{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,13]],"date-time":"2026-04-13T17:09:22Z","timestamp":1776100162061,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":54,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,11,13]],"date-time":"2022-11-13T00:00:00Z","timestamp":1668297600000},"content-version":"vor","delay-in-days":366,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"NSF (National Science Foundation)","doi-asserted-by":"publisher","award":["1937786"],"award-info":[{"award-number":["1937786"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,11,12]]},"DOI":"10.1145\/3460120.3484749","type":"proceedings-article","created":{"date-parts":[[2021,11,13]],"date-time":"2021-11-13T12:05:34Z","timestamp":1636805134000},"page":"2081-2095","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":54,"title":["EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learning"],"prefix":"10.1145","author":[{"given":"Hongbin","family":"Liu","sequence":"first","affiliation":[{"name":"Duke University, Durham, NC, USA"}]},{"given":"Jinyuan","family":"Jia","sequence":"additional","affiliation":[{"name":"Duke University, Durham, NC, USA"}]},{"given":"Wenjie","family":"Qu","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}]},{"given":"Neil Zhenqiang","family":"Gong","sequence":"additional","affiliation":[{"name":"Duke University, Durham, NC, USA"}]}],"member":"320","published-online":{"date-parts":[[2021,11,13]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2020. Twitter demands AI company stops 'collecting faces'. https:\/\/www.bbc.com\/news\/technology-51220654. (2020)."},{"key":"e_1_3_2_1_2_1","unstructured":"2021. DeepSets. https:\/\/github.com\/manzilzaheer\/DeepSets. (2021)."},{"key":"e_1_3_2_1_3_1","unstructured":"2021. FTC settlement with Ever orders data and AIs deleted after facial recognition pivot. https:\/\/techcrunch.com\/2021\/01\/12\/ftc-settlement-with-ever-orders-data-and-ais-deleted-after-facial-recognition-pivot. (2021)."},{"key":"e_1_3_2_1_4_1","unstructured":"2021. MicroImageNet classification challenge. https:\/\/www.kaggle.com\/c\/tiny-imagenet\/overview. (2021)."},{"key":"e_1_3_2_1_5_1","unstructured":"2021. MoCo. https:\/\/github.com\/facebookresearch\/moco. (2021)."},{"key":"e_1_3_2_1_6_1","unstructured":"2021. SimCLR. https:\/\/github.com\/leftthomas\/SimCLR. (2021)."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"crossref","unstructured":"Martin Abadi Andy Chu Ian Goodfellow H Brendan McMahan Ilya Mironov Kunal Talwar and Li Zhang. 2016. Deep learning with differential privacy. In CCS.","DOI":"10.1145\/2976749.2978318"},{"key":"e_1_3_2_1_8_1","volume-title":"USENIX Security Symposium.","author":"Carlini Nicholas","year":"2021","unstructured":"Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting Training Data from Large Language Models. In USENIX Security Symposium."},{"key":"e_1_3_2_1_9_1","volume-title":"Differentially private data generative models. arXiv preprint arXiv:1812.02274","author":"Chen Qingrong","year":"2018","unstructured":"Qingrong Chen, Chong Xiang, Minhui Xue, Bo Li, Nikita Borisov, Dali Kaarfar, and Haojin Zhu. 2018. Differentially private data generative models. arXiv preprint arXiv:1812.02274 (2018)."},{"key":"e_1_3_2_1_10_1","unstructured":"Ting Chen Simon Kornblith Mohammad Norouzi and Geoffrey Hinton. 2020. A simple framework for contrastive learning of visual representations. In ICML."},{"key":"e_1_3_2_1_11_1","unstructured":"Christopher A Choquette Choo Florian Tramer Nicholas Carlini and Nicolas Papernot. 2021. Label-only membership inference attacks. In ICML."},{"key":"e_1_3_2_1_12_1","unstructured":"Adam Coates Andrew Ng and Honglak Lee. 2011. An analysis of single-layer networks in unsupervised feature learning. In AISTATS."},{"key":"e_1_3_2_1_13_1","volume-title":"Martin Riedmiller, and Thomas Brox.","author":"Dosovitskiy Alexey","year":"2015","unstructured":"Alexey Dosovitskiy, Philipp Fischer, Jost Tobias Springenberg, Martin Riedmiller, and Thomas Brox. 2015. Discriminative unsupervised feature learning with exemplar convolutional neural networks. IEEE transactions on pattern analysis and machine intelligence, Vol. 38, 9 (2015), 1734--1747."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"crossref","unstructured":"John C Duchi Michael I Jordan and Martin J Wainwright. 2013. Local privacy and statistical minimax rates. In FOCS.","DOI":"10.1109\/FOCS.2013.53"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"crossref","unstructured":"Cynthia Dwork Frank McSherry Kobbi Nissim and Adam Smith. 2006. Calibrating noise to sensitivity in private data analysis. In TCC.","DOI":"10.1007\/11681878_14"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1186\/s12967-021-02992-2"},{"key":"e_1_3_2_1_17_1","unstructured":"Raia Hadsell Sumit Chopra and Yann LeCun. 2006. Dimensionality reduction by learning an invariant mapping. In CVPR."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"crossref","unstructured":"Inken Hagestedt Mathias Humbert Pascal Berrang Irina Lehmann Roland Eils Michael Backes and Yang Zhang. 2020. Membership inference against DNA methylation databases. In EuroS&P.","DOI":"10.1109\/EuroSP48549.2020.00039"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"crossref","unstructured":"Inken Hagestedt Yang Zhang Mathias Humbert Pascal Berrang Haixu Tang XiaoFeng Wang and Michael Backes. 2019. MBeacon: Privacy-Preserving Beacons for DNA Methylation Data. In NDSS.","DOI":"10.14722\/ndss.2019.23064"},{"key":"e_1_3_2_1_20_1","unstructured":"Kaiming He Haoqi Fan Yuxin Wu Saining Xie and Ross Girshick. 2020. Momentum contrast for unsupervised visual representation learning. In CVPR."},{"key":"e_1_3_2_1_21_1","unstructured":"Kaiming He Xiangyu Zhang Shaoqing Ren and Jian Sun. 2016. Deep residual learning for image recognition. In CVPR."},{"key":"e_1_3_2_1_22_1","volume-title":"Quantifying and Mitigating Privacy Risks of Contrastive Learning. arXiv preprint arXiv:2102.04140","author":"He Xinlei","year":"2021","unstructured":"Xinlei He and Yang Zhang. 2021. Quantifying and Mitigating Privacy Risks of Contrastive Learning. arXiv preprint arXiv:2102.04140 (2021)."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"crossref","unstructured":"Seira Hidano Takao Murakami and Yusuke Kawamoto. 2021. TransMIA: Membership Inference Attacks Using Transfer Shadow Training. In IJCNN.","DOI":"10.1109\/IJCNN52387.2021.9534207"},{"key":"e_1_3_2_1_24_1","volume-title":"Neil Zhenqiang Gong, and Yinzhi Cao","author":"Hui Bo","year":"2021","unstructured":"Bo Hui, Yuchen Yang, Haolin Yuan, Philippe Burlina, Neil Zhenqiang Gong, and Yinzhi Cao. 2021. Practical Blind Membership Inference Attack via Differential Comparisons. In NDSS."},{"key":"e_1_3_2_1_25_1","volume-title":"Towards practical differentially private convex optimization","author":"Iyengar Roger","unstructured":"Roger Iyengar, Joseph P Near, Dawn Song, Om Thakkar, Abhradeep Thakurta, and Lun Wang. 2019. Towards practical differentially private convex optimization. In IEEE S & P."},{"key":"e_1_3_2_1_26_1","volume-title":"USENIX Security Symposium.","author":"Jayaraman Bargav","year":"2019","unstructured":"Bargav Jayaraman and David Evans. 2019. Evaluating differentially private machine learning in practice. In USENIX Security Symposium."},{"key":"e_1_3_2_1_27_1","volume-title":"USENIX Security Symposium.","author":"Jia Jinyuan","year":"2018","unstructured":"Jinyuan Jia and Neil Zhenqiang Gong. 2018. AttriGuard: A practical defense against attribute inference attacks via adversarial machine learning. In USENIX Security Symposium."},{"key":"e_1_3_2_1_28_1","volume-title":"BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning","author":"Jia Jinyuan","unstructured":"Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong. 2022. BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning. In IEEE S & P."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363201"},{"key":"e_1_3_2_1_30_1","unstructured":"Alex Krizhevsky. 2009. Learning multiple layers of features from tiny images. Tech Report (2009)."},{"key":"e_1_3_2_1_31_1","unstructured":"Jiacheng Li Ninghui Li and Bruno Ribeiro. 2021. Membership Inference Attacks and Defenses in Classification Models. In CODASPY."},{"key":"e_1_3_2_1_32_1","unstructured":"Zheng Li and Yang Zhang. 2021. Membership Leakage in Label-Only Exposures. In CCS."},{"key":"e_1_3_2_1_33_1","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In ICLR."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"crossref","unstructured":"Milad Nasr Reza Shokri and Amir Houmansadr. 2018. Machine learning with membership privacy using adversarial regularization. In CCS.","DOI":"10.1145\/3243734.3243855"},{"key":"e_1_3_2_1_35_1","volume-title":"Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning","author":"Nasr Milad","unstructured":"Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In IEEE S & P."},{"key":"e_1_3_2_1_36_1","volume-title":"Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning","author":"Nasr Milad","year":"2021","unstructured":"Milad Nasr, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlini. 2021. Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning. In IEEE S & P."},{"key":"e_1_3_2_1_37_1","volume-title":"Representation learning with contrastive predictive coding. arXiv preprint arXiv:1807.03748","author":"van den Oord Aaron","year":"2018","unstructured":"Aaron van den Oord, Yazhe Li, and Oriol Vinyals. 2018. Representation learning with contrastive predictive coding. arXiv preprint arXiv:1807.03748 (2018)."},{"key":"e_1_3_2_1_38_1","volume-title":"Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al.","author":"Radford Alec","year":"2021","unstructured":"Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. arXiv preprint arXiv:2103.00020 (2021)."},{"key":"e_1_3_2_1_39_1","volume-title":"Language models are unsupervised multitask learners. OpenAI blog","author":"Radford Alec","year":"2019","unstructured":"Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language models are unsupervised multitask learners. OpenAI blog, Vol. 1, 8 (2019), 9."},{"key":"e_1_3_2_1_40_1","volume-title":"Y-Lan Boureau, and Yann LeCun.","author":"Ranzato Marc'Aurelio","year":"2007","unstructured":"Marc'Aurelio Ranzato, Fu Jie Huang, Y-Lan Boureau, and Yann LeCun. 2007. Unsupervised learning of invariant feature hierarchies with applications to object recognition. In CVPR."},{"key":"e_1_3_2_1_41_1","unstructured":"Alexandre Sablayrolles Matthijs Douze Cordelia Schmid Yann Ollivier and Herv\u00e9 J\u00e9gou. 2019. White-box vs black-box: Bayes optimal strategies for membership inference. In ICML."},{"key":"e_1_3_2_1_42_1","volume-title":"Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In NDSS.","author":"Salem Ahmed","year":"2019","unstructured":"Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2019. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In NDSS."},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"crossref","unstructured":"Reza Shokri and Vitaly Shmatikov. 2015. Privacy-preserving deep learning. In CCS.","DOI":"10.1109\/ALLERTON.2015.7447103"},{"key":"e_1_3_2_1_44_1","volume-title":"Membership inference attacks against machine learning models","author":"Shokri Reza","unstructured":"Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Membership inference attacks against machine learning models. In IEEE S & P."},{"key":"e_1_3_2_1_45_1","unstructured":"Karen Simonyan and Andrew Zisserman. 2015. Very deep convolutional networks for large-scale image recognition. In ICLR."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"crossref","unstructured":"Congzheng Song and Ananth Raghunathan. 2020. Information leakage in embedding models. In CCS.","DOI":"10.1145\/3372297.3417270"},{"key":"e_1_3_2_1_47_1","volume-title":"USENIX Security Symposium.","author":"Song Liwei","year":"2021","unstructured":"Liwei Song and Prateek Mittal. 2021. Systematic evaluation of privacy risks of machine learning models. In USENIX Security Symposium."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"crossref","unstructured":"Liwei Song Reza Shokri and Prateek Mittal. 2019. Privacy risks of securing machine learning models against adversarial examples. In CCS.","DOI":"10.1145\/3319535.3354211"},{"key":"e_1_3_2_1_49_1","volume-title":"USENIX Security Symposium.","author":"Tram\u00e8r Florian","year":"2016","unstructured":"Florian Tram\u00e8r, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. 2016. Stealing machine learning models via prediction apis. In USENIX Security Symposium."},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"crossref","unstructured":"Pascal Vincent Hugo Larochelle Yoshua Bengio and Pierre-Antoine Manzagol. 2008. Extracting and composing robust features with denoising autoencoders. In ICML.","DOI":"10.1145\/1390156.1390294"},{"key":"e_1_3_2_1_51_1","volume-title":"Stealing hyperparameters in machine learning","author":"Wang Binghui","unstructured":"Binghui Wang and Neil Zhenqiang Gong. 2018. Stealing hyperparameters in machine learning. In IEEE S & P."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"crossref","unstructured":"Samuel Yeom Irene Giacomelli Matt Fredrikson and Somesh Jha. 2018. Privacy risk in machine learning: Analyzing the connection to overfitting. In CSF.","DOI":"10.1109\/CSF.2018.00027"},{"key":"e_1_3_2_1_53_1","unstructured":"Manzil Zaheer Satwik Kottur Siamak Ravanbakhsh Barnabas Poczos Ruslan Salakhutdinov and Alexander Smola. 2017. Deep sets. In NeurIPS."},{"key":"e_1_3_2_1_54_1","volume-title":"Privacy Analysis of Deep Learning in the Wild: Membership Inference Attacks against Transfer Learning. arXiv preprint arXiv:2009.04872","author":"Zou Yang","year":"2020","unstructured":"Yang Zou, Zhikun Zhang, Michael Backes, and Yang Zhang. 2020. Privacy Analysis of Deep Learning in the Wild: Membership Inference Attacks against Transfer Learning. arXiv preprint arXiv:2009.04872 (2020)."}],"event":{"name":"CCS '21: 2021 ACM SIGSAC Conference on Computer and Communications Security","location":"Virtual Event Republic of Korea","acronym":"CCS '21","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3460120.3484749","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3460120.3484749","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3460120.3484749","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T20:49:25Z","timestamp":1763498965000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3460120.3484749"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,12]]},"references-count":54,"alternative-id":["10.1145\/3460120.3484749","10.1145\/3460120"],"URL":"https:\/\/doi.org\/10.1145\/3460120.3484749","relation":{},"subject":[],"published":{"date-parts":[[2021,11,12]]},"assertion":[{"value":"2021-11-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}