{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,7]],"date-time":"2026-03-07T21:03:53Z","timestamp":1772917433328,"version":"3.50.1"},"reference-count":76,"publisher":"IEEE","license":[{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,5]]},"DOI":"10.1109\/sp46215.2023.10179281","type":"proceedings-article","created":{"date-parts":[[2023,7,21]],"date-time":"2023-07-21T17:18:15Z","timestamp":1689959895000},"page":"327-345","source":"Crossref","is-referenced-by-count":20,"title":["SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learning"],"prefix":"10.1109","author":[{"given":"Ahmed","family":"Salem","sequence":"first","affiliation":[{"name":"Microsoft"}]},{"given":"Giovanni","family":"Cherubin","sequence":"additional","affiliation":[{"name":"Microsoft"}]},{"given":"David","family":"Evans","sequence":"additional","affiliation":[{"name":"University of Virginia"}]},{"given":"Boris","family":"K\u00f6pf","sequence":"additional","affiliation":[{"name":"Microsoft"}]},{"given":"Andrew","family":"Paverd","sequence":"additional","affiliation":[{"name":"Microsoft"}]},{"given":"Anshuman","family":"Suri","sequence":"additional","affiliation":[{"name":"University of Virginia"}]},{"given":"Shruti","family":"Tople","sequence":"additional","affiliation":[{"name":"Microsoft"}]},{"given":"Santiago","family":"Zanella-B\u00e9guelin","sequence":"additional","affiliation":[{"name":"Microsoft"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511804090"},{"key":"ref2","article-title":"Opinion 05\/2014 on anonymization techniques","year":"2014"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1504\/IJSN.2015.071829"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833677"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/1480881.1480894"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SFCS.1997.646128"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/11761679_25"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2007.16"},{"key":"ref9","first-page":"1","article-title":"Mechanizing game-based proofs of security protocols","volume":"33","author":"Blanchet","year":"2012","journal-title":"Software Safety and Security"},{"key":"ref10","first-page":"267","article-title":"The secret sharer: Evaluating and testing unintended memorization in neural networks","volume-title":"28th USENIX Security Symposium","author":"Carlini"},{"key":"ref11","first-page":"2633","article-title":"Extracting training data from large language models","volume-title":"30th USENIX Security Symposium","author":"Carlini"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833649"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00028"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1007\/springerreference_24224"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179334"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417238"},{"key":"ref17","first-page":"1964","article-title":"Label-only membership inference attacks","volume-title":"International Conference on Machine Learning (ICML)","volume":"139","author":"Choquette Choo"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1914598117"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2021.3076443"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2020-0028"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/11681878_14"},{"key":"ref22","article-title":"That which we call private","author":"Erlingsson","year":"2019"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243834"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.56553\/popets-2022-0079"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/800070.802212"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML54575.2023.00018"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0008"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_31"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0067"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24293"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/csf57540.2023.00013"},{"key":"ref33","first-page":"22 205","article-title":"Auditing differentially private machine learning: How private is private SGD?","volume-title":"Advances in Neural Information Processing Systems (NeurIPS)","volume":"33","author":"Jagielski","year":"2020"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560663"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2021-0031"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2022-0023"},{"key":"ref37","first-page":"1605","article-title":"Stolen memories: Leveraging model memorization for calibrated white-box membership inference","volume-title":"29th USENIX Security Symposium","author":"Leino"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516686"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484575"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3436755"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484749"},{"key":"ref42","article-title":"Membership inference on word embedding and beyond","author":"Mahloujifar","year":"2021"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833623"},{"key":"ref44","first-page":"6934","article-title":"Antipodes of label differential privacy: PATE and ALIBI","volume-title":"Advances in Neural Information Processing Systems (NeurIPS)","volume":"34","author":"Malek Esmaeili","year":"2021"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17140-6_10"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-39799-8_48"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00069"},{"issue":"2","key":"ref48","first-page":"687","article-title":"Bridging the gap between computer science and legal approaches to privacy","volume":"31","author":"Nissim","year":"2018","journal-title":"Harvard Journal of Law & Technology"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3624010"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1007\/11958239_14"},{"key":"ref53","first-page":"5558","article-title":"White-box vs black-box: Bayes optimal strategies for membership inference","volume-title":"International Conference on Machine Learning (ICML)","volume":"97","author":"Sablayrolles"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23119"},{"key":"ref55","first-page":"1291","article-title":"Updates-Leak: Data set inference and reconstruction attacks in online learning","volume-title":"29th USENIX Security Symposium","author":"Salem"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i11.17150"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-39200-9_28"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.56553\/popets-2022-0121"},{"key":"ref60","article-title":"Subject membership inference attacks in federated learning","author":"Suri","year":"2022"},{"key":"ref61","first-page":"1433","article-title":"Mitigating membership inference attacks by self-distillation through a novel ensemble architecture","volume-title":"31st USENIX Security Symposium","author":"Tang"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref63","article-title":"Debugging differential privacy: A case study for privacy auditing","author":"Tram\u00e8r","year":"2022"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560554"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00012"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i13.17387"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM51629.2021.00182"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2016.32"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-191362"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417880"},{"key":"ref72","article-title":"Bayesian estimation of differential privacy","author":"Zanella-B\u00e9guelin","year":"2022"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484770"},{"key":"ref74","first-page":"2687","article-title":"Leakage of dataset properties in Multi-Party machine learning","volume-title":"30th USENIX Security Symposium","author":"Zhang"},{"key":"ref75","first-page":"4543","article-title":"Inference attacks against graph neural networks","volume-title":"31st USENIX Security Symposium","author":"Zhang"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.23019"}],"event":{"name":"2023 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2023,5,21]]},"end":{"date-parts":[[2023,5,25]]}},"container-title":["2023 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10179215\/10179280\/10179281.pdf?arnumber=10179281","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,20]],"date-time":"2024-07-20T05:13:55Z","timestamp":1721452435000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10179281\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5]]},"references-count":76,"URL":"https:\/\/doi.org\/10.1109\/sp46215.2023.10179281","relation":{},"subject":[],"published":{"date-parts":[[2023,5]]}}}