{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,11]],"date-time":"2026-07-11T16:52:03Z","timestamp":1783788723639,"version":"3.55.0"},"reference-count":243,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2022]]},"DOI":"10.1109\/tpami.2022.3229593","type":"journal-article","created":{"date-parts":[[2022,12,15]],"date-time":"2022-12-15T20:00:43Z","timestamp":1671134443000},"page":"1-20","source":"Crossref","is-referenced-by-count":46,"title":["Survey: Leakage and Privacy at Inference Time"],"prefix":"10.1109","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6319-9537","authenticated-orcid":false,"given":"Marija","family":"Jegorova","sequence":"first","affiliation":[{"name":"Facebook FAIAR, London"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chaitanya","family":"Kaul","sequence":"additional","affiliation":[{"name":"University of Glasgow, U.K."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Charlie","family":"Mayor","sequence":"additional","affiliation":[{"name":"NHS Scotland, U.K."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alison Q.","family":"O'Neil","sequence":"additional","affiliation":[{"name":"Canon Medical Research Europe, Edinburgh, U.K."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alexander","family":"Weir","sequence":"additional","affiliation":[{"name":"Canon Medical Research Europe, Edinburgh, U.K."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4228-7962","authenticated-orcid":false,"given":"Roderick","family":"Murray-Smith","sequence":"additional","affiliation":[{"name":"University of Glasgow, U.K."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8795-9294","authenticated-orcid":false,"given":"Sotirios A.","family":"Tsaftaris","sequence":"additional","affiliation":[{"name":"University of Edinburgh, U.K."}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref57","article-title":"Thieves on sesame street! Model extraction of BERT-based APIs","author":"krishna","year":"2020"},{"key":"ref207","article-title":"Federated learning systems: Vision, hype and reality for data privacy and protection","author":"li","year":"2019"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"ref208","article-title":"Threats to federated learning: A survey","author":"lyu","year":"2020"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243834"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2020.2975749"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"ref206","article-title":"Advances and open problems in federated learning","author":"kairouz","year":"2019"},{"key":"ref53","article-title":"Towards reverse-engineering black-box neural networks","author":"oh","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref203","article-title":"Federated learning of deep networks using model averaging","author":"mcmahan","year":"2016"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.1145\/3298981"},{"key":"ref55","first-page":"1309","article-title":"Exploring connections between active learning and model extraction","author":"chandrasekaran","year":"2020","journal-title":"Proc 23rd Usenix Conf Secur Symp"},{"key":"ref201","article-title":"Federated optimization: Distributed machine learning for on-device intelligence","author":"konecn\u00fd","year":"2016"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3287560.3287562"},{"key":"ref202","article-title":"Federated learning: Strategies for improving communication efficiency","author":"konecn\u00fd","year":"2016"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2020.3000372"},{"key":"ref210","article-title":"Semi-supervised knowledge transfer for deep learning from private training data","author":"papernot","year":"2017","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref211","article-title":"Fast and differentially private algorithms for decentralized collaborative machine learning","author":"bellet","year":"2017"},{"key":"ref51","article-title":"High accuracy and high fidelity extraction of neural networks","author":"jagielski","year":"2020","journal-title":"Proc 23rd Usenix Conf Secur Symp"},{"key":"ref50","first-page":"601","article-title":"Stealing machine learning models via prediction APIs","author":"tram\u00e8r","year":"2016","journal-title":"Proc 23rd Usenix Conf Secur Symp"},{"key":"ref46","article-title":"Under the hood of membership inference attacks on aggregate location time-series","author":"pyrgelis","year":"2019"},{"key":"ref218","doi-asserted-by":"publisher","DOI":"10.1145\/3365109.3368788"},{"key":"ref45","article-title":"Towards measuring membership privacy","author":"long","year":"2017"},{"key":"ref219","article-title":"Federated collaborative filtering for privacy-preserving personalized recommendation system","author":"ammad-ud-din","year":"2019"},{"key":"ref48","article-title":"Segmentations-leak: Membership inference attacks and defenses in semantic image segmentation","author":"he","year":"2019"},{"key":"ref216","first-page":"493","article-title":"BatchCrypt: Efficient homomorphic encryption for cross-silo federated learning","author":"zhang","year":"2020","journal-title":"Proc 23rd Usenix Conf Secur Symp"},{"key":"ref47","article-title":"Knock knock, who's there? Membership inference on aggregate location data","author":"pyrgelis","year":"2017"},{"key":"ref217","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133982"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00299"},{"key":"ref214","article-title":"SecureBoost: A lossless federated learning framework","author":"cheng","year":"2019"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TCSS.2019.2916086"},{"key":"ref215","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2020.2988525"},{"key":"ref44","first-page":"17","article-title":"Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing","author":"fredrikson","year":"2014","journal-title":"Proc 23rd Usenix Conf Secur Symp"},{"key":"ref212","first-page":"3226","article-title":"Differentially private Bayesian learning on distributed data","author":"heikkil\u00e4","year":"2017","journal-title":"Proc 31st Int Conf Neural Inf Process Syst"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1038\/s41467-019-10933-3"},{"key":"ref213","first-page":"557","article-title":"On connecting stochastic gradient MCMC and differential privacy","author":"li","year":"2019","journal-title":"Proc 22nd Int Conf Artif Intell Statist"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489592"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-30619-9_4"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2018.1700447"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3386263.3407599"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.jpdc.2019.03.003"},{"key":"ref6","article-title":"A survey of privacy attacks in machine learning","author":"rigaki","year":"2020"},{"key":"ref5","article-title":"An overview of privacy in machine learning","author":"de cristofaro","year":"2020"},{"key":"ref100","article-title":"Stolen memories: Leveraging model memorization for calibrated white-box membership inference","author":"leino","year":"2020"},{"key":"ref221","doi-asserted-by":"publisher","DOI":"10.1145\/3214303"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-191362"},{"key":"ref222","article-title":"Fundamentals of fully homomorphic encryption - a survey","volume":"25","author":"brakerski","year":"2018","journal-title":"Electron Colloq Comput Complex"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0008"},{"key":"ref220","article-title":"A fully homomorphic encryption scheme","author":"gentry","year":"0"},{"key":"ref35","first-page":"61","article-title":"Membership inference attack against differentially private deep learning model","volume":"11","author":"rahman","year":"2018","journal-title":"Trans Data Priv"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134012"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354211"},{"key":"ref31","article-title":"GAN-Leaks: A taxonomy of membership inference attacks against GANs","author":"chen","year":"2019"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00029"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2019.2897554"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23119"},{"key":"ref39","article-title":"LOGAN: Evaluating privacy leakage of generative models using generative adversarial networks","author":"hayes","year":"2017"},{"key":"ref38","first-page":"5558","article-title":"White-box versus black-box: Bayes optimal strategies for membership inference","author":"sablayrolles","year":"2019","journal-title":"Proc 36th Int Conf Mach Learn"},{"key":"ref24","article-title":"Déjà Vu: An empirical evaluation of the memorization properties of ConvNets","author":"sablayrolles","year":"2018"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134077"},{"key":"ref26","first-page":"267","article-title":"The secret sharer: Evaluating and testing unintended memorization in neural networks","author":"carlini","year":"2019","journal-title":"Proc 28th USENIX Conf Secur Symp"},{"key":"ref25","article-title":"Memorization precedes generation: Learning unsupervised GANs with memory networks","author":"kim","year":"2018"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"ref22","article-title":"Overlearning reveals sensitive attributes","author":"song","year":"2020"},{"key":"ref21","article-title":"Understanding membership inferences on well-generalized learning models","author":"long","year":"2018"},{"key":"ref28","article-title":"Theoretical insights into memorization in GANs","author":"nagarajan","year":"2018","journal-title":"Proc Conf Neural Inf Process Syst Workshop"},{"key":"ref27","article-title":"The secret sharer: Measuring unintended neural network memorization and extracting secrets","author":"carlini","year":"2018"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00073"},{"key":"ref200","first-page":"2663","article-title":"A stochastic gradient method with an exponential convergence rate for finite training sets","author":"roux","year":"0","journal-title":"Proc Conf Neural Inf Process Syst"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.35"},{"key":"ref129","first-page":"2449","article-title":"Deletion-robust submodular maximization: Data summarization with ”the right to be forgotten","author":"mirzasoleiman","year":"2017","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref97","first-page":"2226","article-title":"Improved techniques for training GANs","author":"salimans","year":"0","journal-title":"Proc Conf Neural Inf Process Syst"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467444"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1098\/rsta.2018.0083"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM52596.2021.9653027"},{"key":"ref99","article-title":"Measuring unintended memorisation of unique private features in neural networks","author":"hartley","year":"2022"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW53098.2021.00368"},{"key":"ref98","article-title":"Understanding rare spurious correlations in neural networks","author":"yang","year":"2022"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243855"},{"key":"ref93","article-title":"Differentially private generative adversarial network","author":"xie","year":"2018"},{"key":"ref133","article-title":"Understanding black-box predictions via influence functions","author":"koh","year":"2017"},{"key":"ref92","article-title":"Synthetic data - A privacy mirage","author":"stadler","year":"2020"},{"key":"ref134","first-page":"1139","article-title":"A swiss army infinitesimal jackknife","author":"giordano","year":"2019","journal-title":"Proc 22nd Int Conf Artif Intell Statist"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/GLOBECOM38437.2019.9014134"},{"key":"ref131","article-title":"Approximate data deletion from machine learning models: Algorithms and evaluations","author":"izzo","year":"2020"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-22312-0_11"},{"key":"ref132","article-title":"Machine unlearning","author":"bourtoule","year":"2019"},{"key":"ref130","first-page":"3518","article-title":"Making AI forget you: Data deletion in machine learning","author":"ginart","year":"2019","journal-title":"Proc 33rd Int Conf Neural Inf Process Syst"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1038\/s41746-020-00353-9"},{"key":"ref90","article-title":"UCI machine learning repository","author":"dua","year":"2017"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2017.00023"},{"key":"ref139","article-title":"Estimating informativeness of samples with smooth unique information","author":"harutyunyan","year":"2021","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref86","first-page":"1895","article-title":"Evaluating differentially private machine learning in practice","author":"jayaraman","year":"2019","journal-title":"Proc 23rd Usenix Conf Secur Symp"},{"key":"ref137","article-title":"Eternal sunshine of the spotless net: Selective forgetting in deep networks","author":"golatkar","year":"2019"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2019.8737416"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58526-6_23"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"ref135","article-title":"Machine unlearning: Linear filtration for logit-based classifiers","author":"baumhauer","year":"2020"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-021-00337-8"},{"key":"ref136","article-title":"Certified data removal from machine learning models","author":"guo","year":"2019"},{"key":"ref82","first-page":"14 774","article-title":"Deep leakage from gradients","author":"zhu","year":"0","journal-title":"Proc Conf Neural Inf Process Syst"},{"key":"ref144","article-title":"Privacy attacks on network embeddings","author":"ellers","year":"2019"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00033"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330885"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref142","article-title":"Mixed-privacy forgetting in deep networks","author":"golatkar","year":"2020"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0067"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134056"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-45724-2_13"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-59710-8_10"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1016\/j.media.2017.07.005"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"ref108","article-title":"Distilling the knowledge in a neural network","author":"hinton","year":"2015","journal-title":"Proc NIPS Deep Learn Representation Learn Workshop"},{"key":"ref229","article-title":"Stable and fair classification","author":"huang","year":"2019"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098162"},{"key":"ref109","first-page":"3394","article-title":"Deep sets","author":"zaheer","year":"2017","journal-title":"Proc 31st Int Conf Neural Inf Process Syst"},{"key":"ref106","first-page":"2615","article-title":"Systematic evaluation of privacy risks of machine learning models","author":"song","year":"2021","journal-title":"Proc Usenix Secur Symp"},{"key":"ref227","article-title":"Towards fair and decentralized privacy-preserving deep learning with blockchain","author":"lyu","year":"2019"},{"key":"ref107","article-title":"Membership inference attacks on machine learning: A survey","author":"hu","year":"2021"},{"key":"ref228","doi-asserted-by":"publisher","DOI":"10.1613\/jair.1.11763"},{"key":"ref75","first-page":"2672","article-title":"Generative adversarial nets","author":"goodfellow","year":"0","journal-title":"Proc Conf Neural Inf Process Syst"},{"key":"ref104","first-page":"1964","article-title":"Label-only membership inference attacks","author":"choquette-choo","year":"2021","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref225","article-title":"Privacy-preserving deep learning for any activation function","author":"phong","year":"2018"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-57959-7"},{"key":"ref105","article-title":"Quantifying membership inference vulnerability via generalization gap and other model metrics","author":"bentley","year":"2020"},{"key":"ref226","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2911169"},{"key":"ref77","article-title":"Guidance on intruder testing","year":"0"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1145\/3461702.3462533"},{"key":"ref223","doi-asserted-by":"publisher","DOI":"10.1145\/2046660.2046682"},{"key":"ref76","year":"2009","journal-title":"Statistical Disclosure Control Protocol"},{"key":"ref103","article-title":"When machine unlearning jeopardizes privacy","author":"chen","year":"2020"},{"key":"ref224","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2020.102807"},{"key":"ref71","article-title":"Defending model inversion and membership inference attacks via prediction purification","author":"yang","year":"2020"},{"key":"ref111","article-title":"Privacy-preserving machine learning through data obfuscation","author":"zhang","year":"2018"},{"key":"ref232","doi-asserted-by":"publisher","DOI":"10.14778\/3055540.3055542"},{"key":"ref70","article-title":"Updates-leak: Data set inference and reconstruction attacks in online learning","author":"salem","year":"2020"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/TSUSC.2019.2930526"},{"key":"ref233","article-title":"A data as a service (DaaS) model for GPU-based data analytics","author":"abe","year":"2018"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/ICDMW51313.2020.00134"},{"key":"ref230","article-title":"A convex framework for fair regression","author":"berk","year":"2017"},{"key":"ref72","article-title":"Practical defences against model inversion attacks for split neural networks","author":"titcombe","year":"2021"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2016.32"},{"key":"ref231","author":"tsybakov","year":"2008","journal-title":"Introduction to Nonparametric Estimation"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00033"},{"key":"ref119","first-page":"5508","article-title":"Time-series generative adversarial networks","author":"yoon","year":"2019","journal-title":"Proc Conf Workshop Neural Inf Process Syst"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354261"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/SCC.2019.00026"},{"key":"ref238","year":"1998","journal-title":"Data Protection Act"},{"key":"ref69","first-page":"14747","article-title":"Deep leakage from gradients","author":"zhu","year":"0","journal-title":"Proc Conf Neural Inf Process Syst"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-10925-7_31"},{"key":"ref239","year":"2016","journal-title":"The EU general data protection regulation 2016\/679 (GDPR) recital 71"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1504\/IJSN.2015.071829"},{"key":"ref115","first-page":"577","article-title":"Collective data-sanitization for preventing sensitive information inference attacks in social networks","volume":"15","author":"cai","year":"2018","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"ref236","doi-asserted-by":"publisher","DOI":"10.1093\/idpl\/ipz026"},{"key":"ref63","article-title":"Property inference from poisoning","author":"chase","year":"2021"},{"key":"ref116","first-page":"972","article-title":"Data sanitization for privacy preservation on social network","author":"tambe","year":"2016","journal-title":"Proc IEEE Int Conf Autom Control Dynamic Optim Techn"},{"key":"ref237","year":"1995","journal-title":"Data Protection Directive"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2019.8737416"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-57351-9_8"},{"key":"ref234","article-title":"Pseudonymisation techniques and best practices","year":"2019"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359824"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-016-0629-5"},{"key":"ref235","article-title":"Anonymisation: Managing data protection risk code of practice","year":"2012"},{"key":"ref60","first-page":"2938","article-title":"How to backdoor federated learning","author":"bagdasaryan","year":"2020","journal-title":"Proc Int Conf Artif Intell Statist"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363201"},{"key":"ref243","first-page":"513","article-title":"AttriGuard: A practical defense against attribute inference attacks via adversarial machine learning","author":"jia","year":"2018","journal-title":"Proc 23rd Usenix Conf Secur Symp"},{"key":"ref123","article-title":"Defending model inversion and membership inference attacks via prediction purification","author":"yang","year":"2020"},{"key":"ref62","article-title":"Model-targeted poisoning attacks with provable convergence","author":"suya","year":"2020"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2021-0041"},{"key":"ref241","year":"2018","journal-title":"Cloud ML Engine Documentation"},{"key":"ref61","first-page":"634","article-title":"Analyzing federated learning through an adversarial lens","author":"bhagoji","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1145\/3422337.3447836"},{"key":"ref242","year":"2018","journal-title":"IBM Data science and machine learning"},{"key":"ref240","year":"2018","journal-title":"Amazon Machine Learning Developer Guide"},{"key":"ref168","first-page":"1069","article-title":"Differentially private empirical risk minimization","volume":"12","author":"chaudhuri","year":"2011","journal-title":"J Mach Learn Res"},{"key":"ref169","first-page":"2722","article-title":"Differentially private empirical risk minimization revisited: Faster and more general","author":"wang","year":"2017","journal-title":"Proc 31st Int Conf Neural Inf Process Syst"},{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.29012\/jpc.660"},{"key":"ref177","article-title":"Generating differentially private datasets using GANs","author":"triastcyn","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref178","first-page":"265","article-title":"Calibrating noise to sensitivity in private data analysis","volume":"7","author":"dwork","year":"2016","journal-title":"Journal of Privacy and Confidentiality"},{"key":"ref175","first-page":"555","article-title":"Learning privately from multiparty data","author":"hamm","year":"2016","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref176","article-title":"Learning differentially private recurrent language models","author":"mcmahan","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref173","article-title":"Differentially private empirical risk minimization with sparsity-inducing norms","author":"kumar","year":"2019"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS.2014.56"},{"key":"ref171","first-page":"6526","article-title":"Differentially private empirical risk minimization with non-convex loss functions","author":"wang","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33011182"},{"key":"ref179","article-title":"When relaxations go bad: “Differentially-private” machine learning","author":"jayaraman","year":"2019"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11212-1_9"},{"key":"ref181","article-title":"Learning differentially private language models without losing accuracy","author":"mcmahan","year":"2017"},{"key":"ref188","article-title":"Scalable differentially private generative student model via PATE","author":"long","year":"2019"},{"key":"ref189","article-title":"PATE-GAN: Generating synthetic data with differential privacy guarantees","author":"jordon","year":"0","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref186","doi-asserted-by":"crossref","DOI":"10.1007\/3-540-45014-9_1","article-title":"Ensemble methods in machine learning","author":"dietterich","year":"2000","journal-title":"First International Workshop on Multiple Classifier Systems"},{"key":"ref187","article-title":"Scalable private learning with PATE","author":"papernot","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref184","first-page":"1876","article-title":"Multiparty differential privacy via aggregation of locally trained classifiers","author":"pathak","year":"2010","journal-title":"Proc 23rd Int Conf Neural Inf Process Syst"},{"key":"ref185","article-title":"Semi-supervised knowledge transfer for deep learning from private training data","author":"papernot","year":"2017"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2017.10"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1145\/1250790.1250803"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref149","article-title":"On the effectiveness of defensive distillation","author":"papernot","year":"2016"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1145\/3278721.3278725"},{"key":"ref147","article-title":"Reconciling utility and membership privacy via knowledge distillation","author":"shejwalkar","year":"2019"},{"key":"ref155","article-title":"Concentrated differential privacy","author":"dwork","year":"2016"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00019"},{"key":"ref153","doi-asserted-by":"crossref","first-page":"211","DOI":"10.1561\/0400000042","article-title":"The algorithmic foundations of differential privacy","volume":"9","author":"dwork","year":"2014","journal-title":"Found Trends Theor Comput Sci"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.1007\/11761679_29"},{"key":"ref151","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2013"},{"key":"ref152","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2018"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref159","article-title":"Subsampled renyi differential privacy and analytical moments accountant","author":"wang","year":"2019","journal-title":"Proc 22nd Int Conf Artif Intell Statist"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-53641-4_24"},{"key":"ref158","first-page":"263","article-title":"Rényi differential privacy","author":"mironov","year":"2017","journal-title":"Proc IEEE 30th Comput Secur Found s Symp"},{"key":"ref166","first-page":"2733","article-title":"(Nearly) optimal algorithms for private online learning in full-information and bandit settings","author":"thakurta","year":"2013","journal-title":"Proc 26th Int Conf Neural Inf Process Syst"},{"key":"ref167","first-page":"32","article-title":"The price of differential privacy for online learning","author":"agarwal","year":"2017","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-020-0186-1"},{"key":"ref165","first-page":"24.1","article-title":"Differentially private online learning","author":"jain","year":"2012","journal-title":"Proc 25th Annu Conf Learn Theory"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-79228-4_1"},{"key":"ref163","article-title":"Differential privacy and machine learning: A survey and review","author":"ji","year":"2014"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"ref161","article-title":"Tensorflow: Large-scale machine learning on heterogeneous distributed systems","author":"abadi","year":"2015"},{"key":"ref13","article-title":"Adversarial attacks and defences: A survey","author":"chakraborty","year":"2018"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2018.10.315"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1016\/j.eng.2019.12.012"},{"key":"ref14","article-title":"Adversarial attacks and defenses in images, graphs and text: A review","author":"xu","year":"2019"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3436755"},{"key":"ref10","article-title":"Security of deep learning methodologies: Challenges and opportunities","author":"rezaei","year":"2019"},{"key":"ref17","first-page":"107","article-title":"Understanding deep learning requires rethinking generalization","author":"zhang","year":"2017","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref16","article-title":"Poisoning attacks and defenses on artificial intelligence: A survey","author":"ram\u00edrez","year":"2022"},{"key":"ref19","article-title":"The unintended consequences of overfitting: Training data inference attacks","author":"yeom","year":"2017"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3332184"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2018.07.023"},{"key":"ref191","first-page":"9058","article-title":"On the generalization benefit of noise in stochastic gradient descent","author":"smith","year":"2020","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1109\/GlobalSIP.2013.6736861"},{"key":"ref190","article-title":"Adding gradient noise improves learning for very deep networks","author":"neelakantan","year":"2015"},{"key":"ref199","first-page":"315","article-title":"Accelerating stochastic gradient descent using predictive variance reduction","author":"johnson","year":"2013","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3220076"},{"key":"ref198","doi-asserted-by":"publisher","DOI":"10.1109\/ICTCS.2017.60"},{"key":"ref195","doi-asserted-by":"publisher","DOI":"10.1145\/3035918.3064047"},{"key":"ref196","first-page":"328","article-title":"DP-LSSGD: A stochastic optimization method to lift the utility in privacy-preserving ERM","author":"wang","year":"2020","journal-title":"Proc 1st Math Sci Mach Learn Conf"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813687"},{"key":"ref194","article-title":"Differentially private variational inference for non-conjugate models","author":"j\u00e4lk\u00f6","year":"2017","journal-title":"Conference on Uncertainty in Artificial Intelligence"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/34\/4359286\/09987657.pdf?arnumber=9987657","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,6,6]],"date-time":"2023-06-06T23:39:30Z","timestamp":1686094770000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9987657\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"references-count":243,"URL":"https:\/\/doi.org\/10.1109\/tpami.2022.3229593","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]}}}