{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T10:58:13Z","timestamp":1783940293263,"version":"3.55.0"},"reference-count":32,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833623","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T15:28:05Z","timestamp":1658935685000},"page":"1120-1137","source":"Crossref","is-referenced-by-count":54,"title":["Property Inference from Poisoning"],"prefix":"10.1109","author":[{"given":"Saeed","family":"Mahloujifar","sequence":"first","affiliation":[{"name":"Princeton University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Esha","family":"Ghosh","sequence":"additional","affiliation":[{"name":"Microsoft Research"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Melissa","family":"Chase","sequence":"additional","affiliation":[{"name":"Microsoft Research"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref13","article-title":"Towards Privacy and Security of Deep Learning Systems: A Survey","author":"he","year":"2019","journal-title":"arXiv 1911 12562 [cs CR]"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243834"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-30115-8_22"},{"key":"ref14","article-title":"Subpopulation Data Poisoning Attacks","author":"jagielski","year":"2019"},{"key":"ref31","article-title":"Model-Targeted Poisoning Attacks: Provable Convergence and Certified Bounds","author":"suya","year":"2020","journal-title":"arXiv preprint arXiv 2006 16578"},{"key":"ref30","first-page":"3517","article-title":"Certified defenses for data poisoning attacks","author":"steinhardt","year":"2017","journal-title":"In Advances in Neural Information Processing Systems"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243834"},{"key":"ref10","first-page":"22","article-title":"UCI machine learning repository, 2010","volume":"15","author":"frank","year":"2011"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1504\/IJSN.2015.071829"},{"key":"ref1","article-title":"3 ways to train a secure machine learning model","year":"2020"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref16","article-title":"The MNIST database of handwritten digits","author":"lecun","year":"0"},{"key":"ref19","first-page":"572","article-title":"Learning under p-Tampering Attacks","author":"mahloujifar","year":"2018","journal-title":"Algorithm Learn Theory"},{"key":"ref18","first-page":"11","author":"liu","year":"2018","journal-title":"Large-scale celebfaces attributes (celeba) dataset"},{"key":"ref24","year":"2020","journal-title":"Privacy-preserving Collaborative Machine Learning"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243855"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"ref25","article-title":"White-box vs Black-box: Bayes Optimal Strategies for Membership Inference","author":"sablayrolles","year":"2019","journal-title":"In ArXiv abs\/1908 11229"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33014536"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00029"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref27","first-page":"6103","article-title":"Poison frogs! targeted clean-label poisoning attacks on neural networks","author":"shafahi","year":"2018","journal-title":"In Advances in Neural Information Processing Systems"},{"key":"ref29","article-title":"Systematic Evaluation of Privacy Risks of Machine Learning Models","author":"song","year":"2020","journal-title":"arXiv preprint arXiv 2003 11055"},{"key":"ref8","article-title":"Label-Only Membership Inference Attacks","author":"choquette choo","year":"2020","journal-title":"arXiv preprint arXiv 2007 14638"},{"key":"ref7","article-title":"The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks","author":"carlini","year":"2018","journal-title":"In USENIX Security Symposium"},{"key":"ref9","first-page":"265","article-title":"Calibrating Noise to Sensitivity in Private Data Analysis","volume":"3876","author":"dwork","year":"2006","journal-title":"In Theory of Cryptography Third Theory of Cryptography Conference TCC 2006"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS.2014.56"},{"key":"ref3","first-page":"2938","article-title":"How to backdoor federated learning","author":"bagdasaryan","year":"2020","journal-title":"In International Conference on Artificial Intelligence and Statistics"},{"key":"ref6","article-title":"Poisoning attacks against support vector machines","author":"biggio","year":"2012","journal-title":"arXiv preprint arXiv 1206 6389"},{"key":"ref5","first-page":"634","article-title":"Analyzing federated learning through an adversarial lens","author":"bhagoji","year":"2019","journal-title":"In International Conference on Machine Learning"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2022,5,22]]},"end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833623.pdf?arnumber=9833623","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T18:26:13Z","timestamp":1699467973000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833623\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":32,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833623","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}