{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,5]],"date-time":"2026-05-05T02:49:11Z","timestamp":1777949351638,"version":"3.51.4"},"publisher-location":"Cham","reference-count":49,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032160881","type":"print"},{"value":"9783032160898","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-16089-8_3","type":"book-chapter","created":{"date-parts":[[2026,5,3]],"date-time":"2026-05-03T23:27:31Z","timestamp":1777850851000},"page":"32-48","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Membership Inference Attacks Beyond Overfitting"],"prefix":"10.1007","author":[{"given":"Mona","family":"Khalil","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Alberto","family":"Blanco-Justicia","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Najeeb","family":"Jebreel","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Josep","family":"Domingo-Ferrer","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,5,1]]},"reference":[{"key":"3_CR1","doi-asserted-by":"crossref","unstructured":"Abadi, M., et al.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308\u2013318 (2016)","DOI":"10.1145\/2976749.2978318"},{"issue":"8","key":"3_CR2","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3547139","volume":"55","author":"A Blanco-Justicia","year":"2022","unstructured":"Blanco-Justicia, A., S\u00e1nchez, D., Domingo-Ferrer, J., Muralidhar, K.: A critical review on the use (and misuse) of differential privacy in machine learning. ACM Comput. Surv. 55(8), 1\u201316 (2022)","journal-title":"ACM Comput. Surv."},{"key":"3_CR3","doi-asserted-by":"crossref","unstructured":"Bourtoule, L., et al.: Machine unlearning. In: 2021 IEEE Symposium on Security and Privacy (SP), pp. 141\u2013159. IEEE (2021)","DOI":"10.1109\/SP40001.2021.00019"},{"key":"3_CR4","doi-asserted-by":"crossref","unstructured":"Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., Tramer, F.: Membership inference attacks from first principles. In: 2022 IEEE Symposium on Security and Privacy (SP), pp. 1897\u20131914. IEEE (2022)","DOI":"10.1109\/SP46214.2022.9833649"},{"key":"3_CR5","unstructured":"Carlini, N., Liu, C., Erlingsson, \u00da., Kos, J., Song, D.: The secret sharer: Evaluating and testing unintended memorization in neural networks. In: 28th USENIX security symposium (USENIX security 19), pp. 267\u2013284 (2019)"},{"key":"3_CR6","unstructured":"Carlini, N., et al.: Extracting training data from large language models. In: 30th USENIX Security Symposium (USENIX Security 21), pp. 2633\u20132650 (2021)"},{"key":"3_CR7","doi-asserted-by":"crossref","unstructured":"Caruana, R., Lawrence, S., Giles, C.: Overfitting in neural nets: backpropagation, conjugate gradient, and early stopping. In: Advances in Neural Information Processing Systems, vol. 13 (2000)","DOI":"10.1109\/IJCNN.2000.857823"},{"key":"3_CR8","doi-asserted-by":"crossref","unstructured":"Dealcala, D., Mancera, G., Morales, A., Fierrez, J., Tolosana, R., Ortega-Garcia, J.: A comprehensive analysis of factors impacting membership inference. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 3585\u20133593 (2024)","DOI":"10.1109\/CVPRW63382.2024.00362"},{"key":"3_CR9","unstructured":"Devlin, J., Chang, M.W., Lee, K., Toutanova, K.: Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 (2018)"},{"key":"3_CR10","doi-asserted-by":"publisher","first-page":"241","DOI":"10.1007\/s11704-019-8208-z","volume":"14","author":"X Dong","year":"2020","unstructured":"Dong, X., Yu, Z., Cao, W., Shi, Y., Ma, Q.: A survey on ensemble learning. Front. Comp. Sci. 14, 241\u2013258 (2020)","journal-title":"Front. Comp. Sci."},{"key":"3_CR11","doi-asserted-by":"crossref","unstructured":"Dwork, C.: Differential privacy. In: International colloquium on automata, languages, and programming. pp. 1\u201312. Springer (2006)","DOI":"10.1007\/11787006_1"},{"key":"3_CR12","doi-asserted-by":"crossref","unstructured":"Feldman, V.: Does learning require memorization? a short tale about a long tail. In: Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, pp. 954\u2013959 (2020)","DOI":"10.1145\/3357713.3384290"},{"key":"3_CR13","doi-asserted-by":"crossref","unstructured":"Ganju, K., Wang, Q., Yang, W., Gunter, C.A., Borisov, N.: Property inference attacks on fully connected neural networks using permutation invariant representations. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 619\u2013633 (2018)","DOI":"10.1145\/3243734.3243834"},{"key":"3_CR14","unstructured":"Ginart, A., Guan, M., Valiant, G., Zou, J.Y.: Making ai forget you: Data deletion in machine learning. In: Advances in Neural Information Processing Systems, vol. 32 (2019)"},{"key":"3_CR15","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770\u2013778 (2016)","DOI":"10.1109\/CVPR.2016.90"},{"issue":"11s","key":"3_CR16","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3523273","volume":"54","author":"H Hu","year":"2022","unstructured":"Hu, H., Salcic, Z., Sun, L., Dobbie, G., Yu, P.S., Zhang, X.: Membership inference attacks on machine learning: a survey. ACM Comput. Surv. (CSUR) 54(11s), 1\u201337 (2022)","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"3_CR17","doi-asserted-by":"crossref","unstructured":"Huang, G., Liu, Z., Van Der Maaten, L., Weinberger, K.Q.: Densely connected convolutional networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4700\u20134708 (2017)","DOI":"10.1109\/CVPR.2017.243"},{"key":"3_CR18","unstructured":"Jayaraman, B., Evans, D.: Evaluating differentially private machine learning in practice. In: 28th USENIX Security Symposium (USENIX Security 19), pp. 1895\u20131912 (2019)"},{"key":"3_CR19","doi-asserted-by":"crossref","unstructured":"Jia, J., Salem, A., Backes, M., Zhang, Y., Gong, N.Z.: Memguard: defending against black-box membership inference attacks via adversarial examples. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 259\u2013274 (2019)","DOI":"10.1145\/3319535.3363201"},{"key":"3_CR20","doi-asserted-by":"crossref","unstructured":"Kemelmacher-Shlizerman, I., Seitz, S.M., Miller, D., Brossard, E.: The megaface benchmark: 1 million faces for recognition at scale. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4873\u20134882 (2016)","DOI":"10.1109\/CVPR.2016.527"},{"key":"3_CR21","doi-asserted-by":"publisher","first-page":"8","DOI":"10.1016\/j.csbj.2014.11.005","volume":"13","author":"K Kourou","year":"2015","unstructured":"Kourou, K., Exarchos, T.P., Exarchos, K.P., Karamouzis, M.V., Fotiadis, D.I.: Machine learning applications in cancer prognosis and prediction. Comput. Struct. Biotechnol. J. 13, 8\u201317 (2015)","journal-title":"Comput. Struct. Biotechnol. J."},{"key":"3_CR22","unstructured":"Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)"},{"key":"3_CR23","doi-asserted-by":"crossref","unstructured":"LeCun, Y., Bengio, Y., Hinton, G.: Deep learning. Nature 521(7553), 436\u2013444 (2015)N","DOI":"10.1038\/nature14539"},{"key":"3_CR24","doi-asserted-by":"crossref","unstructured":"Liu, Y., Zhao, Z., Backes, M., Zhang, Y.: Membership inference attacks by exploiting loss trajectory. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp. 2085\u20132098 (2022)","DOI":"10.1145\/3548606.3560684"},{"key":"3_CR25","doi-asserted-by":"crossref","unstructured":"Long, Y., et al.: A pragmatic approach to membership inferences on machine learning models. In: 2020 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 521\u2013534. IEEE (2020)","DOI":"10.1109\/EuroSP48549.2020.00040"},{"key":"3_CR26","unstructured":"Maaten, L.v.d., Hinton, G.: Visualizing data using t-sne. J. Mach. Learn. Res. 9(Nov), 2579\u20132605 (2008)"},{"issue":"6","key":"3_CR27","doi-asserted-by":"publisher","first-page":"1236","DOI":"10.1093\/bib\/bbx044","volume":"19","author":"R Miotto","year":"2018","unstructured":"Miotto, R., Wang, F., Wang, S., Jiang, X., Dudley, J.T.: Deep learning for healthcare: review, opportunities and challenges. Brief. Bioinform. 19(6), 1236\u20131246 (2018)","journal-title":"Brief. Bioinform."},{"key":"3_CR28","doi-asserted-by":"crossref","unstructured":"Nasr, M., Shokri, R., Houmansadr, A.: Machine learning with membership privacy using adversarial regularization. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 634\u2013646 (2018)","DOI":"10.1145\/3243734.3243855"},{"key":"3_CR29","doi-asserted-by":"crossref","unstructured":"Nasr, M., Shokri, R., Houmansadr, A.: Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In: 2019 IEEE symposium on security and privacy (SP), pp. 739\u2013753. IEEE (2019)","DOI":"10.1109\/SP.2019.00065"},{"issue":"3","key":"3_CR30","doi-asserted-by":"publisher","first-page":"559","DOI":"10.1016\/j.dss.2010.08.006","volume":"50","author":"EW Ngai","year":"2011","unstructured":"Ngai, E.W., Hu, Y., Wong, Y.H., Chen, Y., Sun, X.: The application of data mining techniques in financial fraud detection: A classification framework and an academic review of literature. Decis. Support Syst. 50(3), 559\u2013569 (2011)","journal-title":"Decis. Support Syst."},{"key":"3_CR31","unstructured":"Papernot, N., Song, S., Mironov, I., Raghunathan, A., Talwar, K., Erlingsson, \u00da.: Scalable private learning with pate. arXiv preprint arXiv:1802.08908 (2018)"},{"key":"3_CR32","doi-asserted-by":"publisher","first-page":"1113","DOI":"10.1613\/jair.1.14649","volume":"77","author":"N Ponomareva","year":"2023","unstructured":"Ponomareva, N., et al.: How to dp-fy ml: A practical guide to machine learning with differential privacy. J. Artif. Intell. Res. 77, 1113\u20131201 (2023)","journal-title":"J. Artif. Intell. Res."},{"key":"3_CR33","unstructured":"Rahimian, S., Orekondy, T., Fritz, M.: Sampling attacks: Amplification of membership inference attacks by repeated queries. arXiv preprint arXiv:2009.00395 (2020)"},{"key":"3_CR34","unstructured":"Sablayrolles, A., Douze, M., Schmid, C., Ollivier, Y., J\u00e9gou, H.: White-box vs black-box: bayes optimal strategies for membership inference. In: International Conference on Machine Learning, pp. 5558\u20135567. PMLR (2019)"},{"key":"3_CR35","doi-asserted-by":"crossref","unstructured":"Salem, A., Zhang, Y., Humbert, M., Fritz, M., Backes, M.: Ml-leaks: model and data independent membership inference attacks and defenses on machine learning models. In: Network and Distributed Systems Security Symposium 2019. Internet Society (2019)","DOI":"10.14722\/ndss.2019.23119"},{"key":"3_CR36","doi-asserted-by":"crossref","unstructured":"Selvaraju, R.R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., Batra, D.: Grad-cam: visual explanations from deep networks via gradient-based localization. In: Proceedings of the IEEE International Conference on Computer Vision, pp. 618\u2013626 (2017)","DOI":"10.1109\/ICCV.2017.74"},{"key":"3_CR37","doi-asserted-by":"crossref","unstructured":"Shejwalkar, V., Houmansadr, A.: Membership privacy for machine learning models through knowledge transfer. In: Proceedings of the AAAI conference on artificial intelligence, vol. 35, pp. 9549\u20139557 (2021)","DOI":"10.1609\/aaai.v35i11.17150"},{"key":"3_CR38","doi-asserted-by":"crossref","unstructured":"Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks against machine learning models. In: 2017 IEEE symposium on security and privacy (SP), pp. 3\u201318. IEEE (2017)","DOI":"10.1109\/SP.2017.41"},{"issue":"1","key":"3_CR39","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s40537-019-0197-0","volume":"6","author":"C Shorten","year":"2019","unstructured":"Shorten, C., Khoshgoftaar, T.M.: A survey on image data augmentation for deep learning. J. Big Data 6(1), 1\u201348 (2019)","journal-title":"J. Big Data"},{"key":"3_CR40","doi-asserted-by":"crossref","unstructured":"Song, C., Ristenpart, T., Shmatikov, V.: Machine learning models that remember too much. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 587\u2013601 (2017)","DOI":"10.1145\/3133956.3134077"},{"key":"3_CR41","unstructured":"Song, L., Mittal, P.: Systematic evaluation of privacy risks of machine learning models. In: 30th USENIX Security Symposium (USENIX Security 21), pp. 2615\u20132632 (2021)"},{"issue":"1","key":"3_CR42","first-page":"1929","volume":"15","author":"N Srivastava","year":"2014","unstructured":"Srivastava, N., Hinton, G., Krizhevsky, A., Sutskever, I., Salakhutdinov, R.: Dropout: a simple way to prevent neural networks from overfitting. J. Mach. Learn. Res. 15(1), 1929\u20131958 (2014)","journal-title":"J. Mach. Learn. Res."},{"key":"3_CR43","doi-asserted-by":"crossref","unstructured":"Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., Wojna, Z.: Rethinking the inception architecture for computer vision. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2818\u20132826 (2016)","DOI":"10.1109\/CVPR.2016.308"},{"key":"3_CR44","unstructured":"Tang, X., Mahloujifar, S., Song, L., Shejwalkar, V., Nasr, M., Houmansadr, A., Mittal, P.: Mitigating membership inference attacks by $$\\{$$Self-Distillation$$\\}$$ through a novel ensemble architecture. In: 31st USENIX Security Symposium (USENIX Security 22), pp. 1433\u20131450 (2022)"},{"issue":"9","key":"3_CR45","first-page":"4555","volume":"44","author":"X Wang","year":"2021","unstructured":"Wang, X., Chen, Y., Zhu, W.: A survey on curriculum learning. IEEE Trans. Pattern Anal. Mach. Intell. 44(9), 4555\u20134576 (2021)","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"3_CR46","unstructured":"Wei, J., et al.: Memorization in deep learning: a survey. arXiv preprint arXiv:2406.03880 (2024)"},{"key":"3_CR47","doi-asserted-by":"crossref","unstructured":"Yeom, S., Giacomelli, I., Fredrikson, M., Jha, S.: Privacy risk in machine learning: Analyzing the connection to overfitting. In: 2018 IEEE 31st Computer Security Foundations Symposium (CSF), pp. 268\u2013282. IEEE (2018)","DOI":"10.1109\/CSF.2018.00027"},{"issue":"3","key":"3_CR48","doi-asserted-by":"publisher","first-page":"107","DOI":"10.1145\/3446776","volume":"64","author":"C Zhang","year":"2021","unstructured":"Zhang, C., Bengio, S., Hardt, M., Recht, B., Vinyals, O.: Understanding deep learning (still) requires rethinking generalization. Commun. ACM 64(3), 107\u2013115 (2021)","journal-title":"Commun. ACM"},{"key":"3_CR49","unstructured":"Zhang, H., Cisse, M., Dauphin, Y.N., Lopez-Paz, D.: mixup: Beyond empirical risk minimization. arXiv preprint arXiv:1710.09412 (2017)"}],"container-title":["Lecture Notes in Computer Science","Computer Security. ESORICS 2025 International Workshops"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-16089-8_3","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,3]],"date-time":"2026-05-03T23:27:34Z","timestamp":1777850854000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-16089-8_3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032160881","9783032160898"],"references-count":49,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-16089-8_3","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"1 May 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"The authors have no competing interests to declare that are relevant to the content of this article.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Disclosure of Interests"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Toulouse","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"France","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22 September 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 September 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"30","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/www.esorics2025.org\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}