The DOI matches its Crossref record; 42 of the 42 references it cites were found in a registry or an index.
Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations
Open accessAbstract
With the growing adoption of machine learning, sharing of learned models is becoming popular. However, in addition to the prediction properties the model producer aims to share, there is also a risk that the model consumer can infer other properties of the training data the model producer did not intend to share. In this paper, we focus on the inference of global properties of the training data, such as the environment in which the data was produced, or the fraction of the data that comes from a certain class, as applied to white-box Fully Connected Neural Networks (FCNNs). Because of their complexity and inscrutability, FCNNs have a particularly high risk of leaking unexpected information about their training sets; at the same time, this complexity makes extracting this information challenging. We develop techniques that reduce this complexity by noting that FCNNs are invariant under permutation of nodes in each layer. We develop our techniques using representations that capture this invariance and simplify the information extraction task. We evaluate our techniques on several synthetic and standard benchmark datasets and show that they are very effective at inferring various data properties. We also perform two case studies to demonstrate the impact of our attack. In the first case study we show that a classifier that recognizes smiling faces also leaks information about the relative attractiveness of the individuals in its training set. In the second case study we show that a classifier that recognizes Bitcoin mining from performance counters also leaks information about whether the classifier was trained on logs from machines that were patched for the Meltdown and Spectre attacks.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“In order to better capture the level of confidence of the model, one may also sort the posteriors before the difference or concatenation operations [20].”
From When Machine Unlearning Jeopardizes Privacy (2021) · cites this paper as [20]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Adam: A Method for Stochastic Optimization
Kingma, D. P., & Ba, J. (2014) · arXiv · doi:10.48550/arxiv.1412.6980 · Cited by 98,946
Semi-supervised classification with graph convolutional networks
Kipf, T. N., & Welling, M. (2016) · arXiv · doi:10.48550/arxiv.1609.02907 · Cited by 24,853
FaceNet: A unified embedding for face recognition and clustering
Schroff, F., Kalenichenko, D., & Philbin, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298682 · Cited by 15,267
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280
A Stochastic Approximation Method
Robbins, H., & Monro, S. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729586 · Cited by 9,643
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
DeepFace: Closing the Gap to Human-Level Performance in Face Verification
Taigman, Y., Yang, M., Ranzato, M., & Wolf, L. (2014) · 2014 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2014.220 · Cited by 6,542
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
(2018) · Cited by 3,510
Research works printed but not linked: 9
- Amazon. 2018. Machine Learning at AWS. https://aws.amazon.com/machine-learning/ Retrieved August 15, 2018 from Amazon. 2018. Machine Learning at AWS. https://aws.amazon.com/machine-learning/ Retrieved August 15, 2018 from
- BigML Inc. 2018. BigML. https://bigml.com/ Retrieved August 15, 2018 from BigML Inc. 2018. BigML. https://bigml.com/ Retrieved August 15, 2018 from
- Eric Florenzano . 2016. Gadientzoo. https://www.gradientzoo.com/ Retrieved August 15, 2018 from Eric Florenzano. 2016. Gadientzoo. https://www.gradientzoo.com/ Retrieved August 15, 2018 from
- Google Cloud . 2018. Cloud Machine Learning Engine. https://cloud.google.com/ml-engine/ Retrieved August 15, 2018 from Google Cloud. 2018. Cloud Machine Learning Engine. https://cloud.google.com/ml-engine/ Retrieved August 15, 2018 from
- Jamie Hayes , Luca Melis , George Danezis , and Emiliano De Cristofaro . 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 ( 2017 ). Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). · arXiv
- Zhiqiang Lin , Xiangyu Zhang , and Dongyan Xu . 2010 . Automatic reverse engineering of data structures from binary execution . In Proceedings of the 11th Annual Information Security Symposium. CERIAS-Purdue University, 5. Zhiqiang Lin, Xiangyu Zhang, and Dongyan Xu. 2010. Automatic reverse engineering of data structures from binary execution. In Proceedings of the 11th Annual Information Security Symposium. CERIAS-Purdue University, 5.
- PyTorch core team. 2018. Pytorch . http://pytorch.org/ Retrieved August 15, 2018 from PyTorch core team. 2018. Pytorch. http://pytorch.org/ Retrieved August 15, 2018 from
- Perf Wiki . 2018. Linux profiling with performance counters. https://perf.wiki.kernel.org/index.php/Main_Page Retrieved August 15, 2018 from Perf Wiki. 2018. Linux profiling with performance counters. https://perf.wiki.kernel.org/index.php/Main_Page Retrieved August 15, 2018 from
- Manzil Zaheer Satwik Kottur Siamak Ravanbakhsh Barnabas Poczos Ruslan R Salakhutdinov and Alexander J Smola. 2017. Deep sets. In Advances in Neural Information Processing Systems. 3394--3404. Manzil Zaheer Satwik Kottur Siamak Ravanbakhsh Barnabas Poczos Ruslan R Salakhutdinov and Alexander J Smola. 2017. Deep sets. In Advances in Neural Information Processing Systems. 3394--3404.
Cited by
Sorted by citations
Items 401–471 of 471
Towards Preserving Server-Side Privacy of On-Device Models
Atrey, A., Sinha, R., Sarkhel, S., et al. (2022) · The Web Conference (WWW) · doi:10.1145/3487553.3524257
“Alternatively, property inference attacks focus on extracting hidden global patterns in the training data [5].”
BackgroundLiu, T., Chen, Y., & Gu, W. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i5.25794
“The dataset distillation was first introduced by (Wang et al. 2018), who distilled datasets based on hyperparametric optimization methods (Maclaurin, Duve-naud, and Adams 2015).”
MethodInfluentialAdversarial ML for DNNs, CapsNets, and SNNs at the Edge
Marchisio, A., Hanif, M. A., & Shafique, M. (2023) · Springer eBooks · doi:10.1007/978-3-031-40677-5_18
Alouani, I. (2023) · Springer eBooks · doi:10.1007/978-3-031-40677-5_19
Learning to Prevent Input Leakages in the Mobile Cloud Inference
Xiang, L., Zhang, S., & Zhang, Q. (2023) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2023.3340338 · Cited by 1
“Thelatterinfersprivatepropertiesofthetraining data[7],[8].”
BackgroundCoReg: Membership Privacy Protection via Collaborative Regularization
Yang, Y., Lai, M., & Han, X. G. (2023) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc59305.2023.00027
“…thread of research has shown that machine learning models are prone to memorize sensitive information of training data [1], [2], which make them vulnerable to privacy attacks, including attribute inference attacks [3], membership inference attacks [4], [5] and property inference attacks [6], etc.”
BackgroundA Comprehensive Analysis of Inference Attacks in Federated Learning
Ameria, D., Kumar, U., & Sankhe, S. R. (2023) · IEEE Pune Section International Conference (PuneCon) · doi:10.1109/punecon58714.2023.10450123 · Cited by 1
“3) Inferring Properties: Adversaries can employ passive and active property inference attacks to extract specific characteristics from the training data of fellow participants [18] [19].”
Privacy-Preserving Federated Learning Compatible with Robust AggregatorsPreprint
Alebouyeh, Z., & Bidgoly, A. J. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4882102
Query-Based External Information Leakage Attacks on Face Recognition Models
Grolman, E., Giloni, A., Kremer, R., Saito, H., Shibata, T., Omino, T., Komatsu, M., Hanatani, Y., Shabtai, A., & Elovici, Y. (2024) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn60899.2024.10651362
“Most of the proposed EIL attacks were demonstrated in white-box scenarios in which the attacker assumes complete access to the ML model’s output, structure, and parameters [2], [9], [16].”
BackgroundMethodInfluentialMuin, A.-A., Khan, S., & Miah, M. H. (2024) · SAE technical papers on CD-ROM/SAE technical paper series · doi:10.4271/2024-01-6004
EdDSA Shield: Fortifying Machine Learning Against Data Poisoning Threats in Continual Learning
Nageswari, A., & VASUNDRA, D. S. (2024) · Lecture notes in electrical engineering · doi:10.1007/978-981-97-8031-0_107
Chen, Y., Yang, X., & Deligiannis, N. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73404-5_23 · Cited by 1
Calibrating Practical Privacy Risks for Differentially Private Machine Learning
Gu, Y., & Chen, K. (2024) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata62323.2024.10825354
“…much more than what they are supposed to learn [1] – once the models are published, adversaries can use them to infer private information in the training data, e.g., via model inversion [2], [3], membership inference [4], [5], property inference [6], [7], and domain inference [8], [9] attacks.”
Towards Assessing Integrated Differential Privacy and Fairness Mechanisms in Supervised Learning
Aldairi, M., & Joshi, J. B. D. (2024) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa62245.2024.00034
A Perturbation-Based Privacy Leakage Defense Method for Federal Learning
Yang, C., Huang, S., Ding, Y., Liang, H., Jia, S., & Peng, X. (2024) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc63484.2024.00014
A new method of free-rider attack based on disguise in federated learning
Luo, H., Zhou, R., Su, Y., Huang, J., & Li, W. (2025) · Sixth Symposium on Novel Optoelectronic Detection Technology and Applications · doi:10.1117/12.3056723
“Researchers have extensively studied poisoning attacks [4][5], backdoor attacks [5][6], and reasoning attacks [7][8] in the field of federated learning.”
Gradient Reconstruction Protection Based on Sparse Learning and Gradient Perturbation in IoV
Zhao, J. M., Rao, X., Yang, B., et al. (2025) · International Journal of Intelligent Systems · doi:10.1155/int/9253392
“Sensitive information about vehicle owners could be inferred through attack methods such as gradient inversion, gradient reconstruction attacks (GRAs) [2], membership inference attacks (MIAs) [3], and property inference attacks (PIAs) [4].”
A Representation Learning Induced Property Inference Attack on Machine Learning Models for E-Health
Bukhari, M., Iqbal, A., Aman, M. N., et al. (2024) · Globecom · doi:10.1109/globecom52923.2024.10901499
“Firstly, we presume that the adversary has white box access of the model and thus, has knowledge of the model architecture and parameters [5].”
InfluentialSubject Data Auditing via Source Inference Attack in Cross-Silo Federated Learning
Li, J., Arazzi, M., Nocera, A., & Conti, M. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104034 · Cited by 3
FLAIR: A Federated Learning Approach Against Inference Attacks and Risks
Bouharoun, M., & Erradi, M. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-3774-4_9
Adaptive Domain Inference Attack with Concept Hierarchy
Gu, Y., He, J., & Chen, K. (2025) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3690624.3709332 · Cited by 3
Federated Learning: An Overview of Attacks and Defense Methods
Sameera, K. M., Arikkat, D. R., Vinod, P., A., R. R. K., Aneez, A., & Conti, M. (2025) · Springer eBooks · doi:10.1007/978-3-031-83157-7_14
Luan, S., Lu, X., Zhang, Z., et al. (2025) · Communications in computer and information science · doi:10.1007/978-981-96-6966-0_16
Higashi, T., & Nakai, T. (2025) · doi:10.1145/3709018.3736329 · Cited by 2
“For instance, a classifier trained on Bitcoin logs could disclose whether the machine that produced the logs had implemented patches for Meltdown and Spectre [22].”
DeGain: Detecting GAN-Based Data Inversion in Collaborative Deep Learning
Chen, Z., Gao, Y., Fu, A., Zeng, F., Kuang, B., & Deng, R. H. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-9101-2_9 · Cited by 1
Sentence Embedding Generation Method for Differential Privacy Protection
Liu, Y., Wang, W., & Hua, J. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-9101-2_5
Leveraging Multiple Metrics to Improve Difficulty Calibration in Membership Inference Attacks
Zhou, N., Wang, Z., Liang, X., & Du, R. (2025) · Communications in computer and information science · doi:10.1007/978-981-96-9958-2_14
Interpretable Rotation-Equivariant Multiary-Valued Network for Attribute Obfuscation
Zhang, Q., Zhang, H., Chen, Y.-T., Ren, Q., Ren, J., Xu, C., & Xiang, L. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3599592
“The “property” refers to the input attribute [11], and the inference attacker uses the intermediate-layer feature to infer sensitive attributes of inputs.”
PAIR: Privacy Attack Against Image Recognition With Sample Augmentation
Feng, Y., & Liu, Q. (2025) · IET Image Processing · doi:10.1049/ipr2.70190
Dong, Y., Feng, W., Li, H., Zhang, M., Yu, Q., & Feng, D. (2025) · Scientia Sinica Informationis · doi:10.1360/ssi-2025-0248
A continuous verification mechanism for ensuring client data forgetfulness in Federated Unlearning
Xing, F., Liu, J., Chen, S., Yu, T., & Yang, Y. (2025) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2025.112553 · Cited by 1
A Verifiable Federated Learning Scheme With Privacy-Preserving in MCS
Gu, K., Lei, J., Tan, J., & Li, X. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3627581
“Malicious attackers can recover participants’ original private data from the local or global gradients in plaintext through monitoring, theft, or collusion, which leads to personal privacy breaches [8], [9], [10].”
Zhang, S., Zou, L., Wang, T., & Yang, Z. (2025) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc67675.2025.00112
“Ganju et al. Ganju et al. [17] extend the property inference attack to more complex fully connected neural networks (FCNN) and reduce the complexity of the attack.”
Non-Invasive User Profiling through Label Inference in FL-based Network Traffic Classification
Zhang, H., & Ye, F. (2025) · IEEE International Conference on Mobile Ad-Hoc and Smart Systems (MASS) · doi:10.1109/mass66014.2025.00054
“The authors of [14] proposed property inference attacks, where an attacker infers aggregate properties of the training data that the model designer did not intend to disclose.”
DAV: An Adaptive Defense Framework for Model Extraction Attacks
Sui, P., Zhou, J., Chen, Y., & Li, Y. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11228005
“In addition, they may further commit other attacks, such as membership inference attacks [5], model inversion attacks [6] and attribute inference attacks [7], as the model extraction attack transforms a black-box model into white-box conditions.”
NEXUS: Neuron Activation Scores Exploits for Unveiling Sensitive Attributes
Manna, D., & Tripathy, S. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-13714-2_5
Ong, W. K., & Chan, C. S. (2025) · IEEE Access · doi:10.1109/access.2025.3611992
Hypothesis Testing and Beyond: a Mini Survey on Membership Inference Attacks
Liu, J., Zhang, Z., Li, H., Song, W., Lin, Y., & Zuo, J. (2025) · IEEE International Conference on Privacy Computing and Data Security (PCDS) · doi:10.1109/pcds65695.2025.00014
“While machine learning models face various privacy threats (including model extraction [5], attribute inference [6], and property inference attacks [7]), MIA [1] has emerged as the most representative and widely applied privacy assessment technique.”
Decentralized Privacy-Preserving Federated Learning Using Additive Secret Sharing
Bouamama, J., Benkaouz, Y., & OUZZIF, M. (2025) · International Conference on Wireless Networks and Mobile Communications (WINCOM) · doi:10.1109/wincom65874.2025.11313402
“Despite not sharing raw data, FL is vulnerable to privacy threats such as gradient inversion [5], membership inference [7], and property inference [8].”
Decoupled Self-knowledge Distillation Makes Differentially Private Deep Learning Stronger
Zhao, D., Xue, D., Zhao, S., Li, C., & Chen, H. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-4155-3_35
Adaptive Domain Inference Attack with Concept Hierarchy
Gu, Y., He, J., & Chen, K. (2025) · Maryland Shared Open Access Repository (USMAI Consortium) · doi:10.13016/m2sxuc-qtvo
Saha, U., Tonoy, T. M., & Imtiaz, H. (2025) · IEEE International Conference on Future Machine Learning and Data Science (FMLDS) · doi:10.1109/fmlds67896.2025.00023
“Several studies have shown that trained models can (un)intentionally leak private information through various attacks, including membership inference, model inversion, and property inference [1]–[4].”
Privacy Preserved and Explainable Deep Medical Image Analysis: A Survey
Chowdhury, L., Thuseethan, S., Sebastian, Y., Rajasegarar, S., Alazab, M., & Yearwood, J. L. (2026) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2026.3675200
Privacy preserving location based services : From centralized to federated approaches
Khalfoun, B. (2022) · theses.fr (ABES) · doi:10.70675/c118af96z9a87z460fz8378zb039b96ece7d
Performance and Verifiability of IoT Security Protocols
Mansouri, M. (2023) · theses.fr (ABES) · doi:10.70675/c5a09e65z39ccz4810zb11bza7da4bf12251
Machine learning and privacy protection : Attacks and defenses
Zari, O. (2025) · theses.fr (ABES) · doi:10.70675/e0c63206za6cez483azb47fz1e2a28471833
PrivSplit: A Lossless Method for Prompt Privacy in Distributed Parameter-Efficient Fine-Tuning
Niu, W., Zhang, L., Cheng, H., & Li, S. (2026) · International World Wide Web Conference (WWW) · doi:10.1145/3774904.3792112
Robust watermarking for neural networks in multimedia tasks
Trias, C. D. S. (2025) · theses.fr (ABES) · doi:10.70675/875f9c2bz2068z460ez907bzdbe2b7d8453f
Chuang, Y., & Zhang, Q.-X. (2026) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2026.114734
Rizwan, M., Wali, A., Islam, M. S. U., & Fatima, S. (2026) · Cognitive Computation · doi:10.1007/s12559-026-10597-4
FedLeaks: Creating Timing Channel Leaks in Federated Learning of Adaptive Neural Networks
Akinsanya, A., & Brennan, T. (2026) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3779208.3785394
Huang, K., Wei, Y., Kong, T., et al. (2026) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-026-00897-y
“…can reconstruct high-fidelity copies of training data from gradients uploaded to a server (Zhu et al. 2019), while property inference attacks can extract statistical characteristics of the training set from neural network parameters (Ganju et al. 2018).”
Robust White-Box Watermarking via Matrix Multiplication Against Desynchronization Attacks
徳田, 進., Imaizumi, S., & Kuribayashi, M. (2026) · ACM Workshop on Information Hiding and Multimedia Security (IH&MMSec) · doi:10.1145/3785353.3815076
“Under such attacks, transformations such as weight scaling and permutation can make it difficult to recover the embedded information [7, 13].”
Mao, Y., Shan, F., Mao, S., et al. (2026) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-026-03197-z
Fed-CEP: Federated Causal-Semantic Privacy via Calibrated Input Perturbation
Cui, Q., Zhao, D., Tan, Z., Lv, M., Dang, P., Liu, X., Guo, M., Wang, H., & Li, H. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11581530
“Attackers can reconstruct samples via Gradient Inversion Attacks [1], infer membership via Membership Inference Attacks [2], or steal attributes via Attribute Inference Attacks [3], driving research into privacy-preserving FL mechanisms [4].”
ADUX: Improving Adversarial Attack Detection in UAV Networks Using XAI
Gupta, D., & Gupta, S. (2026) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-026-11493-7
Chougule, B. B., & Bagane, P. (2026) · International Journal on Smart Sensing and Intelligent Systems · doi:10.2478/ijssis-2026-0040
Full-Stack Model Extraction: Evaluating System-Wide Stealing Attacks
Hackett, W., Trawicki, S., Yu, Z., Suri, N., & Garraghan, P. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-32764-2_3
Membership and Property Inference Attacks on text Data in Transfer Learning
Jiang, Z. (2026) · International Conference on Big Data and Privacy Computing (BDPC) · doi:10.1109/bdpc69980.2026.11608215
“Building upon Ateniese’s work, Ganju et al. [10] shifted the attack target to neural networks and proposed two methods for property inference attacks in white-box settings based on fully connected neural networks: one method based on neuron ordering and another based on DeepSets.”
Covert Attacks on Machine Learning Training in Passively Secure MPC
Jagielski, M., Rachuri, R., Scholl, P., & Escudero, D. (2026) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp68448.2026.00047 · Cited by 1
“This is especially difficult for neural networks, which have many “isomorphisms”, wildly different model parameters which correspond to the exact same function [47, 48, 49].”
Learning to Leak: Data Exfiltration from LSTM-Based Next-Token Prediction Models
Medak, M., Pustozerova, A., & Mayer, R. L. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-35586-7_33
Privacy-preserving methodologies against privacy attacks on deep learning: a survey
Ghosh, S., & Mandal, A. K. (2026) · Knowledge and Information Systems · doi:10.1007/s10115-026-02865-4
Cheng, G., Liu, S., Chen, Y., Zhu, M., Zhao, H., Qin, Z., Wu, Y., & Zhao, X. (2026) · IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws72778.2026.00186
“These threats correspond to membership inference attacks [29], property inference at-1528 tacks [30], and reconstruction attacks [31], respectively.”
Differentially private federated learning for image analysis in smart-city surveillance
Pandya, N., & Mistry, D. (2026) · Frontiers in Imaging · doi:10.3389/fimag.2026.1966936
Security and Privacy in Federated Learning
Lu, X., Yan, C., Liò, P., Hui, P., & Wang, P. (2026) · IntechOpen eBooks · doi:10.5772/intechopen.1017100
A Blackbox Access to Load Forecasting Models Is All You Need to Breach Privacy
Aly, H., Al-Ali, A. K., Al-Ali, A. K., et al. (2026) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3856299
“Invariant Representation (PIR) attack.”
InfluentialLocal Model Poisoning Attacks to Byzantine-Robust Federated Learning
Fang, M., Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv · doi:10.48550/arxiv.1911.11815 · Cited by 828
“Specifically, an attacker could compromise the confidentiality of users’ private training or testing data via various attacks such as model inversion attacks [21, 22], membership inference attacks [40, 49, 53], and property inference attacks [1, 24].”
BackgroundEvaluating Differentially Private Machine Learning in Practice
Jayaraman, B., & Evans, D. (2019) · arXiv · doi:10.48550/arxiv.1902.08874 · Cited by 265
“These attacks have been performed on HMM and SVM models [2] and neural networks [23].”
MethodTowards Probabilistic Verification of Machine Unlearning
Sommer, D. M., Song, L., Wagh, S., & Mittal, P. (2020) · arXiv · doi:10.48550/arxiv.2003.04247 · Cited by 38
“However, recent works have shown that ML models memorize sensitive information of training data [1–4], indicating serious privacy risks to individual user data.”
BackgroundEavesdrop the Composition Proportion of Training Labels in Federated Learning
Wang, L., Xu, S., Wang, X., & Zhu, Q. (2019) · arXiv · doi:10.48550/arxiv.1910.06044 · Cited by 34
“Ganju et al. [47] construct an inference attack towards fully-connected neural networks, and they realize it by applying post-training techniques to a white-box model.”
Method
Metadata
- Authors
- Ganju, K., Wang, Q., Yang, W., Gunter, C. A., & Borisov, N.
- Affiliations
- University of Illinois Urbana-Champaign (US)
- The University of Texas at Dallas (US)
- Venue
- Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2018-10-15
- Pages
- 619-633
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2897830718
- Semantic Scholar
- 490c30b1d6b680be3c5a13552073e4fc10a850dc
- Cited by
- 475
- References
- 37
- Citations by year
- 2026: 27 · 2025: 58 · 2024: 89 · 2023: 98 · 2022: 74 · 2021: 69 · 2020: 39 · 2019: 19 · 2018: 2
- FWCI
- 13.11
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- U.S. Department of Energy (DE-OE0000780)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- property inference attacks, fully connected neural network, permutation invariance, training data leakage, white-box attacks, model sharing, performance counters
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
