LOGAN: Membership Inference Attacks Against Generative Models
Open accessAbstract
Generative models estimate the underlying distribution of a dataset to generate realistic samples according to that distribution. In this paper, we present the first membership inference attacks against generative models: given a data point, the adversary determines whether or not it was used to train the model. Our attacks leverage Generative Adversarial Networks (GANs), which combine a discriminative and a generative model, to detect overfitting and recognize inputs that were part of training datasets, using the discriminator’s capacity to learn statistical differences in distributions. We present attacks based on both white-box and black-box access to the target model, against several state-of-the-art generative models, over datasets of complex representations of faces (LFW), objects (CIFAR-10), and medical images (Diabetic Retinopathy). We also discuss the sensitivity of the attacks to different training parameters, and their robustness against mitigation strategies, finding that defenses are either ineffective or lead to significantly worse performances of the generative models in terms of training stability and/or sample quality.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Formal security and secrecy mechanisms such as model encryption can only partially address privacy requirements, as even encrypted models have been found to leak sensitive information.
“Formal security and secrecy mechanisms such as model encryption can only partially address this requirement, as even encrypted models have been found to leak sensitive information in previous work23,24.”
From Medical imaging deep learning with differential privacy (2021) · cites this paper as [24]
Cites
(2014) · Cited by 33,419 · see citing works
Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
Ioffe, S., & Szegedy, C. (2015) · arXiv · doi:10.48550/arxiv.1502.03167 · Cited by 27,818 · see citing works
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,890 · see citing works
GAN（Generative Adversarial Nets）
淳司, 柴. (2017) · Journal of Japan Society for Fuzzy Theory and Intelligent Informatics · doi:10.3156/jsoft.29.5_177_2 · Cited by 19,268 · see citing works
Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate ShiftPreprint
Ioffe, S. (2024) · arXiv (Cornell University) · doi:10.57702/o9raffed · Cited by 15,273 · see citing works
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215 · see citing works
Distilling the Knowledge in a Neural Network
Hinton, G., Vinyals, O., & Dean, J. (2015) · arXiv · doi:10.48550/arxiv.1503.02531 · Cited by 14,204 · see citing works
Photo-Realistic Single Image Super-Resolution Using a Generative Adversarial Network
Ledig, C., Theis, L., Huszar, F., Caballero, J., Cunningham, A., Acosta, A., Aitken, A., Tejani, A., Totz, J., Wang, Z., et al. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.19 · Cited by 12,696 · see citing works
Unsupervised representation learning with deep convolutional generative adversarial networks
Radford, A., Metz, L., & Chintala, S. (2015) · arXiv · doi:10.48550/arxiv.1511.06434 · Cited by 12,235 · see citing works
Improved Techniques for Training GANs
Salimans, T., Goodfellow, I., Zaremba, W., Cheung, V., Radford, A., & Chen, X. (2016) · arXiv · doi:10.48550/arxiv.1606.03498 · Cited by 6,965 · see citing works
Improved training of Wasserstein GANs
Gulrajani, I., Ahmed, F., Arjovsky, M., Dumoulin, V., & Courville, A. (2017) · arXiv · doi:10.48550/arxiv.1704.00028 · Cited by 6,800 · see citing works
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Labeled Faces in the Wild: A Database forStudying Face Recognition in Unconstrained Environments
Huang, G. B., Mattar, M., Berg, T. L., & Miller, E. G. (2008) · HAL · Cited by 4,445 · see citing works
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956 · see citing works
Differential Privacy: A Survey of Results
Dwork, C. (2008) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-79228-4_1 · Cited by 3,542 · see citing works
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,123 · see citing works
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961 · see citing works
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356 · see citing works
Weight Normalization: A Simple Reparameterization to Accelerate Training of Deep Neural NetworksPreprint
Salimans, T., & Kingma, D. P. (2016) · Neural Information Processing Systems · doi:10.48550/arxiv.1602.07868 · Cited by 2,284 · see citing works
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
Hitaj, B., Ateniese, G., & Perez-Cruz, F. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134012 · Cited by 1,377 · see citing works
De-anonymizing Social Networks
Narayanan, A., & Shmatikov, V. (2009) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2009.22 · Cited by 1,324 · see citing works
Autoencoding beyond pixels using a learned similarity metric
Larsen, A., Sønderby, S. K., Larochelle, H., & Winther, O. (2016) · Research at the University of Copenhagen (University of Copenhagen) · Cited by 1,317 · see citing works
(2016) · International Conference on Machine Learning · Cited by 1,270 · see citing works
Semantic Image Inpainting with Deep Generative Models
Yeh, R. A., Chen, C., Lim, T. Y., Schwing, A. G., Hasegawa‐Johnson, M., & Do, M. N. (2017) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2017.728 · Cited by 1,263 · see citing works
Homer, N., Szelinger, S., Redman, M., Duggan, D., Tembe, W., Muehling, J., Pearson, J. V., Stephan, D. A., Nelson, S. F., & Craig, D. W. (2008) · PLoS Genetics · doi:10.1371/journal.pgen.1000167 · Cited by 1,221 · see citing works
BEGAN: Boundary Equilibrium Generative Adversarial NetworksPreprint
Berthelot, D., Schumm, T., & Metz, L. (2017) · arXiv.org · doi:10.48550/arxiv.1703.10717 · Cited by 1,217 · see citing works
Are GANs Created Equal? A Large-Scale StudyPreprint
Lučić, M., Kurach, K., Michalski, M., Gelly, S., & Bousquet, O. (2017) · Neural Information Processing Systems · doi:10.48550/arxiv.1711.10337 · Cited by 1,175 · see citing works
Privacy Preserving Data Mining
Lindell, Y., & Pinkas, B. (2000) · Lecture Notes in Computer Science · doi:10.1007/3-540-44598-6_3 · Cited by 1,077 · see citing works
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S. (2018) · 2018 IEEE 31st Computer Security Foundations Symposium (CSF) · doi:10.1109/csf.2018.00027 · Cited by 1,001 · see citing works
Stealing Machine Learning Models via Prediction APIs
Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., & Ristenpart, T. (2016) · arXiv · doi:10.48550/arxiv.1609.02943 · Cited by 796 · see citing works
Medical Image Synthesis with Context-Aware Generative Adversarial Networks
Nie, D., Trullo, R., Lian, J., Petitjean, C., Ruan, S., Wang, Q., & Shen, D. G. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-66179-7_48 · Cited by 751 · see citing works
Autoencoding beyond pixels using a learned similarity metricPreprint
Larsen, A., Sønderby, S. K., Larochelle, H., & Winther, O. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1512.09300 · Cited by 712 · see citing works
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.
Fredrikson, M., Lantz, E., Jha, S., Lin, S. M., Page, D., & Ristenpart, T. (2014) · PubMed · Cited by 658 · see citing works
Lossy Image Compression with Compressive AutoencodersPreprint
Theis, L., Shi, W., Cunningham, A., & Huszár, F. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1703.00395 · Cited by 579 · see citing works
Machine Learning Models that Remember Too Much
Song, C., Ristenpart, T., & Shmatikov, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134077 · Cited by 526 · see citing works
Ateniese, G., Mancini, L. V., Spognardi, A., Villani, A., Vitali, D., & Felici, G. (2015) · International Journal of Security and Networks · doi:10.1504/ijsn.2015.071829 · Cited by 482 · see citing works
Machine Learning with Membership Privacy using Adversarial Regularization
Nasr, M., Shokri, R., & Houmansadr, A. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243855 · Cited by 458 · see citing works
Privacy-Preserving Generative Deep Neural Networks Support Clinical Data Sharing
Beaulieu‐Jones, B. K., Wu, Z. S., Williams, C., Lee, R., Bhavnani, S. P., Byrd, J. B., & Greene, C. S. (2019) · Circulation Cardiovascular Quality and Outcomes · doi:10.1161/circoutcomes.118.005122 · Cited by 407 · see citing works
Privacy-Preserving Multivariate Statistical Analysis: Linear Regression and Classification
Du, W. K., Han, Y. S., & Chen, S. (2004) · SIAM International Conference on Data Mining · doi:10.1137/1.9781611972740.21 · Cited by 376 · see citing works
Scalable Private Learning with PATE
Papernot, N., Song, S., Mironov, I., Raghunathan, A., Talwar, K., & Erlingsson, Ú. (2018) · arXiv · doi:10.48550/arxiv.1802.08908 · Cited by 373 · see citing works
"You Might Also Like:" Privacy Risks of Collaborative Filtering
Calandrino, J. A., Kilzer, A., Narayanan, A., Felten, E. W., & Shmatikov, V. (2011) · 2011 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2011.40 · Cited by 311 · see citing works
Duchi, J. C., Jordan, M. I., & Wainwright, M. J. (2014) · Journal of the ACM · doi:10.1145/2666468 · Cited by 238 · see citing works
Lossy Image Compression with Compressive Autoencoders
Huszár, F., Theis, L., Shi, W., & Cunningham, A. (2020) · Apollo (University of Cambridge) · doi:10.17863/cam.51995 · Cited by 237 · see citing works
Knock Knock, Who's There? Membership Inference on Aggregate Location Data
Pyrgelis, A., Troncoso, C., & Cristofaro, E. D. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23183 · Cited by 232 · see citing works
Privacy-Preserving Deep Learning: Revisited and Enhanced
Phong, L. T., Aono, Y., Hayashi, T., Wang, L., & Moriai, S. (2017) · Communications in computer and information science · doi:10.1007/978-981-10-5421-1_9 · Cited by 170 · see citing works
Membership Inference Attack against Differentially Private Deep Learning Model.
Rahman, M. A., Rahman, T., Laganière, R., & Mohammed, N. (2018) · Cited by 167 · see citing works
Generalization in Adaptive Data Analysis and Holdout Reuse
Dwork, C., Feldman, V., Hardt, M., Pitassi, T., Reingold, O., & Roth, A. (2015) · arXiv · doi:10.48550/arxiv.1506.02629 · Cited by 152 · see citing works
Membership Privacy in MicroRNA-based Studies
Michael Backes, A., Berrang, P., Humbert, M., & Manoharan, P. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978355 · Cited by 133 · see citing works
On the Quantitative Analysis of Decoder-Based Generative ModelsPreprint
Wu, Y., Burda, Y., Salakhutdinov, R., & Grosse, R. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1611.04273 · Cited by 133 · see citing works
The Secret Sharer: Measuring Unintended Neural Network Memorization & Extracting SecretsPreprint
Carlini, N., Liu, C., Kos, J., Erlingsson, Ú., & Song, D. X. (2018) · arXiv (Cornell University) · Cited by 124 · see citing works
AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine LearningPreprint
Jia, J., & Gong, N. Z. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.04810 · Cited by 119 · see citing works
De-anonymizing social networks and inferring private attributes using knowledge graphs
Qian, J., Li, X., Zhang, C., & Chen, L. (2016) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom.2016.7524578 · Cited by 100 · see citing works
Privacy-preserving generative deep neural networks support clinical data sharingPreprint
Beaulieu‐Jones, B. K., Wu, Z. S., Williams, C., et al. (2017) · bioRxiv (Cold Spring Harbor Laboratory) · doi:10.1101/159756 · Cited by 89 · see citing works
Ji, S., Li, W., Gong, N. Z., Mittal, P., & Beyah, R. (2015) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2015.23096 · Cited by 88 · see citing works
Towards Demystifying Membership Inference AttacksPreprint
Truex, S., Liu, L., Gürsoy, M. E., Yu, L., & Wei, W. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.09173 · Cited by 84 · see citing works
Privacy Aware LearningPreprint
Duchi, J. C., Jordan, M. I., & Wainwright, M. J. (2012) · arXiv (Cornell University) · doi:10.48550/arxiv.1210.2085 · Cited by 61 · see citing works
What Does The Crowd Say About You? Evaluating Aggregation-based Location Privacy
Pyrgelis, A., Troncoso, C., & Cristofaro, E. D. (2017) · Proceedings on Privacy Enhancing Technologies · doi:10.1515/popets-2017-0043 · Cited by 56 · see citing works
Generating Multi-label Discrete Electronic Health Records using Generative Adversarial Networks.Preprint
Choi, E., Biswal, S., Malin, B., Duke, J. D., Stewart, W. F., & Sun, J. (2017) · arXiv (Cornell University) · Cited by 40 · see citing works
Differentially Private Bayesian OptimizationPreprint
Kusner, M. J., Gardner, J. R., Garnett, R., & Weinberger, K. Q. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1501.04080 · Cited by 27 · see citing works
Revisiting Differentially Private Regression: Lessons From Learning Theory and their ConsequencesPreprint
Wu, X., Fredrikson, M., Wu, W., Jha, S., & Naughton, J. F. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1512.06388 · Cited by 18 · see citing works
Generalized Denoising Auto-Encoders as Generative Models
Bengio, Y., Yao, L., Alain, G., & Vincent, P. (2013) · arXiv · doi:10.48550/arxiv.1305.6663
Flagged first, then by citations
2 of the 64 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734 · see citing works
Self-citationA survey on large language model (LLM) security and privacy: The Good, The Bad, and The Ugly
Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z., & Zhang, Y. (2024) · High-Confidence Computing · doi:10.1016/j.hcc.2024.100211 · Cited by 1,083 · see citing works
Membership Inference Attacks on Machine Learning: A Survey
Hu, H., Salcic, Z. A., Sun, L., Dobbie, G., Yu, P. S., & Zhang, X. (2022) · ACM Computing Surveys · doi:10.1145/3523273 · Cited by 586 · see citing works
Membership Inference Attacks From First Principles
Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., & Tramèr, F. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833649 · Cited by 562 · see citing works
When Machine Learning Meets Privacy: A Survey and Outlook
Liu, B., Ding, M., Shaham, S., Rahayu, W., Farokhi, F., & Lin, Z. (2022) · ACM Computing Surveys · doi:10.1145/3436755 · Cited by 455 · see citing works
Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks
Golatkar, A., Achille, A., & Soatto, S. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00932 · Cited by 394 · see citing works
Generative Adversarial Networks: A Survey Toward Private and Secure Applications
Cai, Z., Xiong, Z., Xu, H., Wang, P., Li, W., & Pan, Y. (2022) · ACM Computing Surveys · doi:10.1145/3459992 · Cited by 376 · see citing works
Generative Adversarial Networks in Time Series: A Systematic Literature Review
Brophy, E., Wang, Z., She, Q., & Ward, T. (2023) · ACM Computing Surveys · doi:10.1145/3559540 · Cited by 337 · see citing works
A Survey of Privacy Attacks in Machine Learning
Rigaki, M., & Garcia, S. (2024) · ACM Computing Surveys · doi:10.1145/3624010 · Cited by 285 · see citing works
Privacy and Security Issues in Deep Learning: A Survey
Liu, X., Xie, L., Wang, Y., Zou, J., Xiong, J., Ying, Z., & Vasilakos, A. V. (2020) · IEEE Access · doi:10.1109/access.2020.3045078 · Cited by 285 · see citing works
Analyzing User-Level Privacy Attack Against Federated Learning
Song, M., Wang, Z., Zhang, Z., Song, Y., Wang, Q., Ren, J., & Qi, H. (2020) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2020.3000372 · Cited by 256 · see citing works
Using GANs for Sharing Networked Time Series Data
Lin, Z., Jain, A., Wang, C., Fanti, G. C., & Sekar, V. (2020) · ACM Internet Measurement Conference (IMC) · doi:10.1145/3419394.3423643 · Cited by 232 · see citing works
Wireless Federated Learning with Local Differential Privacy
Seif, M., Tandon, R., & Li, M. (2020) · IEEE International Symposium on Information Theory (ISIT) · doi:10.1109/isit44484.2020.9174426 · Cited by 212 · see citing works
Label-Only Membership Inference AttacksPreprint
Choquette-Choo, C. A., Tramèr, F., Carlini, N., & Papernot, N. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.14321 · Cited by 215 · see citing works
DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspection
Rieger, P., Nguyen, T. D., Miettinen, M., & Sadeghi, A.-R. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23156 · Cited by 202 · see citing works
Auditing Data Provenance in Text-Generation Models
Song, C., & Shmatikov, V. (2019) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3292500.3330885 · Cited by 192 · see citing works
Medical imaging deep learning with differential privacy
Ziller, A., Usynin, D., Braren, R., Makowski, M., Rueckert, D., & Kaissis, G. (2021) · Scientific Reports · doi:10.1038/s41598-021-93030-0 · Cited by 172 · see citing works
A review of generative adversarial networks and its application in cybersecurity
Yinka-Banjo, C., & Ugot, O.-A. (2019) · Artificial Intelligence Review · doi:10.1007/s10462-019-09717-4 · Cited by 157 · see citing works
Monte Carlo and Reconstruction Membership Inference Attacks against Generative Models
Hilprecht, B., Härterich, M., & Bernau, D. (2019) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2019-0067 · Cited by 158 · see citing works
Local and Central Differential Privacy for Robustness and Privacy in Federated Learning
Naseri, M., Hayes, J., & De Cristofaro, E. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23054 · Cited by 188 · see citing works
Self-citationPrivacy-Preserving Techniques in Generative AI and Large Language Models: A Narrative Review
Feretzakis, G., Papaspyridis, K., Gkoulalas-Divanis, A., & Verykios, V. S. (2024) · Information · doi:10.3390/info15110697 · Cited by 176 · see citing works
Differentially private synthetic medical data generation using convolutional GANs
Torfi, A., Fox, E. A., & Reddy, C. K. A. (2021) · Information Sciences · doi:10.1016/j.ins.2021.12.018 · Cited by 149 · see citing works
Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning
Nasr, M., Song, S., Thakurta, A., Papernot, N., & Carlini, N. (2021) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40001.2021.00069 · Cited by 150 · see citing works
A Privacy-Preserving and Verifiable Federated Learning Scheme
Zhang, X., Fu, A., Wang, H., Zhou, C., & Chen, Z. (2020) · International Conference on Communications · doi:10.1109/icc40277.2020.9148628 · Cited by 133 · see citing works
Li, J., Cairns, B. J., Li, J., & Zhu, T. (2023) · npj Digital Medicine · doi:10.1038/s41746-023-00834-7 · Cited by 134 · see citing works
Attacking and Protecting Data Privacy in Edge–Cloud Collaborative Inference Systems
He, Z., Zhang, T., & Lee, R. B.-L. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3022358 · Cited by 126 · see citing works
GAN Enhanced Membership Inference: A Passive Local Attack in Federated Learning
Zhang, J., Zhang, J., Chen, J., & Yu, S. (2020) · ICC 2020 - 2020 IEEE International Conference on Communications (ICC) · doi:10.1109/icc40277.2020.9148790 · Cited by 133 · see citing works
Golatkar, A., Achille, A., & Soatto, S. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58526-6_23 · Cited by 122 · see citing works
Adversarial Attacks to Machine Learning-Based Smart Healthcare Systems
Newaz, A. I., Haque, N. I., Sikder, A. K., Rahman, M. A., & Uluagac, A. S. (2020) · Globecom · doi:10.1109/globecom42002.2020.9322472 · Cited by 114 · see citing works
Machine unlearning: linear filtration for logit-based classifiers
Baumhauer, T., Schöttle, P., & Zeppelzauer, M. (2022) · Machine Learning · doi:10.1007/s10994-022-06178-9 · Cited by 123 · see citing works
Practical GAN-based synthetic IP header trace generation using NetShare
Yin, Y., Lin, Z., Jin, M., Fanti, G. C., & Sekar, V. (2022) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/3544216.3544251 · Cited by 107 · see citing works
Privacy and Security of Big Data in AI Systems: A Research and Standards Perspective
Dilmaghani, S., Brust, M. R., Danoy, G., Cassagnes, N., Pecero, J., & Bouvry, P. (2019) · 2019 IEEE International Conference on Big Data (Big Data) · doi:10.1109/bigdata47090.2019.9006283 · Cited by 111 · see citing works
Anonymization: The imperfect science of using data while preserving privacy
Gadotti, A., Rocher, L., Houssiau, F., Creţu, A.-M., & de Montjoye, Y.-A. (2024) · Science Advances · doi:10.1126/sciadv.adn7053 · Cited by 116 · see citing works
Detecting Overfitting of Deep Generative Networks via Latent Recovery
Webster, R., Rabin, J., Simon, L., & Jurie, F. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.01153 · Cited by 101 · see citing works
Generative Models for Effective ML on Private, Decentralized Datasets
Augenstein, S., McMahan, H. B., Ramage, D., Ramaswamy, S., Kairouz, P., Chen, M., Mathews, R., & Arcas, B. A. Y. (2019) · arXiv · doi:10.48550/arxiv.1911.06679 · Cited by 103 · see citing works
Decentralized Wireless Federated Learning With Differential Privacy
Chen, S., Yu, D., Zou, Y., Yu, J., & Cheng, X. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3145010 · Cited by 100 · see citing works
MLCAD: A Survey of Research in Machine Learning for CAD Keynote Paper
Rapp, M., Amrouch, H., Lin, Y., Yu, B., Pan, D. Z., Wolf, M., & Henkel, J. (2021) · IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems · doi:10.1109/tcad.2021.3124762 · Cited by 99 · see citing works
When Machine Learning Meets Privacy: A Survey and OutlookPreprint
Liu, B., Ding, M., Shaham, S., Rahayu, W. J., Farokhi, F., & Lin, Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.11819 · Cited by 99 · see citing works
Large Language Models Can Be Strong Differentially Private LearnersPreprint
Li, X., Tramèr, F., Liang, P., & Hashimoto, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.05679 · Cited by 153 · see citing works
REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data
Chen, X., Wang, W., Bender, C., Ding, Y., Jia, R., Li, B., & Song, D. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3453079 · Cited by 99 · see citing works
Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge TransferPreprint
Chang, H., Shejwalkar, V., Shokri, R., & Houmansadr, A. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.11279 · Cited by 131 · see citing works
Practical Blind Membership Inference Attack via Differential Comparisons
Hui, B., Yang, Y., Yuan, H., Burlina, P., Gong, N. Z., & Cao, Y. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24293 · Cited by 102 · see citing works
Membership inference attacks against synthetic health data
Zhang, Z., Yan, C., & Malin, B. (2021) · Journal of Biomedical Informatics · doi:10.1016/j.jbi.2021.103977 · Cited by 102 · see citing works
Adversarial Attacks Against Deep Generative Models on Data: A Survey
Sun, H., Zhu, T., Zhang, Z., Jin, D., Xiong, P., & Zhou, W. (2023) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2021.3130903 · Cited by 90 · see citing works
Synthetic data in biomedicine via generative artificial intelligence
van Breugel, B., Liu, T., Oglić, D., & van der Schaar, M. (2024) · Nature Reviews Bioengineering · doi:10.1038/s44222-024-00245-7 · Cited by 97 · see citing works
Trusted AI in Multiagent Systems: An Overview of Privacy and Security for Distributed Learning
Ma, C., Li, J., Wei, K., Liu, B., Ding, M., Yuan, L., Han, Z., & Vincent Poor, H. (2023) · Proceedings of the IEEE · doi:10.1109/jproc.2023.3306773 · Cited by 96 · see citing works
Inference Attacks Against Collaborative Learning.Preprint
Melis, L., Song, C., Cristofaro, E. D., & Shmatikov, V. (2018) · arXiv (Cornell University) · Cited by 93 · see citing works
Self-citationSynthetic Data -- Anonymisation Groundhog DayPreprint
Stadler, T., Oprisanu, B., & Troncoso, C. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.07018 · Cited by 115 · see citing works
A Review on Machine Unlearning
Zhang, H., Nakamura, T., Isohara, T., & Sakurai, K. (2023) · SN Computer Science · doi:10.1007/s42979-023-01767-4 · Cited by 81 · see citing works
Poisoning-Assisted Property Inference Attack Against Federated Learning
Wang, Z., Huang, Y., Song, M., Wu, L., Xue, F., & Ren, K. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3196646 · Cited by 82 · see citing works
Differential privacy in deep learning: A literature survey
Pan, K., Ong, Y.-S., Gong, M., Li, H., Qin, A. K., & Gao, Y. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.127663 · Cited by 79 · see citing works
Synthesis of Realistic ECG using Generative Adversarial NetworksPreprint
Delaney, A. M., Brophy, E., & Ward, T. E. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.09150 · Cited by 74 · see citing works
Shen, M., Wang, H., Zhang, B., Zhu, L., Xu, K., Li, Q. L., & Du, X. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3028110 · Cited by 71 · see citing works
Privacy Inference Attack and Defense in Centralized and Federated Learning: A Comprehensive Survey
Rao, B., Zhang, J., Wu, D., Zhu, C., Sun, X., & Chen, B. (2024) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2024.3363670 · Cited by 79 · see citing works
Sun, C., van Soest, J., & Dumontier, M. (2023) · Journal of Biomedical Informatics · doi:10.1016/j.jbi.2023.104404 · Cited by 76 · see citing works
Survey: Leakage and Privacy at Inference Time
Jegorova, M., Kaul, C., Mayor, C., O'Neil, A. Q., Weir, A., Murray-Smith, R., & Tsaftaris, S. A. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3229593 · Cited by 77 · see citing works
Secure Aggregation is Insecure: Category Inference Attack on Federated Learning
Gao, J., Hou, B., Guo, X., Liu, Z., Zhang, Y., Chen, K., & Li, J. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3128679 · Cited by 70 · see citing works
Chen, J., Wang, H., & Shi, X. M. (2020) · Pacific Symposium on Biocomputing (PSB) · doi:10.1142/9789811232701_0003 · Cited by 66 · see citing works
Label-Only Model Inversion Attacks via Boundary Repulsion
Kahla, M., Chen, S., Just, H. A., & Jia, R. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01462 · Cited by 69 · see citing works
A Survey of Generative Adversarial Networks for Synthesizing Structured Electronic Health Records
Ghosheh, G. O., Li, J., & Zhu, T. (2024) · ACM Computing Surveys · doi:10.1145/3636424 · Cited by 95 · see citing works
Membership Inference Attacks and Defenses in Classification Models
Li, J., Li, N., & Ribeiro, B. (2021) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3422337.3447836 · Cited by 68 · see citing works
Kossen, T., Subramaniam, P., Madai, V. I., Hennemuth, A., Hildebrand, K., Hilbert, A., Sobesky, J., Livne, M., Galinović, I., Khalil, A. A., et al. (2021) · Computers in Biology and Medicine · doi:10.1016/j.compbiomed.2021.104254 · Cited by 64 · see citing works
A Critical Overview of Privacy in Machine Learning
Cristofaro, E. D. (2021) · IEEE Security & Privacy · doi:10.1109/msec.2021.3076443 · Cited by 63 · see citing works
Adversarial interference and its mitigations in privacy-preserving collaborative machine learning
Usynin, D., Ziller, A., Makowski, M. R., Braren, R., Rueckert, D., Glocker, B., Kaissis, G. A., & Passerat‐Palmbach, J. (2021) · Nature Machine Intelligence · doi:10.1038/s42256-021-00390-3 · Cited by 64 · see citing works
Using Highly Compressed Gradients in Federated Learning for Data Reconstruction Attacks
Yang, H., Ge, M., Xiang, K., & Li, J. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3227761 · Cited by 62 · see citing works
Efficiently Stealing your Machine Learning Models
Reith, R. N., Schneider, T. H., & Tkachenko, O. (2019) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/3338498.3358646 · Cited by 56 · see citing works
Attack-Resistant Federated Learning with Residual-based ReweightingPreprint
Fu, S., Xie, C., Li, B., & Chen, Q. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.11464 · Cited by 78 · see citing works
Optimizing Privacy-Preserving Outsourced Convolutional Neural Network Predictions
Li, M., Chow, S. S. M., Hu, S., Yan, Y., Shen, C. Q., & Wang, Q. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3029899 · Cited by 59 · see citing works
Defending Model Inversion and Membership Inference Attacks via Prediction PurificationPreprint
Yang, Z., Shao, B., Xuan, B., Chang, E., & Zhang, F. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.03915 · Cited by 74 · see citing works
RDP-GAN: A Rényi-Differential Privacy Based Generative Adversarial Network
Ma, C., Li, J., Ding, M., Liu, B., Wei, K., Weng, J., & Poor, H. V. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3233580 · Cited by 59 · see citing works
Generative AI model privacy: a survey
Liu, Y., Huang, J., Li, Y., Wang, D., & Xiao, B. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-11024-6 · Cited by 65 · see citing works
Naseri, M., Hayes, J., & Cristofaro, E. D. (2020) · arXiv (Cornell University) · Cited by 54 · see citing works
Self-citationImproved Gradient Inversion Attacks and Defenses in Federated Learning
Geng, J., Mou, Y., Li, Q., Li, F., Beyan, O., Decker, S., & Rong, C. (2023) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2023.3239116 · Cited by 53 · see citing works
Visual privacy attacks and defenses in deep learning: a survey
Zhang, G., Liu, B., Zhu, T., Zhou, A., & Zhou, W. (2022) · Artificial Intelligence Review · doi:10.1007/s10462-021-10123-y · Cited by 53 · see citing works
Generative adversarial networks in time series: A survey and taxonomyPreprint
Brophy, E., Wang, Z., She, Q., & Ward, T. E. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2107.11098 · Cited by 50 · see citing works
An Overview of Privacy in Machine LearningPreprint
Cristofaro, E. D. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.08679 · Cited by 91 · see citing works
Privacy Amplification for Federated Learning via User Sampling and Wireless Aggregation
Seif, M., Chang, W.-T., & Tandon, R. (2021) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2021.3118408 · Cited by 49 · see citing works
On the (In)Feasibility of Attribute Inference Attacks on Machine Learning Models
Zhao, B. Z. H., Agrawal, A., Coburn, C., Asghar, H. J., Bhaskar, R., Kâafar, M. A., Webb, D., & Dickinson, P. (2021) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp51992.2021.00025 · Cited by 46 · see citing works
Privacy-Enhanced Decentralized Federated Learning at Dynamic Edge
Chen, S., Wang, Y., Yu, D., Ren, J., Xu, C., & Zheng, Y. (2023) · IEEE Transactions on Computers · doi:10.1109/tc.2023.3239542 · Cited by 43 · see citing works
Membership Inference Attacks against Diffusion Models
Matsumoto, T., Miura, T., & Yanai, N. (2023) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw59333.2023.00013 · Cited by 46 · see citing works
Label-Only Membership Inference Attacks and Defenses in Semantic Segmentation Models
Zhang, G., Liu, B., Zhu, T., Ding, M., & Zhou, W. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3154029 · Cited by 42 · see citing works
Cancelable Permutation-Based Indexing for Secure and Efficient Biometric Identification
Murakami, T., Fujita, R., Ohki, T., Kaga, Y., Fujio, M., & Takahashi, K. (2019) · IEEE Access · doi:10.1109/access.2019.2908456 · Cited by 41 · see citing works
privGAN: Protecting GANs from membership inference attacks at low cost to utility
Mukherjee, S., Xu, Y., Trivedi, A., Patowary, N., & Ferres, J. L. (2021) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2021-0041 · Cited by 58 · see citing works
SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learning
Salem, A., Cherubin, G., Evans, D. M., Köpf, B., Paverd, A., Suri, A., Tople, S., & Zanella-Béguelin, S. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179281 · Cited by 44 · see citing works
Federated Learning for Smart Grid: A Survey on Applications and Potential Vulnerabilities
Zhang, Z., Rath, S., Xu, J., & Xiao, T. (2025) · ACM Transactions on Cyber-Physical Systems · doi:10.1145/3760788 · Cited by 60 · see citing works
Stealing Machine Learning Models: Attacks and Countermeasures for Generative Adversarial Networks
Hu, H., & Pang, J. (2021) · Annual Computer Security Applications Conference · doi:10.1145/3485832.3485838 · Cited by 43 · see citing works
Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble ArchitecturePreprint
Tang, X., Mahloujifar, S., Song, L., Shejwalkar, V., Nasr, M., Houmansadr, A., & Mittal, P. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.08324 · Cited by 40 · see citing works
PPA: Preference Profiling Attack Against Federated Learning
Zhou, C., Gao, Y., Fu, A., Chen, K., Dai, Z., Zhang, Z., Xue, M., & Zhang, Y. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.23171 · Cited by 38 · see citing works
CrowdGuard: Federated Backdoor Detection in Federated Learning
Rieger, P., Krauß, T., Miettinen, M., Dmitrienko, A., & Sadeghi, A.-R. (2024) · Proceedings 2024 Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.23233 · Cited by 36 · see citing works
Label-Only Membership Inference Attack against Node-Level Graph Neural Networks
Conti, M., Li, J., Picek, S., & Xu, J. (2022) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3560830.3563734 · Cited by 37 · see citing works
A federated learning scheme meets dynamic differential privacy
Guo, S., Wang, X., Long, S., Liu, H., Liu, H., & Sam, T. H. (2023) · CAAI Transactions on Intelligence Technology · doi:10.1049/cit2.12187 · Cited by 35 · see citing works
A survey on membership inference attacks and defenses in machine learning
Niu, J., Liu, P., Zhu, X., Shen, K., Wang, Y., Chi, H., Shen, Y., Jiang, X., Ma, J., & Zhang, Y. (2024) · Journal of Information and Intelligence · doi:10.1016/j.jiixd.2024.02.001 · Cited by 40 · see citing works
Attacks and Defenses for Generative Diffusion Models: A Comprehensive Survey
Truong, V. T., Dang, L., & Le, L. B. (2025) · ACM Computing Surveys · doi:10.1145/3721479 · Cited by 41 · see citing works
Chen, J., Wang, H., Gao, H., & Shi, X. M. (2021) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3447548.3467445 · Cited by 35 · see citing works
Resisting membership inference attacks through knowledge distillation
Zheng, J., Cao, Y., & Wang, H. (2021) · Neurocomputing · doi:10.1016/j.neucom.2021.04.082 · Cited by 33 · see citing works
SoK: Privacy-Preserving Data Synthesis
Hu, Y., Wu, F., Li, Q., Long, Y., Garrido, G. M., Ge, C., Ding, B., Forsyth, D. A., Li, B., & Song, D. X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00002 · Cited by 36 · see citing works
Deep convolutional and conditional neural networks for large-scale genomic data generation
Yelmen, B., Decelle, A., Boulos, L. L., Szatkownik, A., Furtlehner, C., Charpiat, G., & Jay, F. (2023) · PLoS Computational Biology · doi:10.1371/journal.pcbi.1011584 · Cited by 29 · see citing works
Privacy attacks against deep learning models and their countermeasures
Shafee, A. A., & Awaad, T. A. (2020) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2020.101940 · Cited by 29 · see citing works
Differentially Private Synthetic Data: Applied Evaluations and EnhancementsPreprint
Rosenblatt, L., Liu, X., Pouyanfar, S., de Leon, E., Desai, A., & Allen, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.05537 · Cited by 45 · see citing works
Federated learning for generating synthetic data: a scoping review
Little, C. L., Elliot, M. J., & Allmendinger, R. (2023) · International Journal for Population Data Science · doi:10.23889/ijpds.v8i1.2158 · Cited by 28 · see citing works
- Authors
- Hayes, J., Melis, L., Danezis, G., & De Cristofaro, E.
- Affiliations
- University College London (GB)
- University College London
- Venue
- Proceedings on Privacy Enhancing Technologies
- Published
- 2018-12-24
- Volume
- 2019
- Issue
- 1
- Pages
- 133-152
- ISSN
- 2299-0984 (ISSN-L)
- OpenAlex
- W2887995258
- Cited by
- 433
- References
- 64
- Citations by year
- 2026: 31 · 2025: 46 · 2024: 62 · 2023: 74 · 2022: 69 · 2021: 68 · 2020: 54 · 2019: 27 · 2018: 2
- FWCI
- 21.13
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Proceedings on Privacy Enhancing Technologies (publishedVersion, cc-by-nc-nd)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- membership inference attacks, generative models, generative adversarial networks, privacy attacks, overfitting detection, black-box attacks, white-box attacks, defense robustness, training data privacy, medical image privacy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
