{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,26]],"date-time":"2026-06-26T13:51:02Z","timestamp":1782481862040,"version":"3.54.5"},"publisher-location":"Cham","reference-count":46,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032008909","type":"print"},{"value":"9783032008916","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,8,7]],"date-time":"2025-08-07T00:00:00Z","timestamp":1754524800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,8,7]],"date-time":"2025-08-07T00:00:00Z","timestamp":1754524800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-00891-6_12","type":"book-chapter","created":{"date-parts":[[2025,8,6]],"date-time":"2025-08-06T09:03:04Z","timestamp":1754470984000},"page":"145-159","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Defenses Against Membership Inference Attacks on\u00a0Unlearned Data"],"prefix":"10.1007","author":[{"given":"Josep","family":"Domingo-Ferrer","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Najeeb","family":"Jebreel","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"S\u00e1nchez","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,8,7]]},"reference":[{"key":"12_CR1","doi-asserted-by":"crossref","unstructured":"Abadi, M., et al.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308\u2013318 (2016)","DOI":"10.1145\/2976749.2978318"},{"key":"12_CR2","doi-asserted-by":"crossref","unstructured":"Bertran, M., et al.: Scalable membership inference attacks via quantile regression. In: Advances in Neural Information Processing Systems, vol. 36 (2024)","DOI":"10.52202\/075280-0016"},{"issue":"3","key":"12_CR3","doi-asserted-by":"publisher","first-page":"90","DOI":"10.1007\/s10462-024-11078-6","volume":"58","author":"A Blanco-Justicia","year":"2025","unstructured":"Blanco-Justicia, A., et al.: Digital forgetting in large language models: a survey of unlearning methods. Artif. Intell. Rev. 58(3), 90 (2025)","journal-title":"Artif. Intell. Rev."},{"issue":"8","key":"12_CR4","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3547139","volume":"55","author":"A Blanco-Justicia","year":"2022","unstructured":"Blanco-Justicia, A., S\u00e1nchez, D., Domingo-Ferrer, J., Muralidhar, K.: A critical review on the use (and misuse) of differential privacy in machine learning. ACM Comput. Surv. 55(8), 1\u201316 (2022)","journal-title":"ACM Comput. Surv."},{"key":"12_CR5","doi-asserted-by":"crossref","unstructured":"Bourtoule, L., et al.:. Machine unlearning. In: 2021 IEEE Symposium on Security and Privacy (SP), pp. 141\u2013159. IEEE (2021)","DOI":"10.1109\/SP40001.2021.00019"},{"key":"12_CR6","doi-asserted-by":"crossref","unstructured":"Cao, Y., Yang, J.: Towards making systems forget with machine unlearning. In: 2015 IEEE Symposium on Security and Privacy, pp. 463\u2013480. IEEE (2015)","DOI":"10.1109\/SP.2015.35"},{"key":"12_CR7","doi-asserted-by":"crossref","unstructured":"Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., Tramer, F.: Membership inference attacks from first principles. In: 2022 IEEE Symposium on Security and Privacy (SP), pp. 1897\u20131914. IEEE (2022)","DOI":"10.1109\/SP46214.2022.9833649"},{"key":"12_CR8","unstructured":"Carlini, N., et\u00a0al. Extracting training data from large language models. In: 30th USENIX Security Symposium (USENIX Security 21), pp. 2633\u20132650 (2021)"},{"key":"12_CR9","doi-asserted-by":"crossref","unstructured":"Chen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., Zhang, Y.: When machine unlearning jeopardizes privacy. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 896\u2013911 (2021)","DOI":"10.1145\/3460120.3484756"},{"key":"12_CR10","doi-asserted-by":"crossref","unstructured":"Chien, E., Wang, H., Chen, Z., Li, P.: Langevin unlearning: A new perspective of noisy gradient descent for machine unlearning. In: The Thirty-eighth Annual Conference on Neural Information Processing Systems (2024)","DOI":"10.52202\/079017-2530"},{"key":"12_CR11","unstructured":"Choquette-Choo, C. A., Tramer, F., Carlini, N., Papernot, N.: Label-only membership inference attacks. In: International Conference on Machine Learning, pp. 1964\u20131974. PMLR (2021)"},{"key":"12_CR12","unstructured":"Chourasia, R., Shah, N.: Forget unlearning: towards true data-deletion in machine learning. In: International Conference on Machine Learning, pp. 6028\u20136073. PMLR (2023)"},{"key":"12_CR13","doi-asserted-by":"crossref","unstructured":"DeAlcala, D., Mancera, G., Morales, A., Fierrez, J., Tolosana, R., Ortega-Garcia, J.: A comprehensive analysis of factors impacting membership inference. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 3585\u20133593 (2024)","DOI":"10.1109\/CVPRW63382.2024.00362"},{"key":"12_CR14","doi-asserted-by":"crossref","unstructured":"Dwork, C., McSherry, F., Nissim, K., Smith, A.: Calibrating noise to sensitivity in private data analysis. In: Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pp. 265\u2013284. Springer (2006)","DOI":"10.1007\/11681878_14"},{"key":"12_CR15","unstructured":"European Parliament and Council of the European Union. Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (General Data Protection Regulation). https:\/\/data.europa.eu\/eli\/reg\/2016\/679\/oj, 2016"},{"key":"12_CR16","doi-asserted-by":"crossref","unstructured":"Fredrikson, M., Jha, S., Ristenpart, T.: Model inversion attacks that exploit confidence information and basic countermeasures. In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp. 1322\u20131333 (2015)","DOI":"10.1145\/2810103.2813677"},{"key":"12_CR17","unstructured":"Ginart, A., Guan, M., Valiant, G., Zou, J.Y.: Making AI forget you: data deletion in machine learning. In: Advances in Neural Information Processing Systems, vol. 32 (2019)"},{"key":"12_CR18","doi-asserted-by":"crossref","unstructured":"Golatkar, A., Achille, A., Soatto, S.: Eternal sunshine of the spotless net: selective forgetting in deep networks. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 9304\u20139312 (2020)","DOI":"10.1109\/CVPR42600.2020.00932"},{"key":"12_CR19","unstructured":"Guo, C., Goldstein, T., Hannun, A., Van Der Maaten, L.: Certified data removal from machine learning models. In: Proceedings of the 37th International Conference on Machine Learning, pp. 3832\u20133842 (2020)"},{"key":"12_CR20","unstructured":"Gupta, V., Jung, C., Neel, S., Roth, A., Sharifi-Malvajerdi, S., Waites, C.: Adaptive machine unlearning. In: Advances in Neural Information Processing Systems, vol. 34, pp. 16319\u201316330 (2021)"},{"key":"12_CR21","unstructured":"Ilharco, G., et al.: Editing models with task arithmetic. In: The Eleventh International Conference on Learning Representations (2023)"},{"issue":"4","key":"12_CR22","doi-asserted-by":"publisher","first-page":"295","DOI":"10.1016\/0893-6080(88)90003-2","volume":"1","author":"RA Jacobs","year":"1988","unstructured":"Jacobs, R.A.: Increased rates of convergence through learning rate adaptation. Neural Netw. 1(4), 295\u2013307 (1988)","journal-title":"Neural Netw."},{"key":"12_CR23","doi-asserted-by":"crossref","unstructured":"Jang, J.: Knowledge unlearning for mitigating privacy risks in language models. In: Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 14389\u201314408. Association for Computational Linguistics (2023)","DOI":"10.18653\/v1\/2023.acl-long.805"},{"key":"12_CR24","unstructured":"Krogh, A., Hertz, J.: A simple weight decay can improve generalization. In: Advances in Neural Information Processing Systems, vol. 4 (1991)"},{"key":"12_CR25","doi-asserted-by":"crossref","unstructured":"Kurmanji, M., Triantafillou, P., Hayes, J., Triantafillou, E.: Towards unbounded machine unlearning. In: Advances in Neural Information Processing Systems, vol. 36, pp. 1957\u20131987 (2023)","DOI":"10.52202\/075280-0095"},{"key":"12_CR26","doi-asserted-by":"crossref","unstructured":"Lee, S., Choi, D.H.: Learning and unlearning to operate profitable secure electric vehicle charging. IEEE Trans. Ind. Inf. (2024)","DOI":"10.1109\/TII.2024.3396524"},{"key":"12_CR27","doi-asserted-by":"crossref","unstructured":"Li, Z., Zhang, Y.: Membership leakage in label-only exposures. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 880\u2013895 (2021)","DOI":"10.1145\/3460120.3484575"},{"issue":"11","key":"12_CR28","doi-asserted-by":"publisher","first-page":"9424","DOI":"10.1002\/int.23000","volume":"37","author":"L Zhaobo","year":"2022","unstructured":"Zhaobo, L., Liang, H., Zhao, M., Lv, Q., Liang, T., Wang, Y.: Label-only membership inference attacks on machine unlearning without dependence of posteriors. Int. J. Intell. Syst. 37(11), 9424\u20139441 (2022)","journal-title":"Int. J. Intell. Syst."},{"key":"12_CR29","unstructured":"State of\u00a0California Department\u00a0of Justice. California consumer privacy act (ccpa) | state of california - department of justice - office of the attorney general (2018). https:\/\/oag.ca.gov\/privacy\/ccpa. Accessed 08 Mar 2024"},{"key":"12_CR30","unstructured":"Papernot, N., Abadi, M., Erlingsson, U., Goodfellow, I., Talwar, K.: Semi-supervised knowledge transfer for deep learning from private training data. In: International Conference on Learning Representations (2017)"},{"key":"12_CR31","doi-asserted-by":"crossref","unstructured":"Prechelt, L.: Early stopping-but when? In: Neural Networks: Tricks of the Trade, pp. 55\u201369. Springer (2002)","DOI":"10.1007\/3-540-49430-8_3"},{"key":"12_CR32","doi-asserted-by":"crossref","unstructured":"Qu, Y., Yuan, X., Ding, M., Ni, W., Rakotoarivelo, T., Smith, D.: Learn to unlearn: a survey on machine unlearning. arXiv preprint: arXiv:2305.07512 (2023)","DOI":"10.1109\/MC.2023.3333319"},{"key":"12_CR33","doi-asserted-by":"crossref","unstructured":"Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., Backes, M.: Ml-leaks: model and data independent membership inference attacks and defenses on machine learning models. In: Network and Distributed Systems Security Symposium 2019. Internet Society (2019)","DOI":"10.14722\/ndss.2019.23119"},{"key":"12_CR34","unstructured":"Sekhari, A., Acharya, J., Kamath, G., Suresh, A.T.: Remember what you want to forget: Algorithms for machine unlearning. In: Advances in Neural Information Processing Systems, vol. 34, pp. 18075\u201318086 (2021)"},{"key":"12_CR35","doi-asserted-by":"crossref","unstructured":"Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks against machine learning models. In: 2017 IEEE Symposium on Security and Privacy (SP), pp. 3\u201318. IEEE (2017)","DOI":"10.1109\/SP.2017.41"},{"issue":"1","key":"12_CR36","first-page":"1929","volume":"15","author":"N Srivastava","year":"2014","unstructured":"Srivastava, N., Hinton, G., Krizhevsky, A., Sutskever, I., Salakhutdinov, R.: Dropout: a simple way to prevent neural networks from overfitting. J. Mach. Learn. Res. 15(1), 1929\u20131958 (2014)","journal-title":"J. Mach. Learn. Res."},{"key":"12_CR37","doi-asserted-by":"crossref","unstructured":"Sula, N., Kumar, A., Hou, J., Wang, H., Tourani, R.: Silver linings in the shadows: harnessing membership inference for machine unlearning. arXiv preprint: arXiv:2407.00866 (2024)","DOI":"10.1109\/CNS66487.2025.11195030"},{"key":"12_CR38","unstructured":"Ullah, E., Mai, T., Rao, A., Rossi, R.A., Arora, R.: Machine unlearning via algorithmic stability. In: Conference on Learning Theory, pp. 4126\u20134142. PMLR (2021)"},{"key":"12_CR39","unstructured":"Watson, L., Guo, C., Cormode, G., Sablayrolles, A.: On the importance of difficulty calibration in membership inference attacks. In: International Conference on Learning Representations (2022)"},{"key":"12_CR40","doi-asserted-by":"crossref","unstructured":"Wu, X., et al.: DEPN: detecting and editing privacy neurons in pretrained language models. In: The 2023 Conference on Empirical Methods in Natural Language Processing (2023)","DOI":"10.18653\/v1\/2023.emnlp-main.174"},{"key":"12_CR41","doi-asserted-by":"crossref","unstructured":"Yao, J., et al.: Machine unlearning of pre-trained large language models. In: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 8403\u20138419 (2024)","DOI":"10.18653\/v1\/2024.acl-long.457"},{"key":"12_CR42","doi-asserted-by":"crossref","unstructured":"Yeom, S., Giacomelli, I., Fredrikson, M., Jha, S.: Privacy risk in machine learning: analyzing the connection to overfitting. In: 2018 IEEE 31st Computer Security Foundations Symposium (CSF), pp. 268\u2013282. IEEE (2018)","DOI":"10.1109\/CSF.2018.00027"},{"key":"12_CR43","unstructured":"Zarifzadeh, S., Liu, P., Shokri, R.: Low-cost high-power membership inference attacks. In: Forty-first International Conference on Machine Learning (2024)"},{"key":"12_CR44","unstructured":"Zhang, R., Lin, L., Bai, Y., Mei, S.: Negative preference optimization: from catastrophic collapse to effective unlearning. In: First Conference on Language Modeling (2024)"},{"issue":"2","key":"12_CR45","first-page":"1","volume":"3","author":"Y Zhang","year":"2024","unstructured":"Zhang, Y., Zhiyu, H., Bai, Y., Jiancan, W., Wang, Q., Feng, F.: Recommendation unlearning via influence function. ACM Trans. Recommender Syst. 3(2), 1\u201323 (2024)","journal-title":"ACM Trans. Recommender Syst."},{"key":"12_CR46","doi-asserted-by":"crossref","unstructured":"Zhong, Z., Zheng, L., Kang, G., Li, S., Yang, Y.: Random erasing data augmentation. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, pp. 13001\u201313008 (2020)","DOI":"10.1609\/aaai.v34i07.7000"}],"container-title":["Lecture Notes in Computer Science","Modeling Decisions for Artificial Intelligence"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-00891-6_12","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,26]],"date-time":"2026-06-26T13:23:25Z","timestamp":1782480205000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-00891-6_12"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8,7]]},"ISBN":["9783032008909","9783032008916"],"references-count":46,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-00891-6_12","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,8,7]]},"assertion":[{"value":"7 August 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"MDAI","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Modeling Decisions for Artificial Intelligence","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Valencia","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Spain","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"15 September 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18 September 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"mdai2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/mdai.cat\/mdai2025\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}