. In Advances in Neural Information Processing Systems. 3394--3404. Manzil Zaheer Satwik Kottur Siamak Ravanbakhsh Barnabas Poczos Ruslan R Salakhutdinov and Alexander J Smola. 2017. Deep sets. In Advances in Neural Information Processing Systems. 3394--3404.
Cited by
Sorted by citations
Items 301–400 of 471
Privacy attack in federated learning is not easy: an experimental study
Zhu, H., Huang, L., & Xie, Z. (2025) · Complex & Intelligent Systems · doi:10.1007/s40747-025-02009-1 · Cited by 6
“On the other hand, image data, being continuous and high-dimensional, relies heavily on the spatial relationships between pixels, with each pixel serving as a distinct feature.”
Exploring Clustered Federated Learning’s Vulnerability against Property Inference Attack
Kim, H., Cho, Y., Lee, Y., Bae, H., & Paek, Y. (2023) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3607199.3607218 · Cited by 6
“Among these attacks, our focus is on the property inference attack (PIA), which seeks to extract unintended property information from a model trained for a specific task [5, 18, 19].”
BackgroundFDRP: federated deep relationship prediction with sequential information
Liu, H., Li, N., Kou, H., et al. (2023) · Wireless Networks · doi:10.1007/s11276-023-03530-2 · Cited by 4
“However, if the model updates and gradients sent to the server contain sufficient information, an attacker could potentially deduce the original data information [38], raising concerns about data security.”
Mitigating Membership Inference Attacks via Weighted Smoothing
Tan, M., Xie, X., Sun, J., & Wang, T. (2023) · Annual Computer Security Applications Conference · doi:10.1145/3627106.3627189 · Cited by 4
Verification of Neural Networks’ Local Differential Classification Privacy
Reshef, R., Kabaha, A., Seleznova, O., & Drachsler-Cohen, D. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-50521-8_5 · Cited by 4
Transpose Attack: Stealing Datasets with Bidirectional Training
Amit, G., Levy, M. Y., & Mirsky, Y. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.23325 · Cited by 12
FSRPCL: Privacy-preserve federated social relationship prediction with contrastive learning
Liu, H., Li, N., Kou, H., et al. (2024) · Tsinghua Science & Technology · doi:10.26599/tst.2024.90100xx · Cited by 4
Smart contract assisted secure aggregation scheme for model update in federated learning
Caihong, W., & Liu, J. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110542 · Cited by 5
Ahmadzai, M., & Nguyen, G. (2024) · Future Internet · doi:10.3390/fi16070220 · Cited by 4
“[28] Property Inference on FCNNs [29] Hacking Smart Machines 4 [30] Cache Telepathy Inference attacks of parameters: steals model parameters.”
BackgroundCorrelation inference attacks against machine learning models
Creţu, A.-M., Guépin, F., & de Montjoye, Y.-A. (2024) · Science Advances · doi:10.1126/sciadv.adj9260 · Cited by 4
“[16] showed that extending this attack to multilayer perceptrons (MLP) is more challenging due to their permutation equivalence property and propose to use weight-based neuron sorting and set-based meta-classifiers which we use in our white-box experiments on MLPs.”
BackgroundMethodInfluentialMatryoshka: Exploiting the Over-Parametrization of Deep Learning Models for Covert Data Transmission
Pan, X., Zhang, M., Yan, Y., Zhang, S., & Yang, M. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3434417 · Cited by 7
Data Leakage Attack via Backdoor Misclassification Triggers of Deep Learning Models
Yang, X., Luo, W., Zhang, L., Chen, Z., & Wang, J. (2022) · International Conference on Data Intelligence and Security (ICDIS) · doi:10.1109/icdis55630.2022.00017 · Cited by 5
“Some attack methods threaten the data privacy of data holders, such as the membership inference attack [4]–[7], the model inversion attack [4], [8], [9], and the property inference attack [9]–[11].”
BackgroundCompromise Privacy in Large-Batch Federated Learning via Malicious Model Parameters
Zhang, S., Huang, J., Zhang, Z., & Qi, C. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-22677-9_4 · Cited by 5
Compromise privacy in large-batch Federated Learning via model poisoning
Zhang, S., Huang, J., Zhang, Z., Li, P., & Qi, C. (2023) · Information Sciences · doi:10.1016/j.ins.2023.119421 · Cited by 6
Private Deep Neural Network Models Publishing for Machine Learning as a Service
Mao, Y., Zhu, B., Hong, W., Zhu, Z., Zhang, Y., & Zhong, S. (2020) · International Workshop on Quality of Service · doi:10.1109/iwqos49365.2020.9212853 · Cited by 4
“Generally, once the whole DNN model is published, any client who is granted to access the model could be an adversary and is capable of performing arbitrary computation on model parameters including some serious white-box attacks which have been reported in [7], [10], [11], [19].”
BackgroundQuantifying (Hyper) Parameter Leakage in Machine Learning
Duddu, V., & Rao, D. V. (2020) · IEEE International Conference on Multimedia Big Data · doi:10.1109/bigmm50055.2020.00041 · Cited by 4
“Alternatively, an adversary can infer attributes of training data which can further result in reconstruction attacks [15].”
BackgroundReconciling Utility and Membership Privacy via Knowledge Distillation.Preprint
Shejwalkar, V., & Houmansadr, A. (2019) · arXiv (Cornell University) · Cited by 7
Model Extraction and Defenses on Generative Adversarial NetworksPreprint
Hu, H., & Pang, J. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2101.02069 · Cited by 4
“In addition to model extract attacks, there are other types of attacks in relation to privacy and security [9, 21, 67], such as membership inference attacks [12, 19, 55, 58, 59] and property inference attacks [17].”
BackgroundPrivacy Inference Attacks and Defenses in Cloud-based Deep Neural Network: A SurveyPreprint
Zhang, X., Chen, C., Xie, Y., Chen, X., Zhang, J., & Xiang, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.06300 · Cited by 4
“Whereas, both [33] and [146] investigated inferring the global property of the training set from the trained model.”
BackgroundMethodSource Inference Attacks in Federated LearningPreprint
Hu, H., Salcic, Z. A., Sun, L., Dobbie, G., & Zhang, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.05659 · Cited by 4
“Location, Purchase, CHMNIST, MNIST, and CIFAR-10 are realistic datasets which are widely used for evaluating privacy leakage on ML models [30, 14, 8, 37].”
BackgroundGI-NAS: Boosting Gradient Inversion Attacks Through Adaptive Neural Architecture Search
Yu, W., Hao, F., Chen, B., Sui, X., Chen, C., Wu, H., Xia, S., & Xu, K. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3589127 · Cited by 9
“Early works [5], [6], [7], [8] involve inferring the existence of certain samples in the dataset (i.e., Membership Inference Attacks [14]) or further revealing some properties of the private training set (i.e., Property Inference Attacks [15]) from the uploaded gradients.”
FedShieldLLM: Measurement, Detection and Protection of Privacy Leakage in Federated LLMs
Sun, W., Wang, X., Liang, Z., Chen, J., Lan, W., Chen, Y., & Wang, F. (2026) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2026.3657229 · Cited by 3
“A different yet potent category is property inference attacks [21], [22], which focus on extracting statistical attributes of the training data, such as user demographics or stylistic features, without recovering individual records.”
A Stealthy Inference Attack on Split Learning with a Split-Fuse Defensive Measure
Dougherty, S., Kumar, A., Hou, J., Tourani, R., & Tabakhi, A. M. (2023) · IEEE Conference on Communications and Network Security · doi:10.1109/cns59707.2023.10288661 · Cited by 3
“Different from recent works [17], [26], [27], our attack targets the live inference data that clients provide during the inference phase.”
BackgroundFind the Lady: Permutation and Re-synchronization of Deep Neural Networks
Trias, C. D. S., Mitrea, M., Fiandrotti, A., et al. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i19.30091 · Cited by 3
Liu, H., Qu, W., Jia, J., & Gong, N. Z. (2024) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw63631.2024.00019 · Cited by 5
“For privacy, an attacker can leverage various inference attacks such as model inversion attacks [28], membership inference attacks [51], and property inference attacks [6], [29] to infer sensitive information about a classifier’s training data.”
BackgroundJia, J., Wang, B., & Gong, N. Z. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3437519 · Cited by 4
“Existing property inference attacks [4, 16] re-”
BackgroundMethodInfluentialKD‐GAN: An effective membership inference attacks defence framework
Zhang, Z., Lin, G., Ke, L., Peng, S., Hu, L. F., & Yan, H. (2022) · International Journal of Intelligent Systems · doi:10.1002/int.23021 · Cited by 3
Capacity Abuse Attack of Deep Learning Models Without Need of Label Encodings
Luo, W., Zhang, L., Wu, Y., Liu, C., Han, P., & Zhuang, R. (2023) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2023.3266419 · Cited by 3
“Ganju et al. [24] considered the problem of property inference attacks in the fully connected neural network model.”
BackgroundFederated Learning on Transcriptomic Data: Model Quality and Performance Trade-Offs
Hannemann, A., Ewald, J., Seeger, L., & Buchmann, E. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-63772-8_26 · Cited by 3
A Performance Analysis for Confidential Federated Learning
Casella, B., Colonnelli, I., Mittone, G., Birke, R., Riviera, W., Sciarappa, A., Cavazzoni, C., & Aldinucci, M. (2024) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw63631.2024.00009 · Cited by 3
“Property inference attacks [7] want to infer a global private property of the data.”
BackgroundDandapat, S., Sahu, N., Azad, C., et al. (2024) · doi:10.1109/apci61480.2024.10616636 · Cited by 3
“Layers in between the input layer and output layer are known as hidden layers [13].”
BackgroundDo Backdoors Assist Membership Inference Attacks?
Goto, Y., Ashizawa, N., Shibahara, T., & Yanai, N. (2024) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-64954-7_13 · Cited by 3
Decaf: Data Distribution Decompose Attack Against Federated Learning
Dai, Z., Gao, Y., Zhou, C., Fu, A., Zhang, Z., Xue, M., Zheng, Y., & Zhang, Y. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3516545 · Cited by 4
Towards privacy aware deep learning for embedded systems
Duddu, V., Boutet, A., & Shejwalkar, V. (2022) · ACM Symposium on Applied Computing · doi:10.1145/3477314.3507128 · Cited by 4
Exploration of Membership Inference Attack on Convolutional Neural Networks and Its Defenses
Yao, Y. (2022) · International Conference on Image Processing, Computer Vision and Machine Learning (ICICML) · doi:10.1109/icicml57342.2022.10009850 · Cited by 3
Bitton, R., Maman, N., Singh, I., Momiyama, S., Elovici, Y., & Shabtai, A. (2021) · arXiv (Cornell University) · Cited by 3
Anti-Neuron Watermarking: Protecting Personal Data Against Unauthorized Neural Model Training.Preprint
Zou, Z., Gong, B., & Wang, L. (2021) · arXiv (Cornell University) · Cited by 3
Zhou, X., Liu, C., Zhang, Z., et al. (2025) · Chinese Journal of Chemical Engineering · doi:10.1016/j.cjche.2025.02.003 · Cited by 2
Security of Approximate Neural Networks against Power Side-channel Attacks
Japa, A., Miskelly, J., O'Neill, M. P., et al. (2025) · Proceedings - ACM IEEE Design Automation Conference · doi:10.1109/dac63849.2025.11133333 · Cited by 2
Dual Dependency Disentangling for Defending Model Inversion Attacks in Split Federated Learning
Chen, T., Wang, J., Zhao, J., Du, B., Wang, H., Bai, X., Zheng, L. L., & Liu, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3621008 · Cited by 2
“…attacks [41], [42], [43], [44], [45] that aim to identify whether a specific data sample was used during the training, property inference attacks [46], [47], [48] that seek to infer properties of the training dataset, and Model Inversion (MI) attacks [17], [18], [19], [20], [49], [50] that aim…”
Lightweight Techniques for Federated Anomaly Detection in Log Data
Pustozerova, A., Gómez, A. G., Landauer, M., Wurzenberger, M., Skopik, F., Weippl, E. R., Mayer, R. L., & Ekelhart, A. (2026) · IEEE Transactions on Reliability · doi:10.1109/tr.2026.3677674 · Cited by 2
“…updates or weights are exchanged during FL and are considered low risk , however, model parameters still encode characteristics of the training data and can leak potentially sensitive information through attacks such as membership inference [53], model inversion [13], or property inference [14].”
Inference Attacks and Counterattacks in Federated Learning
Yu, S., & Cui, L. (2022) · Digital Privacy and Security · doi:10.1007/978-981-19-8692-5_2 · Cited by 2
Towards Benchmarking Privacy Risk for Differential Privacy: A Survey
Prokhorenkov, D., & Cao, Y. (2023) · ACM International Conference on Systems for Energy-Efficient Buildings, Cities, and Transportation (BuildSys) · doi:10.1145/3600100.3625373 · Cited by 2
GanNoise: Defending against black-box membership inference attacks by countering noise generation
Liang, J., Huang, T., Luo, Z., Li, D., Li, Y., & Ding, Z. (2023) · International Conference on Data Security and Privacy Protection (DSPP) · doi:10.1109/dspp58763.2023.10405019 · Cited by 3
“This renders them vulnerable to a range of privacy attacks, including but not limited to attribute inference attacks [11], dataset reconstruction attacks [12], and membership inference attacks (MIA) [9].”
BackgroundSoK: Unintended Interactions among Machine Learning Defenses and Risks
Duddu, V., Szyller, S., & Asokan, N. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00243 · Cited by 7
“P4 Distribution inference (aka property inference) infers properties of the distribution from which D tr was sampled [9], [58], [118], [157], [205].”
BackgroundBlack-Box Reconstruction Attacks on LLMs: A Preliminary Study in Code Summarization
Russodivito, M., Spina, A., Scalabrino, S., et al. (2024) · Communications in computer and information science · doi:10.1007/978-3-031-70245-7_27 · Cited by 2
Two-Stage Client Selection Scheme for Blockchain-Enabled Federated Learning in IoT
Jin, X., Ma, C., Luo, S., Zeng, P., & Wei, Y. (2024) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2024.055344 · Cited by 2
PIAFGNN: Property Inference Attacks against Federated Graph Neural Networks
Liu, J., Xue, B., Guo, M., Xu, Y., & Chen, B. (2024) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2024.057814 · Cited by 2
A Secure Aggregation Scheme for Model Update in Federated Learning
Wang, B., Hu, C., & Liu, Z. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-19208-1_41 · Cited by 2
A Hitchhiker’s Guide to White-Box Neural Network Watermarking Robustness
Trias, C. D. S., Mitrea, M., Tartaglione, E., et al. (2023) · European Workshop on Visual Information Processing · doi:10.1109/euvip58404.2023.10323067 · Cited by 2
“The preliminary solution presented in [11] was not designed to be effective when supplementary operations ( e.g. fine-tuning) are applied on the permuted neurons, while [9] targets the specification of a generic counterattack against the permutation.”
BackgroundTP-NET: Training Privacy-Preserving Deep Neural Networks under Side-Channel Power Attacks
Hu, H., Gegax-Randazzo, J., Carper, C., et al. (2022) · IEEE International Symposium on Smart Electronic Systems (iSES) · doi:10.1109/ises54909.2022.00095 · Cited by 2
“In recent years, different privacy attack techniques associated with DNNs have been proposed, such as adversarial attacks [10], model extraction attacks [6], [7], [11], and data privacy inference attacks [12], [13].”
BackgroundPreventing Information Leakage with Neural Architecture Search.Preprint
Zhang, S., Xiang, L., Li, C., Wang, Y., Liu, Z., Zhang, Q., & Li, B. (2019) · arXiv (Cornell University) · Cited by 2
GECKO: Reconciling Privacy, Accuracy and Efficiency in Embedded Deep LearningPreprint
Duddu, V., Boutet, A., & Shejwalkar, V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.00912 · Cited by 4
Decamouflage: A Framework to Detect Image-Scaling Attacks on Convolutional Neural NetworksPreprint
Kim, B., Abuadbba, A., Gao, Y., Zheng, Y., Ahmed, M. E., Kim, H., & Nepal, . (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.03735 · Cited by 2
“us adversarial attacks. Hence, significant research efforts have been directed to defeat the main stream of adversarial attacks such as adversarial samples [4, 24], backdooring [7, 15], and inference [5, 13]. Xiao et al. [27] introduced a new attack called image-scaling attack(alsoreferredtoascamouflageattack)thatpote…”
BackgroundKazim, E., Polle, R., Carvalho, G., Koshiyama, A., Inness, C., Knight, A., Gorski, C., Barber, D., Lomas, E., Yılmaz, E., et al. (2021) · SSRN Electronic Journal · doi:10.2139/ssrn.3935987 · Cited by 2
Federated Learning of Artificial Neural Networks
Kiss, P. T. (2022) · Eötvös Loránd Tudományegyetem · doi:10.15476/elte.2021.124 · Cited by 2
Adversarial and Generative Deep Learning for Data Privacy in Human-Centered Artificial IntelligencePreprint
Lomurno, E. (2025) · doi:10.31224/4629 · Cited by 2
Evaluating the Impact of Adversarial Factors on Membership Inference Attacks
Niu, B., Sun, J., Chen, Y., Zhang, L., Cao, J. P., Geng, K., & Li, F. (2023) · IEEE Smart World Congress (SWC) · doi:10.1109/swc57546.2023.10448806 · Cited by 1
“For instance, adversaries could launch the model inversion attacks [1], [2], [3], property inference attacks [4], [5], [6], and membership inference attacks [7], [8], [9] to infer the sensitive information about model’s parameter and training dataset.”
BackgroundDealSecAgg: Efficient Dealer-Assisted Secure Aggregation for Federated Learning
Stock, J., Heitmann, H., Schug, J. N., & Demmler, D. (2024) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3664476.3670873 · Cited by 3
SelTZ: Fine-Grained Data Protection for Edge Neural Networks Using Selective TrustZone Execution
Jeong, S., & Oh, H. (2024) · Electronics · doi:10.3390/electronics14010123 · Cited by 1
Tang, L., & Joshi, J. (2024) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa62245.2024.00040 · Cited by 2
The Bell-LaPadula (BLP) Enterprise Security Architecture Model vs Inference Attacks
Ayamga, D., Nanda, P., & Mohanty, M. (2024) · International Conference on Security of Information and Networks (SIN) · doi:10.1109/sin63213.2024.10871247 · Cited by 1
“[32] [16] [34] Poisoning inference attack is a form of MIA that occurs when a foe poisons certain portions of the training dataset to behave in a pattern of interest to the adversary.”
Chen, S., Liu, J., Li, Y., Li, Y., Yang, Y., Liu, G., & Wang, C. (2024) · IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA) · doi:10.1109/ispa63168.2024.00115 · Cited by 2
“One approach to exact unlearning involves fully reinitial-izing the model and subsequently retraining it using data from the remaining clients [15].”
Do Fairness Interventions Come at the Cost of Privacy: Evaluations for Binary Classifiers
Tian, H., Zhang, G., Liu, B., Zhu, T., Ding, M., & Zhou, W. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3551157 · Cited by 1
“These attacks share similarities with MIAs, particularly in how some AIA methods exploit prediction gaps between different sub-groups to infer attribute information, as demonstrated by Yeom et al. and Ganju et al. [60], [61].”
Jiménez-López, D., Rodríguez-Barroso, N., Luzón, M. V., Ser, J. D., & Herrera, F. (2025) · Machine Learning and Knowledge Extraction · doi:10.3390/make7020043 · Cited by 2
CGGL: A client-side generative gradient leakage attack with double diffusion prior
Pu, B., Liu, Z., Wu, L., Xu, K., Liang, B., He, Z., Ma, B., & Zhao, L. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103292 · Cited by 3
Trustworthiness in Vision-Language Models
Vu, K., & Lai, P. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-6389-7_7 · Cited by 1
Advanced Privacy Protection in Federated Learning using Server-initiated Homomorphic Encryption
Lee, C., Daggitt, M. L., Gao, Y., & Hong, J. B. (2025) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3746252.3761144 · Cited by 1
Privacy-Preserving Explainable AIoT Application via SHAP Entropy Regularization
Sharma, D. P., Sun, X., Xue, L., Lin, X., & Xiong, P. (2025) · IEEE Annual Congress on Artificial Intelligence of Things (AIoT) · doi:10.1109/aiot66900.2025.00046 · Cited by 2
“• Property inference attack [12]: This attack targets the extraction of global statistical characteristics of the training data, such as dominant appliance usage patterns or occupancy trends, revealing sensitive aggregate information.”
He, P., & Joshi, J. B. D. (2025) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa67132.2025.00013 · Cited by 2
“Privacy Threats: Membership, inversion, and property inference attacks exploit shared gradients to uncover private training data [57]–[59].”
Counterfactual Adversarial Examples for Mitigating Privacy Risk in Adversarially Robust Models
Sun, A., Lu, Y., Yang, W., & Zhang, J. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-5716-5_21 · Cited by 1
Self-citationMiao, Q., Sun, W. Y., Zhu, D., Li, J., Zhou, Y., & Alcaraz, C. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3656886 · Cited by 2
“Meanwhile, [15] demonstrated through experiments that training hyperparameters can affect the success of attacks, meaning clients may face varying levels of privacy leakage risks.”
A Hypothesis Testing Approach to Sharing Logs with Confidence
Long, Y., Xu, L., & Gunter, C. A. (2020) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3374664.3375743 · Cited by 1
“Our dataset [14] includes 22 different hardware counters (i.”
MethodSelf-citationMacro-level Inference in Collaborative Learning
Mayer, R. L., & Ekelhart, A. (2022) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3508398.3519361 · Cited by 1
“A similar technique is used in [6] to infer training set properties from fully connected neural networks.”
MethodEmpirical study of privacy inference attack against deep reinforcement learning models
Zhou, H., Mo, K., Huang, T., & Li, Y. (2023) · Connection Science · doi:10.1080/09540091.2023.2211240 · Cited by 1
“For example, membership inference attacks (Shokri et al., 2017) allow querying a model to determine whether a sample is in the training set, and (Ganju et al., 2018) present an inference attack to extract dataset attributes.”
BackgroundLi, Y., & Li, B. (2023) · International Conference on Networks, Communications and Information Technology (CNCIT) · doi:10.1145/3605801.3605820 · Cited by 1
“Several research studies [5, 7, 15, 18, 19, 21] have highlighted these risks in recent years.”
BackgroundA Cautionary Tale: On the Role of Reference Data in Empirical Privacy Defenses
Kaplan, C., Xu, C., Marfoq, O., Neglia, G., & de Oliveira, A. S. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2024-0031 · Cited by 5
SODA: Protecting Proprietary Information in On-Device Machine Learning Models
Atrey, A., Sinha, R., Mitra, S., et al. (2023) · ACM/IEEE Symposium on Edge Computing (SEC) · doi:10.1145/3583740.3626617 · Cited by 1
Enhanced Privacy Protection in Graph Neural Networks Using Local Differential Privacy
Yu, J., Li, Y. H., Wen, M., et al. (2024) · IEEE International Conference on Software Quality, Reliability and Security (QRS) · doi:10.1109/qrs62785.2024.00050 · Cited by 1
Katzav, R., Giloni, A., Grolman, E., et al. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73226-3_17 · Cited by 1
Fundamentals of privacy-preserving and secure machine learning
Akram, A., Zimmer, P., Gritti, C., Karame, G., & Önen, M. (2025) · Elsevier eBooks · doi:10.1016/b978-0-44-323761-4.00031-6 · Cited by 1
SnatchML: Hijacking ML Models Without Training Access
Ghorbel, M., Bouzidi, H., Bilasco, I. M., et al. (2025) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml64287.2025.00013 · Cited by 1
An Efficient Epsilon Selection Method for DP-ERM with Expected Accuracy Constraints
Li, Y., Li, B., Wang, W., & Liu, N. (2022) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom56396.2022.00079 · Cited by 1
Rotation-Equivariant Neural Networks for Privacy ProtectionPreprint
Zhang, H., Chen, Y.-T., Ma, H., Xu, C., Ren, Q., Xiang, L., Shi, J., & Zhang, Q. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.13016 · Cited by 3
“Many researches [3, 4, 15, 16, 20, 25, 28] have pointed out that, attackers can recover significant amount of sensitive input information from intermediate-layer features of a DNN.”
BackgroundAccuracy-Privacy Trade-off in Deep Ensembles.Preprint
Rezaei, S., Shafiq, Z., & Liu, X. (2021) · arXiv (Cornell University) · Cited by 1
Novel Neural Network Repair Methods for Data Privacy and Individual Fairness
Graves, L. M. (2021) · UWSpace (University of Waterloo) · Cited by 1
Quantifying and Localizing Private Information Leakage from Neural Network GradientsPreprint
Mo, F., Borovykh, A., Malekzadeh, M., Haddadi, H., & Demetriou, S. (2021) · arXiv (Cornell University) · Cited by 1
Privacy-Preserving Federated Learning Compatible with Robust AggregatorsPreprint
Alebouyeh, Z., & Bidgoly, A. J. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4793556 · Cited by 1
Special Session: Towards an Agile Design Methodology for Efficient, Reliable, and Secure ML Systems
Dave, S., Marchisio, A., Hanif, M. A., Guesmi, A., Shrivastava, A., Alouani, I., & Shafique, M. (2022) · IEEE VLSI Test Symposium (VTS) · doi:10.1109/vts52500.2021.9794253 · Cited by 15
“More generically, Property Inference Attacks [136] infer certain properties that hold only for a fraction of the training data, and are independent from the features that the DNN model aims to learn.”
BackgroundA Novel Defending Scheme for Graph-Based Classification Against Graph Structure Manipulating Attack
Zhao, Q., Zhang, F., & Zhang, Y. (2020) · Communications in computer and information science · doi:10.1007/978-981-15-9031-3_26
Formalizing Distribution Inference RisksPreprint
Suri, A., & Evans, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.03699
“Ganju et al. [5] applied their meta-classifier method on two properties on this dataset: 38% v/s 65% women (case A), and 0% v/s 87% whites (case B).”
InfluentialLearning to Prevent Leakage: Privacy-Preserving Inference in the Mobile CloudPreprint
Zhang, S., Xiang, L., Li, C., et al. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.08421
“In this category, the adversary infers from features about the input properties beyond what contains in the output, as in works such as [6, 7, 8].”
BackgroundData Protection in Big Data Analysis
Shafieinejad, M. (2021) · UWSpace (University of Waterloo)
Accuracy-Privacy Trade-off in Deep Ensemble: A Membership Inference PerspectivePreprint
Rezaei, S., Shafiq, Z., & Liu, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.05381 · Cited by 5
Advanced Attacks and Protection Mechanisms in IoT Devices and Networks
Batina, L., Mentens, N., Miettinen, M., Mukhtar, N., Nguyen, T. D., Rabbani, M. M., Rieger, P., & Sadeghi, A. (2021) · Wiley eBooks · doi:10.1002/9781119607755.ch1
Li, Y., Liu, Y., Li, B., Wang, W., & Liu, N. (2021) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom53373.2021.00064
“In particular, when sensitive data is used to train the machine learning model, the model itself might unwittingly leak information about that data through either their behavior (i.e., black-box attack [1], [2]) or the details of their structure (i.e., white-box attack [3], [4]).”
MethodFSSA: Efficient 3-Round Secure Aggregation for Privacy-Preserving Federated LearningPreprint
Luo, F. (2022) · doi:10.36227/techrxiv.20004140 · Cited by 1
Power-Efficient Trainable Neural Networks towards Accurate Measurement of Irregular Cavity Volume
Zhang, X., Jiang, Y., Gao, H., et al. (2022) · Electronics · doi:10.3390/electronics11132073
Self-citation
Metadata
- Authors
- Ganju, K., Wang, Q., Yang, W., Gunter, C. A., & Borisov, N.
- Affiliations
- University of Illinois Urbana-Champaign (US)
- The University of Texas at Dallas (US)
- Venue
- Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2018-10-15
- Pages
- 619-633
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2897830718
- Semantic Scholar
- 490c30b1d6b680be3c5a13552073e4fc10a850dc
- Cited by
- 475
- References
- 37
- Citations by year
- 2026: 27 · 2025: 58 · 2024: 89 · 2023: 98 · 2022: 74 · 2021: 69 · 2020: 39 · 2019: 19 · 2018: 2
- FWCI
- 13.11
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- U.S. Department of Energy (DE-OE0000780)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- property inference attacks, fully connected neural network, permutation invariance, training data leakage, white-box attacks, model sharing, performance counters
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
