{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,4]],"date-time":"2025-12-04T06:43:18Z","timestamp":1764830598000,"version":"3.46.0"},"reference-count":49,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2025,10,21]],"date-time":"2025-10-21T00:00:00Z","timestamp":1761004800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,10,21]],"date-time":"2025-10-21T00:00:00Z","timestamp":1761004800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"name":"PCL-CMCC","award":["2024ZY2B0050"],"award-info":[{"award-number":["2024ZY2B0050"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["World Wide Web"],"published-print":{"date-parts":[[2025,11]]},"DOI":"10.1007\/s11280-025-01377-5","type":"journal-article","created":{"date-parts":[[2025,10,21]],"date-time":"2025-10-21T13:23:58Z","timestamp":1761053038000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["C2DP: CLIP-conditioned knowledge distillation for membership inference privacy protection"],"prefix":"10.1007","volume":"28","author":[{"given":"Bo","family":"Yang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hui","family":"He","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zimeng","family":"Jia","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lun","family":"Xin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wei","family":"Yu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zejun","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Renhao","family":"Lu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Weizhe","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,10,21]]},"reference":[{"issue":"2","key":"1377_CR1","doi-asserted-by":"publisher","first-page":"144907","DOI":"10.1109\/ACCESS.2019.2944243","volume":"7","author":"CI Eke","year":"2019","unstructured":"Eke, C.I., Norman, A.A., Shuib, L., Nweke, H.F.: A survey of user profiling: State-of-the-art, challenges, and solutions. IEEE Access 7(2), 144907\u2013144924 (2019)","journal-title":"IEEE Access"},{"key":"1377_CR2","first-page":"1","volume":"54","author":"H Hu","year":"2020","unstructured":"Hu, H., Salcic, Z., Sun, L., Dobbie, G., Yu, P.S., Zhang, X.: Membership inference attacks on machine learning: A survey. ACM Comput. Surv. 54, 1\u201337 (2020)","journal-title":"ACM Comput. Surv."},{"key":"1377_CR3","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1162\/tacl_a_00299","volume":"8","author":"S Hisamoto","year":"2020","unstructured":"Hisamoto, S., Post, M., Duh, K.: Membership inference attacks on sequence-to-sequence models: Is my data in your machine translation system? Trans. Assoc. Comput. Linguistics 8, 49\u201363 (2020)","journal-title":"Trans. Assoc. Comput. Linguistics"},{"key":"1377_CR4","doi-asserted-by":"crossref","unstructured":"Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., Tram\u00e8r, F.: Membership inference attacks from first principles. In: Proceedings of the 43rd IEEE Symposium on Security and Privacy, SP 2022, pp. 1897\u20131914. IEEE, (2022)","DOI":"10.1109\/SP46214.2022.9833649"},{"key":"1377_CR5","unstructured":"Choquette-Choo, C.A., Tram\u00e8r, F., Carlini, N., Papernot, N.: Label-only membership inference attacks. In: Proceedings of the 38th International Conference on Machine Learning, ICML 2021, vol. 139, pp. 1964\u20131974. PMLR, (2021)"},{"key":"1377_CR6","doi-asserted-by":"crossref","unstructured":"Ye, J., Maddi, A., Murakonda, S.K., Bindschaedler, V., Shokri, R.: Enhanced membership inference attacks against machine learning models. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 2022, pp. 3093\u20133106. ACM, (2022)","DOI":"10.1145\/3548606.3560675"},{"key":"1377_CR7","doi-asserted-by":"crossref","unstructured":"Chen, D., Yu, N., Zhang, Y., Fritz, M.: GAN-Leaks: A taxonomy of membership inference attacks against generative models. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 343\u2013362. ACM, (2020)","DOI":"10.1145\/3372297.3417238"},{"key":"1377_CR8","doi-asserted-by":"crossref","unstructured":"Nasr, M., Shokri, R., Houmansadr, A.: Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In: Proceedings of the 2019 IEEE Symposium on Security and Privacy, SP 2019, pp. 739\u2013753. IEEE, (2019)","DOI":"10.1109\/SP.2019.00065"},{"issue":"4","key":"1377_CR9","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3704633","volume":"57","author":"L Bai","year":"2025","unstructured":"Bai, L., Hu, H., Ye, Q., Li, H., Wang, L., Xu, J.: Membership inference attacks and defenses in federated learning: A survey. ACM Comput. Surv. 57(4), 1\u201335 (2025)","journal-title":"ACM Comput. Surv."},{"key":"1377_CR10","doi-asserted-by":"publisher","first-page":"6441","DOI":"10.1109\/TIFS.2024.3413592","volume":"19","author":"C Wu","year":"2024","unstructured":"Wu, C., Chen, J., Fang, Q., He, K., Zhao, Z., Ren, H., Xu, G., Liu, Y., Xiang, Y.: Rethinking membership inference attacks against transfer learning. IEEE Trans. Inf. Forensics Secur. 19, 6441\u20136454 (2024)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"1377_CR11","doi-asserted-by":"crossref","unstructured":"Liu, H., Wu, Y., Yu, Z., Zhang, N.: Please tell me more: Privacy impact of explainability through the lens of membership inference attack. In: Proceedings of the IEEE Symposium on Security and Privacy, SP 2024, pp. 4791\u20134809. IEEE, (2024)","DOI":"10.1109\/SP54263.2024.00120"},{"key":"1377_CR12","doi-asserted-by":"crossref","unstructured":"Li, H., Li, Z., Wu, S., Hu, C., Ye, Y., Zhang, M., Feng, D., Zhang, Y.: SeqMIA: Sequential-metric based membership inference attack. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS 2024, pp. 3496\u20133510. ACM, (2024)","DOI":"10.1145\/3658644.3690335"},{"key":"1377_CR13","doi-asserted-by":"crossref","unstructured":"Li, Y., Liu, G., Wang, C., Yang, Y.: Generating is believing: Membership inference attacks against retrieval-augmented generation. In: Proceedings of the 2025 IEEE International Conference on Acoustics, Speech and Signal Processing, ICASSP 2025, pp. 1\u20135. IEEE, (2025)","DOI":"10.1109\/ICASSP49660.2025.10889013"},{"key":"1377_CR14","doi-asserted-by":"crossref","unstructured":"Li, Q., Fu, X., Wang, X., Liu, J., Gao, X., Dai, J., Han, J.: Unveiling structural memorization: Structural membership inference attack for text-to-image diffusion models. In: Proceedings of the 32nd ACM International Conference on Multimedia, MM 2024, pp. 10554\u201310562. ACM, (2024)","DOI":"10.1145\/3664647.3681170"},{"key":"1377_CR15","doi-asserted-by":"crossref","unstructured":"He, Y., Li, B., Wang, Y., Yang, M., Wang, J., Hu, H., Zhao, X.: Is difficulty calibration all we need? Towards more practical membership inference attacks. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS 2024, pp. 1226\u20131240. ACM, (2024)","DOI":"10.1145\/3658644.3690316"},{"key":"1377_CR16","doi-asserted-by":"publisher","first-page":"427","DOI":"10.1109\/TIFS.2023.3324772","volume":"19","author":"G Liu","year":"2024","unstructured":"Liu, G., Xu, T., Zhang, R., Wang, Z., Wang, C., Liu, L.: Gradient-leaks: Enabling black-box membership inference attacks against machine learning models. IEEE Trans. Inf. Forensics Secur. 19, 427\u2013440 (2024)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"1377_CR17","unstructured":"Jayaraman, B., Evans, D.: Evaluating differentially private machine learning in practice. In: Proceedings of the 28th USENIX Security Symposium, USENIX Security 2019, pp. 1895\u20131912. USENIX Association, (2019)"},{"issue":"6","key":"1377_CR18","doi-asserted-by":"publisher","first-page":"2073","DOI":"10.1109\/TSC.2019.2897554","volume":"14","author":"S Truex","year":"2021","unstructured":"Truex, S., Liu, L., Gursoy, M.E., Yu, L., Wei, W.: Demystifying membership inference attacks in machine learning as a service. IEEE Trans. Serv. Comput. 14(6), 2073\u20132089 (2021)","journal-title":"IEEE Trans. Serv. Comput."},{"issue":"5","key":"1377_CR19","doi-asserted-by":"publisher","first-page":"4997","DOI":"10.1109\/TDSC.2024.3367737","volume":"21","author":"W Ma","year":"2024","unstructured":"Ma, W., Song, Y., Xue, M., Wen, S., Xiang, Y.: The \u201ccode\u2019\u2019 of ethics: A holistic audit of AI code generators. IEEE Trans. Dependable Secur. Comput. 21(5), 4997\u20135013 (2024)","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"1377_CR20","doi-asserted-by":"crossref","unstructured":"Yeom, S., Giacomelli, I., Fredrikson, M., Jha, S.: Privacy risk in machine learning: Analyzing the connection to overfitting. In: Proceedings of the 31st IEEE Computer Security Foundations Symposium, CSF 2018, pp. 268\u2013282. IEEE Computer Society, (2018)","DOI":"10.1109\/CSF.2018.00027"},{"key":"1377_CR21","doi-asserted-by":"crossref","unstructured":"Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., Backes, M.: ML-Leaks: Model and data independent membership inference attacks and defenses on machine learning models. In: Proceedings of the 26th Annual Network and Distributed System Security Symposium, NDSS 2019. The Internet Society, (2019)","DOI":"10.14722\/ndss.2019.23119"},{"key":"1377_CR22","unstructured":"Song, L., Mittal, P.: Systematic evaluation of privacy risks of machine learning models. In: Proceedings of the 30th USENIX Security Symposium, USENIX Security 2021, August 11-13, 2021, pp. 2615\u20132632. USENIX Association, (2021)"},{"key":"1377_CR23","doi-asserted-by":"crossref","unstructured":"Jia, J., Salem, A., Backes, M., Zhang, Y., Gong, N.Z.: MemGuard: Defending against black-box membership inference attacks via adversarial examples. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS 2019, pp. 259\u2013274. ACM, (2019)","DOI":"10.1145\/3319535.3363201"},{"issue":"1","key":"1377_CR24","first-page":"1929","volume":"15","author":"N Srivastava","year":"2014","unstructured":"Srivastava, N., Hinton, G.E., Krizhevsky, A., Sutskever, I., Salakhutdinov, R.: Dropout: a simple way to prevent neural networks from overfitting. J. Mach. Learn. Res. 15(1), 1929\u20131958 (2014)","journal-title":"J. Mach. Learn. Res."},{"issue":"15","key":"1377_CR25","doi-asserted-by":"publisher","first-page":"44455","DOI":"10.1007\/s11042-023-17394-3","volume":"83","author":"SB Hamida","year":"2024","unstructured":"Hamida, S.B., Mrabet, H., Chaieb, F., Jemai, A.: Assessment of data augmentation, dropout with L2 regularization and differential privacy against membership inference attacks. Multim. Tools Appl. 83(15), 44455\u201344484 (2024)","journal-title":"Multim. Tools Appl."},{"key":"1377_CR26","unstructured":"Guo, C., Pleiss, G., Sun, Y., Weinberger, K.Q.: On calibration of modern neural networks. In: Proceedings of the 34th International Conference on Machine Learning, ICML 2017. Proceedings of Machine Learning Research, vol.\u00a070, pp. 1321\u20131330. PMLR, (2017)"},{"key":"1377_CR27","unstructured":"M\u00fcller, R., Kornblith, S., Hinton, G.E.: When does label smoothing help? In: Proceedings of the Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, pp. 4696\u20134705. (2019)"},{"key":"1377_CR28","doi-asserted-by":"crossref","unstructured":"Hu, H., Salcic, Z., Dobbie, G., Chen, Y., Zhang, X.: EAR: An enhanced adversarial regularization approach against membership inference attacks. In: Proceedings of the International Joint Conference on Neural Networks, IJCNN 2021, pp. 1\u20138. IEEE, (2021)","DOI":"10.1109\/IJCNN52387.2021.9534381"},{"key":"1377_CR29","unstructured":"Tan, J., LeJeune, D., Mason, B., Javadi, H., Baraniuk, R.G.: A blessing of dimensionality in membership inference through regularization. In: Proceedings of the International Conference on Artificial Intelligence and Statistics, vol. 206, pp. 10968\u201310993. PMLR, (2023)"},{"key":"1377_CR30","doi-asserted-by":"crossref","unstructured":"Nasr, M., Shokri, R., Houmansadr, A.: Machine learning with membership privacy using adversarial regularization. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS 2018, pp. 634\u2013646. ACM, (2018)","DOI":"10.1145\/3243734.3243855"},{"key":"1377_CR31","unstructured":"Chen, D., Yu, N., Fritz, M.: RelaxLoss: Defending membership inference attacks without losing utility. In: Proceedings of the Tenth International Conference on Learning Representations, ICLR 2022. OpenReview.net, (2022)"},{"issue":"3","key":"1377_CR32","doi-asserted-by":"publisher","first-page":"17","DOI":"10.29012\/jpc.v7i3.405","volume":"7","author":"C Dwork","year":"2016","unstructured":"Dwork, C., McSherry, F., Nissim, K., Smith, A.D.: Calibrating noise to sensitivity in private data analysis. J. Priv. Confidentiality 7(3), 17\u201351 (2016)","journal-title":"J. Priv. Confidentiality"},{"key":"1377_CR33","doi-asserted-by":"crossref","unstructured":"Hui, B., Yang, Y., Yuan, H., Burlina, P., Gong, N.Z., Cao, Y.: Practical blind membership inference attack via differential comparisons. In: Proceedings of the 28th Annual Network and Distributed System Security Symposium, NDSS 2021. The Internet Society, (2021)","DOI":"10.14722\/ndss.2021.24293"},{"key":"1377_CR34","unstructured":"Jayaraman, B., Evans, D.: Evaluating differentially private machine learning in practice. In: Proceedings of the 28th USENIX Security Symposium, USENIX Security 2019, pp. 1895\u20131912. USENIX Association, (2019)"},{"key":"1377_CR35","unstructured":"Leino, K., Fredrikson, M.: Stolen memories: leveraging model memorization for calibrated white-box membership inference. In: Proceedings of the 29th USENIX Security Symposium, USENIX Security 2020, pp. 1605\u20131622. USENIX Association, (2020)"},{"key":"1377_CR36","doi-asserted-by":"crossref","unstructured":"Li, J., Li, N., Ribeiro, B.: Membership inference attacks and defenses in classification models. In: Proceedings of the 11th ACM Conference on Data and Application Security and Privacy, pp. 5\u201316. ACM, (2021)","DOI":"10.1145\/3422337.3447836"},{"key":"1377_CR37","doi-asserted-by":"crossref","unstructured":"Shejwalkar, V., Houmansadr, A.: Membership privacy for machine learning models through knowledge transfer. In: Proceedings of the 35th AAAI Conference on Artificial Intelligence, AAAI 2021, pp. 9549\u20139557. AAAI Press, (2021)","DOI":"10.1609\/aaai.v35i11.17150"},{"issue":"1","key":"1377_CR38","first-page":"61","volume":"11","author":"MA Rahman","year":"2018","unstructured":"Rahman, M.A., Rahman, T., Lagani\u00e8re, R., Mohammed, N.: Membership inference attack against differentially private deep learning model. Trans. Data Priv. 11(1), 61\u201379 (2018)","journal-title":"Trans. Data Priv."},{"key":"1377_CR39","doi-asserted-by":"crossref","unstructured":"Truex, S., Liu, L., Gursoy, M.E., Wei, W., Yu, L.: Effects of differential privacy and data skewness on membership inference vulnerability. In: Proceedings of the First IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications, TPS-ISA 2019, pp. 82\u201391. IEEE, (2019)","DOI":"10.1109\/TPS-ISA48467.2019.00019"},{"key":"1377_CR40","doi-asserted-by":"crossref","unstructured":"Abadi, M., Chu, A., Goodfellow, I.J., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308\u2013318. ACM, (2016)","DOI":"10.1145\/2976749.2978318"},{"key":"1377_CR41","doi-asserted-by":"publisher","first-page":"7211","DOI":"10.1109\/TIFS.2025.3581103","volume":"20","author":"Z Deng","year":"2025","unstructured":"Deng, Z., Sun, R., Xue, J., Ma, W., Wen, S., Nepal, S., Xiang, Y.: Hardening LLM fine-tuning: From differentially private data selection to trustworthy model quantization. IEEE Trans. Inf. Forensics Secur. 20, 7211\u20137226 (2025)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"1377_CR42","doi-asserted-by":"publisher","first-page":"114","DOI":"10.1016\/j.neucom.2021.04.082","volume":"452","author":"J Zheng","year":"2021","unstructured":"Zheng, J., Cao, Y., Wang, H.: Resisting membership inference attacks through knowledge distillation. Neurocomputing 452, 114\u2013126 (2021)","journal-title":"Neurocomputing"},{"key":"1377_CR43","unstructured":"Krizhevsky, A., Sutskever, I., Hinton, G.E.: ImageNet classification with deep convolutional neural networks. In: The Proceedings of 26th Annual Conference on Neural Information Processing Systems 2012, pp. 1106\u20131114. (2012)"},{"key":"1377_CR44","unstructured":"Bishop, C.M., Nasrabadi, N.M.: Pattern recognition and machine learning, vol.\u00a04. Springer, (2006)"},{"key":"1377_CR45","unstructured":"Sablayrolles, A., Douze, M., Schmid, C., Ollivier, Y., J\u00e9gou, H.: White-box vs Black-box: Bayes Optimal Strategies for Membership Inference. In: Proceedings of the 36th International Conference on Machine Learning, ICML 2019, Proceedings of Machine Learning Research, vol.\u00a097, pp. 5558\u20135567. PMLR, (2019)"},{"key":"1377_CR46","doi-asserted-by":"crossref","unstructured":"Chen, J., Jordan, M.I., Wainwright, M.J.: HopSkipJumpAttack: A query-efficient decision-based attack. In: Proceedings of the 2020 IEEE Symposium on Security and Privacy, SP 2020, pp. 1277\u20131294. IEEE, (2020)","DOI":"10.1109\/SP40000.2020.00045"},{"key":"1377_CR47","doi-asserted-by":"crossref","unstructured":"Li, Z., Zhang, Y.: Membership leakage in label-only exposures. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 880\u2013895. ACM, (2021)","DOI":"10.1145\/3460120.3484575"},{"key":"1377_CR48","unstructured":"Rezaei, S., Liu, X.: Towards the infeasibility of membership inference on deep models. arXiv:2005.13702 (2020)"},{"key":"1377_CR49","doi-asserted-by":"crossref","unstructured":"Cubuk, E.D., Zoph, B., Shlens, J., Le, Q.: RandAugment: Practical automated data augmentation with a reduced search space. In: The Proceedings of Annual Conference on Neural Information Processing Systems 2020. NeurIPS 2020 (2020)","DOI":"10.1109\/CVPRW50498.2020.00359"}],"container-title":["World Wide Web"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11280-025-01377-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11280-025-01377-5\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11280-025-01377-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,4]],"date-time":"2025-12-04T04:06:39Z","timestamp":1764821199000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11280-025-01377-5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,21]]},"references-count":49,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2025,11]]}},"alternative-id":["1377"],"URL":"https:\/\/doi.org\/10.1007\/s11280-025-01377-5","relation":{},"ISSN":["1386-145X","1573-1413"],"issn-type":[{"type":"print","value":"1386-145X"},{"type":"electronic","value":"1573-1413"}],"subject":[],"published":{"date-parts":[[2025,10,21]]},"assertion":[{"value":"30 June 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 September 2025","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"9 September 2025","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"21 October 2025","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"The authors declare no competing interests.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"68"}}