{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T18:21:58Z","timestamp":1771698118538,"version":"3.50.1"},"reference-count":50,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2023,10,17]],"date-time":"2023-10-17T00:00:00Z","timestamp":1697500800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2023,10,17]],"date-time":"2023-10-17T00:00:00Z","timestamp":1697500800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Sci. China Inf. Sci."],"published-print":{"date-parts":[[2024,3]]},"DOI":"10.1007\/s11432-022-3507-7","type":"journal-article","created":{"date-parts":[[2023,12,1]],"date-time":"2023-12-01T05:02:56Z","timestamp":1701406976000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":11,"title":["Model architecture level privacy leakage in neural networks"],"prefix":"10.1007","volume":"67","author":[{"given":"Yan","family":"Li","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hongyang","family":"Yan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Teng","family":"Huang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zijie","family":"Pan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiewei","family":"Lai","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaoxue","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kongyang","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jin","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2023,10,17]]},"reference":[{"key":"3507_CR1","doi-asserted-by":"crossref","unstructured":"Huang G, Liu Z, van der Maaten L, et al. Densely connected convolutional networks. In: Proceedings of IEEE Conference on Computer Vision and Pattern Recognition, 2017. 4700\u20134708","DOI":"10.1109\/CVPR.2017.243"},{"key":"3507_CR2","doi-asserted-by":"crossref","unstructured":"Shokri R, Stronati M, Song C, et al. Membership inference attacks against machine learning models. In: Proceedings of IEEE Symposium on Security and Privacy (SP), 2017. 3\u201318","DOI":"10.1109\/SP.2017.41"},{"key":"3507_CR3","unstructured":"Zhu L, Liu Z, Han S. Deep leakage from gradients. In: Proceedings of Advances in Neural Information Processing Systems, 2019. 14774\u201314784"},{"key":"3507_CR4","unstructured":"Salem A, Bhattacharya A, Backes M, et al. Updates-leak: data set inference and reconstruction attacks in online learning. In: Proceedings of the 29th USENIX Security Symposium (USENIX Security 20), 2020. 1291\u20131308"},{"key":"3507_CR5","doi-asserted-by":"crossref","unstructured":"Nasr M, Shokri R, Houmansadr A. Comprehensive privacy analysis of deep learning: passive and active white-box inference attacks against centralized and federated learning. In: Proceedings of IEEE Symposium on Security and Privacy (SP), 2019. 739\u2013753","DOI":"10.1109\/SP.2019.00065"},{"key":"3507_CR6","doi-asserted-by":"publisher","first-page":"301","DOI":"10.1016\/j.ins.2017.06.033","volume":"417","author":"Y Song","year":"2017","unstructured":"Song Y, Li Z, Li Y, et al. Attribute-based signcryption scheme based on linear codes. Inf Sci, 2017, 417: 301\u2013309","journal-title":"Inf Sci"},{"key":"3507_CR7","doi-asserted-by":"publisher","first-page":"29","DOI":"10.1016\/j.jnca.2018.11.001","volume":"126","author":"X Zhang","year":"2019","unstructured":"Zhang X, Zhu L, Wang X, et al. A packet-reordering covert channel over VoLTE voice and video traffics. J Netw Comput Appl, 2019, 126: 29\u201338","journal-title":"J Netw Comput Appl"},{"key":"3507_CR8","doi-asserted-by":"publisher","first-page":"55","DOI":"10.1016\/j.ins.2018.12.023","volume":"480","author":"Q Zhang","year":"2019","unstructured":"Zhang Q, Wang X, Yuan J, et al. A hierarchical group key agreement protocol using orientable attributes for cloud computing. Inf Sci, 2019, 480: 55\u201369","journal-title":"Inf Sci"},{"key":"3507_CR9","doi-asserted-by":"publisher","first-page":"91","DOI":"10.1016\/j.jpdc.2019.04.003","volume":"130","author":"J Li","year":"2019","unstructured":"Li J, Wang X, Huang Z, et al. Multi-level multi-secret sharing scheme for decentralized e-voting in cloud computing. J Parallel Distr Comput, 2019, 130: 91\u201397","journal-title":"J Parallel Distr Comput"},{"key":"3507_CR10","doi-asserted-by":"crossref","unstructured":"Chen X, Xie L, Wu J, et al. Progressive differentiable architecture search: bridging the depth gap between search and evaluation. In: Proceedings of IEEE\/CVF International Conference on Computer Vision, 2019. 1294\u20131303","DOI":"10.1109\/ICCV.2019.00138"},{"key":"3507_CR11","unstructured":"Liu H, Simonyan K, Yang Y. DARTS: differentiable architecture search. 2018. ArXiv:1806.09055"},{"key":"3507_CR12","unstructured":"Long Y, Bindschaedler V, Gunter C A. Towards measuring membership privacy. 2017. ArXiv:1712.09136"},{"key":"3507_CR13","doi-asserted-by":"crossref","unstructured":"Salem A, Zhang Y, Humbert M, et al. ML-leaks: model and data independent membership inference attacks and defenses on machine learning models. 2018. ArXiv:1806.01246","DOI":"10.14722\/ndss.2019.23119"},{"key":"3507_CR14","unstructured":"Pham H, Guan M, Zoph B, et al. Efficient neural architecture search via parameters sharing. In: Proceedings of International Conference on Machine Learning (PMLR), 2018. 4095\u20134104"},{"key":"3507_CR15","unstructured":"Brock A, Lim T, Ritchie J M, et al. Smash: one-shot model architecture search through hypernetworks. 2017. ArXiv:1708.05344"},{"key":"3507_CR16","doi-asserted-by":"crossref","unstructured":"Abadi M, Chu A, Goodfellow I, et al. Deep learning with differential privacy. In: Proceedings of ACM SIGSAC Conference on Computer and Communications Security, 2016. 308\u2013318","DOI":"10.1145\/2976749.2978318"},{"key":"3507_CR17","doi-asserted-by":"crossref","unstructured":"Mo K, Huang T, Xiang X. Querying little is enough: model inversion attack via latent information. In: Proceedings of International Conference on Machine Learning for Cyber Security, 2020. 583\u2013591","DOI":"10.1007\/978-3-030-62460-6_52"},{"key":"3507_CR18","doi-asserted-by":"publisher","first-page":"7235","DOI":"10.1002\/int.22879","volume":"37","author":"W Lin","year":"2022","unstructured":"Lin W, Xu Y, Liu B, et al. Contribution-based federated learning client selection. Int J Intell Sys, 2022, 37: 7235\u20137260","journal-title":"Int J Intell Sys"},{"key":"3507_CR19","doi-asserted-by":"publisher","first-page":"5880","DOI":"10.1002\/int.22818","volume":"37","author":"J Ma","year":"2022","unstructured":"Ma J, Naas S, Sigg S, et al. Privacy-preserving federated learning based on multi-key homomorphic encryption. Int J Intell Sys, 2022, 37: 5880\u20135901","journal-title":"Int J Intell Sys"},{"key":"3507_CR20","unstructured":"Zhao B, Mopuri K R, Bilen H. IDLG: improved deep leakage from gradients. 2020. ArXiv:2001.02610"},{"key":"3507_CR21","doi-asserted-by":"crossref","unstructured":"Wang Z, Song M, Zhang Z, et al. Beyond inferring class representatives: user-level privacy leakage from federated learning. In: Proceedings of IEEE INFOCOM 2019-IEEE Conference on Computer Communications, 2019. 2512\u20132520","DOI":"10.1109\/INFOCOM.2019.8737416"},{"key":"3507_CR22","unstructured":"Geiping J, Bauermeister H, Dr\u00f6ge H, et al. Inverting gradients \u2014 how easy is it to break privacy in federated learning? In: Proceedings of Advances in Neural Information Processing Systems, 2020. 16937\u201316947"},{"key":"3507_CR23","unstructured":"Zhu J, Blaschko M. R-GAP: recursive gradient attack on privacy. 2020. ArXiv:2010.07733"},{"key":"3507_CR24","unstructured":"Mo F, Borovykh A, Malekzadeh M, et al. Layer-wise characterization of latent information leakage in federated learning. 2020. ArXiv:2010.08762"},{"key":"3507_CR25","doi-asserted-by":"crossref","unstructured":"Chen D, Yu N, Zhang Y, et al. GAN-leaks: a taxonomy of membership inference attacks against generative models. In: Proceedings of ACM SIGSAC Conference on Computer and Communications Security, 2020. 343\u2013362","DOI":"10.1145\/3372297.3417238"},{"key":"3507_CR26","unstructured":"Leino K, Fredrikson M. Stolen memories: leveraging model memorization for calibrated white-box membership inference. In: Proceedings of the 29th USENIX Security Symposium (USENIX Security 20), 2020. 1605\u20131622"},{"key":"3507_CR27","doi-asserted-by":"crossref","unstructured":"Rezaei S, Liu X. On the difficulty of membership inference attacks. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 2021. 7892\u20137900","DOI":"10.1109\/CVPR46437.2021.00780"},{"key":"3507_CR28","unstructured":"Truex S, Liu L, Gursoy M E, et al. Towards demystifying membership inference attacks. 2018. ArXiv:1807.09173"},{"key":"3507_CR29","doi-asserted-by":"crossref","unstructured":"Jia J, Salem A, Backes M, et al. MemGuard: defending against black-box membership inference attacks via adversarial examples. In: Proceedings of ACM SIGSAC Conference on Computer and Communications Security, 2019. 259\u2013274","DOI":"10.1145\/3319535.3363201"},{"key":"3507_CR30","unstructured":"Hu H, Salcic Z, Sun L, et al. Membership inference attacks on machine learning: a survey. 2021. ArXiv:2103.07853"},{"key":"3507_CR31","doi-asserted-by":"publisher","first-page":"107252","DOI":"10.1016\/j.asoc.2021.107252","volume":"105","author":"S Ai","year":"2021","unstructured":"Ai S, Koe A S V, Huang T. Adversarial perturbation in remote sensing image recognition. Appl Soft Comput, 2021, 105: 107252","journal-title":"Appl Soft Comput"},{"key":"3507_CR32","doi-asserted-by":"publisher","first-page":"7685","DOI":"10.1002\/int.22899","volume":"37","author":"Y Guo","year":"2022","unstructured":"Guo Y, Jiao B, Tan Y, et al. A transfer weighted extreme learning machine for imbalanced classification. Int J Intell Sys, 2022, 37: 7685\u20137705","journal-title":"Int J Intell Sys"},{"key":"3507_CR33","unstructured":"Goodfellow I J, Shlens J, Szegedy C. Explaining and harnessing adversarial examples. 2014. ArXiv:1412.6572"},{"key":"3507_CR34","doi-asserted-by":"crossref","unstructured":"Dong Y, Liao F, Pang T, et al. Boosting adversarial attacks with momentum. In: Proceedings of IEEE Conference on Computer Vision and Pattern Recognition, 2018. 9185\u20139193","DOI":"10.1109\/CVPR.2018.00957"},{"key":"3507_CR35","unstructured":"Madry A, Makelov A, Schmidt L, et al. Towards deep learning models resistant to adversarial attacks. 2017. ArXiv:1706.06083"},{"key":"3507_CR36","doi-asserted-by":"publisher","first-page":"103612","DOI":"10.1016\/j.csi.2021.103612","volume":"82","author":"J Liu","year":"2022","unstructured":"Liu J, Zhang Q, Mo K, et al. An efficient adversarial example generation algorithm based on an accelerated gradient iterative fast gradient. Comput Stand Interfaces, 2022, 82: 103612","journal-title":"Comput Stand Interfaces"},{"key":"3507_CR37","doi-asserted-by":"publisher","first-page":"102632","DOI":"10.1016\/j.jnca.2020.102632","volume":"162","author":"T Huang","year":"2020","unstructured":"Huang T, Zhang Q, Liu J, et al. Adversarial attacks on deep-learning-based SAR image target recognition. J Netw Comput Appl, 2020, 162: 102632","journal-title":"J Netw Comput Appl"},{"key":"3507_CR38","doi-asserted-by":"publisher","first-page":"7526","DOI":"10.1002\/int.22892","volume":"37","author":"J Wang","year":"2022","unstructured":"Wang J, Yin Z, Jiang J, et al. Attention-guided black-box adversarial attacks with large-scale multiobjective evolutionary optimization. Int J Intell Sys, 2022, 37: 7526\u20137547","journal-title":"Int J Intell Sys"},{"key":"3507_CR39","doi-asserted-by":"publisher","first-page":"1441","DOI":"10.1002\/int.22349","volume":"36","author":"C Chen","year":"2021","unstructured":"Chen C, Huang T. Camdar-ADV: generating adversarial patches on 3D object. Int J Intell Syst, 2021, 36: 1441\u20131453","journal-title":"Int J Intell Syst"},{"key":"3507_CR40","doi-asserted-by":"publisher","first-page":"3325","DOI":"10.1007\/s13042-020-01242-z","volume":"12","author":"H Ren","year":"2021","unstructured":"Ren H, Huang T, Yan H. Adversarial examples: attacks and defenses in the physical world. Int J Mach Learn Cyber, 2021, 12: 3325\u20133336","journal-title":"Int J Mach Learn Cyber"},{"key":"3507_CR41","unstructured":"Buckman J, Roy A, Raffel C, et al. Thermometer encoding: one hot way to resist adversarial examples. In: Proceedings of International Conference on Learning Representations, 2018"},{"key":"3507_CR42","doi-asserted-by":"crossref","unstructured":"Xie C, Wu Y, Maaten L, et al. Feature denoising for improving adversarial robustness. In: Proceedings of IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 2019. 501\u2013509","DOI":"10.1109\/CVPR.2019.00059"},{"key":"3507_CR43","unstructured":"Tram\u00e9r F, Kurakin A, Papernot N, et al. Ensemble adversarial training: attacks and defenses. 2017. ArXiv:1705.07204"},{"key":"3507_CR44","unstructured":"Wistuba M, Rawat A, Pedapati T. A survey on neural architecture search. 2019. ArXiv:1905.01392"},{"key":"3507_CR45","doi-asserted-by":"publisher","first-page":"473","DOI":"10.1007\/s12243-019-00704-y","volume":"74","author":"Y Wang","year":"2019","unstructured":"Wang Y, Xue H, Liu Y, et al. Statistical network protocol identification with unknown pattern extraction. Ann Telecommun, 2019, 74: 473\u2013482","journal-title":"Ann Telecommun"},{"key":"3507_CR46","doi-asserted-by":"crossref","unstructured":"Wang Y, Meng W, Li W, et al. Adaptive machine learning-based alarm reduction via edge computing for distributed intrusion detection systems. Concurr Comput Pract Exper, 2019, 31","DOI":"10.1002\/cpe.5101"},{"key":"3507_CR47","doi-asserted-by":"publisher","first-page":"2901","DOI":"10.1109\/JIOT.2020.2963927","volume":"7","author":"N Jiang","year":"2020","unstructured":"Jiang N, Tian F, Li J, et al. MAN: mutual attention neural networks model for aspect-level sentiment classification in SIoT. IEEE Int Things J, 2020, 7: 2901\u20132913","journal-title":"IEEE Int Things J"},{"key":"3507_CR48","doi-asserted-by":"publisher","first-page":"1736","DOI":"10.1109\/TIFS.2020.3043139","volume":"16","author":"X Guo","year":"2020","unstructured":"Guo X, Liu Z, Li J, et al. VeriFL: communication-efficient and fast verifiable aggregation for federated learning. IEEE Trans Inform Forensic Secur, 2020, 16: 1736\u20131751","journal-title":"IEEE Trans Inform Forensic Secur"},{"key":"3507_CR49","doi-asserted-by":"publisher","first-page":"952","DOI":"10.1109\/TIFS.2020.3025438","volume":"16","author":"W Tang","year":"2020","unstructured":"Tang W, Li B, Barni M, et al. An automatic cost learning framework for image steganography using deep reinforcement learning. IEEE Trans Inform Forensic Secur, 2020, 16: 952\u2013967","journal-title":"IEEE Trans Inform Forensic Secur"},{"key":"3507_CR50","doi-asserted-by":"publisher","first-page":"182314","DOI":"10.1007\/s11432-020-3039-x","volume":"64","author":"Y Huang","year":"2021","unstructured":"Huang Y, Lv S, Liu Z, et al. Cetus: an efficient symmetric searchable encryption against file-injection attack with SGX. Sci China Inf Sci, 2021, 64: 182314","journal-title":"Sci China Inf Sci"}],"container-title":["Science China Information Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11432-022-3507-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11432-022-3507-7\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11432-022-3507-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,19]],"date-time":"2025-04-19T19:52:57Z","timestamp":1745092377000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11432-022-3507-7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10,17]]},"references-count":50,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2024,3]]}},"alternative-id":["3507"],"URL":"https:\/\/doi.org\/10.1007\/s11432-022-3507-7","relation":{},"ISSN":["1674-733X","1869-1919"],"issn-type":[{"value":"1674-733X","type":"print"},{"value":"1869-1919","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,10,17]]},"assertion":[{"value":"5 January 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"6 May 2022","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"7 June 2022","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"17 October 2023","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"132101"}}