{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,8]],"date-time":"2026-01-08T02:32:15Z","timestamp":1767839535873,"version":"3.49.0"},"publisher-location":"New York, NY, USA","reference-count":61,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,11,7]],"date-time":"2022-11-07T00:00:00Z","timestamp":1667779200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Trustworthy Federated Data Analytics","award":["ZT-I-OO1 4"],"award-info":[{"award-number":["ZT-I-OO1 4"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,11,7]]},"DOI":"10.1145\/3548606.3559359","type":"proceedings-article","created":{"date-parts":[[2022,11,7]],"date-time":"2022-11-07T11:41:28Z","timestamp":1667821288000},"page":"1917-1931","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":18,"title":["Auditing Membership Leakages of Multi-Exit Networks"],"prefix":"10.1145","author":[{"given":"Zheng","family":"Li","sequence":"first","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}]},{"given":"Yiyong","family":"Liu","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}]},{"given":"Xinlei","family":"He","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}]},{"given":"Ning","family":"Yu","sequence":"additional","affiliation":[{"name":"Salesforce Research, Palo Alto, CA, USA"}]},{"given":"Michael","family":"Backes","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}]},{"given":"Yang","family":"Zhang","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}]}],"member":"320","published-online":{"date-parts":[[2022,11,7]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"https:\/\/greenai.cloud\/.  https:\/\/greenai.cloud\/."},{"key":"e_1_3_2_2_2_1","unstructured":"https:\/\/twitter.com\/IntelAI\/status\/1089644305445208064  https:\/\/twitter.com\/IntelAI\/status\/1089644305445208064"},{"key":"e_1_3_2_2_3_1","unstructured":"https:\/\/www.cs.toronto.edu\/~kriz\/cifar.html.  https:\/\/www.cs.toronto.edu\/~kriz\/cifar.html."},{"key":"e_1_3_2_2_4_1","unstructured":"https:\/\/www.kaggle.com\/c\/tiny-imagenet.  https:\/\/www.kaggle.com\/c\/tiny-imagenet."},{"key":"e_1_3_2_2_5_1","unstructured":"https:\/\/www.kaggle.com\/c\/acquire-valued-shoppers-challenge\/data.  https:\/\/www.kaggle.com\/c\/acquire-valued-shoppers-challenge\/data."},{"key":"e_1_3_2_2_6_1","unstructured":"https:\/\/sites.google.com\/site\/yangdingqi\/home\/foursquare-dataset.  https:\/\/sites.google.com\/site\/yangdingqi\/home\/foursquare-dataset."},{"key":"e_1_3_2_2_7_1","unstructured":"https:\/\/www.dshs.texas.gov\/thcic\/hospitals\/Inpatientpudf.shtm.  https:\/\/www.dshs.texas.gov\/thcic\/hospitals\/Inpatientpudf.shtm."},{"key":"e_1_3_2_2_8_1","unstructured":"https:\/\/en.wikipedia.org\/wiki\/Z-test.  https:\/\/en.wikipedia.org\/wiki\/Z-test."},{"key":"e_1_3_2_2_9_1","unstructured":"https:\/\/github.com\/JohannesBuchner\/imagehash.  https:\/\/github.com\/JohannesBuchner\/imagehash."},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"e_1_3_2_2_11_1","first-page":"1964","volume-title":"Nicolas Papernot. Label-Only Membership Inference Attacks. In International Conference on Machine Learning (ICML)","author":"Choquette Choo Christopher A.","year":"2021","unstructured":"Christopher A. Choquette Choo , Florian Tram\u00e8r , Nicholas Carlini , and Nicolas Papernot. Label-Only Membership Inference Attacks. In International Conference on Machine Learning (ICML) , pages 1964 -- 1974 . PMLR, 2021 . Christopher A. Choquette Choo, Florian Tram\u00e8r, Nicholas Carlini, and Nicolas Papernot. Label-Only Membership Inference Attacks. In International Conference on Machine Learning (ICML), pages 1964--1974. PMLR, 2021."},{"key":"e_1_3_2_2_12_1","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.FIPS.180-4"},{"key":"e_1_3_2_2_13_1","volume-title":"Fin- gerprinting Multi-exit Deep Neural Network Models via Inference Time. CoRR abs\/2110.03175","author":"Dong Tian","year":"2021","unstructured":"Tian Dong , Han Qiu , Tianwei Zhang , Jiwei Li , Hewu Li , and Jialiang Lu . Fin- gerprinting Multi-exit Deep Neural Network Models via Inference Time. CoRR abs\/2110.03175 , 2021 . Tian Dong, Han Qiu, Tianwei Zhang, Jiwei Li, Hewu Li, and Jialiang Lu. Fin- gerprinting Multi-exit Deep Neural Network Models via Inference Time. CoRR abs\/2110.03175, 2021."},{"key":"e_1_3_2_2_14_1","first-page":"226","volume-title":"Xiaowei Xu. A Density-Based Algorithm for Discovering Clusters in Large Spatial Databases with Noise. In International Conference on Knowledge Discovery and Data Mining (KDD)","author":"Ester Martin","year":"1996","unstructured":"Martin Ester , Hans-Peter Kriegel , J\u00f6rg Sander , and Xiaowei Xu. A Density-Based Algorithm for Discovering Clusters in Large Spatial Databases with Noise. In International Conference on Knowledge Discovery and Data Mining (KDD) , pages 226 -- 231 . AAAI, 1996 . Martin Ester, Hans-Peter Kriegel, J\u00f6rg Sander, and Xiaowei Xu. A Density-Based Algorithm for Discovering Clusters in Large Spatial Databases with Noise. In International Conference on Knowledge Discovery and Data Mining (KDD), pages 226--231. AAAI, 1996."},{"key":"e_1_3_2_2_15_1","first-page":"2672","volume-title":"Yoshua Bengio. Generative Adversarial Nets. In Annual Conference on Neural Information Processing Systems (NIPS)","author":"Goodfellow Ian","year":"2014","unstructured":"Ian Goodfellow , Jean Pouget-Abadie , Mehdi Mirza , Bing Xu , David Warde-Farley , Sherjil Ozair , Aaron Courville , and Yoshua Bengio. Generative Adversarial Nets. In Annual Conference on Neural Information Processing Systems (NIPS) , pages 2672 -- 2680 . NIPS, 2014 . Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative Adversarial Nets. In Annual Conference on Neural Information Processing Systems (NIPS), pages 2672--2680. NIPS, 2014."},{"key":"e_1_3_2_2_16_1","volume-title":"International Conference on Learning Representations (ICLR)","author":"Goodfellow Ian","year":"2015","unstructured":"Ian Goodfellow , Jonathon Shlens , and Christian Szegedy . Explaining and Harness- ing Adversarial Examples . In International Conference on Learning Representations (ICLR) , 2015 . Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and Harness- ing Adversarial Examples. In International Conference on Learning Representations (ICLR), 2015."},{"key":"e_1_3_2_2_17_1","volume-title":"Emiliano De Cristofaro. LOGAN: Evaluating Privacy Leakage of Generative Models Using Generative Adversarial Networks. Privacy Enhancing Technologies Symposium","author":"Hayes Jamie","year":"2019","unstructured":"Jamie Hayes , Luca Melis , George Danezis , and Emiliano De Cristofaro. LOGAN: Evaluating Privacy Leakage of Generative Models Using Generative Adversarial Networks. Privacy Enhancing Technologies Symposium , 2019 . Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. LOGAN: Evaluating Privacy Leakage of Generative Models Using Generative Adversarial Networks. Privacy Enhancing Technologies Symposium, 2019."},{"key":"e_1_3_2_2_18_1","first-page":"770","volume-title":"Jian Sun. Deep Residual Learning for Image Recognition. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR)","author":"He Kaiming","year":"2016","unstructured":"Kaiming He , Xiangyu Zhang , Shaoqing Ren , and Jian Sun. Deep Residual Learning for Image Recognition. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages 770 -- 778 . IEEE, 2016 . Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep Residual Learning for Image Recognition. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770--778. IEEE, 2016."},{"key":"e_1_3_2_2_19_1","volume-title":"Node- Level Membership Inference Attacks Against Graph Neural Networks. CoRR abs\/2102.05429","author":"He Xinlei","year":"2021","unstructured":"Xinlei He , Rui Wen , Yixin Wu , Michael Backes , Yun Shen , and Yang Zhang . Node- Level Membership Inference Attacks Against Graph Neural Networks. CoRR abs\/2102.05429 , 2021 . Xinlei He, Rui Wen, Yixin Wu, Michael Backes, Yun Shen, and Yang Zhang. Node- Level Membership Inference Attacks Against Graph Neural Networks. CoRR abs\/2102.05429, 2021."},{"key":"e_1_3_2_2_20_1","first-page":"845","volume-title":"ACM SIGSAC Conference on Computer and Communications Security (CCS)","author":"He Xinlei","year":"2021","unstructured":"Xinlei He and Yang Zhang . Quantifying and Mitigating Privacy Risks of Con- trastive Learning . In ACM SIGSAC Conference on Computer and Communications Security (CCS) , pages 845 -- 863 . ACM, 2021 . Xinlei He and Yang Zhang. Quantifying and Mitigating Privacy Risks of Con- trastive Learning. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 845--863. ACM, 2021."},{"key":"e_1_3_2_2_21_1","volume-title":"Distilling the Knowledge in a Neural Network. CoRR abs\/1503.02531","author":"Hinton Geoffrey E.","year":"2015","unstructured":"Geoffrey E. Hinton , Oriol Vinyals , and Jeffrey Dean . Distilling the Knowledge in a Neural Network. CoRR abs\/1503.02531 , 2015 . Geoffrey E. Hinton, Oriol Vinyals, and Jeffrey Dean. Distilling the Knowledge in a Neural Network. CoRR abs\/1503.02531, 2015."},{"key":"e_1_3_2_2_22_1","volume-title":"Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference. In International Conference on Learning Representations (ICLR)","author":"Hong Sanghyun","year":"2021","unstructured":"Sanghyun Hong , Yigitcan Kaya , Ionut-Vlad Modoranu , and Tudor Dumitras . A Panda? No , It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference. In International Conference on Learning Representations (ICLR) , 2021 . Sanghyun Hong, Yigitcan Kaya, Ionut-Vlad Modoranu, and Tudor Dumitras. A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference. In International Conference on Learning Representations (ICLR), 2021."},{"key":"e_1_3_2_2_23_1","volume-title":"Qun Liu. Dyn-aBERT: Dynamic BERT with Adaptive Width and Depth. In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS","author":"Hou Lu","year":"2020","unstructured":"Lu Hou , Zhiqi Huang , Lifeng Shang , Xin Jiang , Xiao Chen , and Qun Liu. Dyn-aBERT: Dynamic BERT with Adaptive Width and Depth. In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS , 2020 . Lu Hou, Zhiqi Huang, Lifeng Shang, Xin Jiang, Xiao Chen, and Qun Liu. Dyn-aBERT: Dynamic BERT with Adaptive Width and Depth. In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2020."},{"key":"e_1_3_2_2_24_1","first-page":"1423","volume-title":"Fengming Liu. Dynamic Adaptive DNN Surgery for Inference Acceleration on the Edge. In IEEE Conference on Computer Communications (INFOCOM)","author":"Hu Chuang","year":"2019","unstructured":"Chuang Hu , Wei Bao , Dan Wang , and Fengming Liu. Dynamic Adaptive DNN Surgery for Inference Acceleration on the Edge. In IEEE Conference on Computer Communications (INFOCOM) , pages 1423 -- 1431 . IEEE, 2019 . Chuang Hu, Wei Bao, Dan Wang, and Fengming Liu. Dynamic Adaptive DNN Surgery for Inference Acceleration on the Edge. In IEEE Conference on Computer Communications (INFOCOM), pages 1423--1431. IEEE, 2019."},{"key":"e_1_3_2_2_25_1","volume-title":"International Conference on Learning Representations (ICLR)","author":"Hu Ting-Kuei","year":"2020","unstructured":"Ting-Kuei Hu , Tianlong Chen , Haotao Wang , and Zhangyang Wang . Triple Wins : Boosting Accuracy, Robustness and Efficiency Together by Enabling Input-Adaptive Inference . In International Conference on Learning Representations (ICLR) , 2020 . Ting-Kuei Hu, Tianlong Chen, Haotao Wang, and Zhangyang Wang. Triple Wins: Boosting Accuracy, Robustness and Efficiency Together by Enabling Input-Adaptive Inference. In International Conference on Learning Representations (ICLR), 2020."},{"key":"e_1_3_2_2_26_1","volume-title":"Weinberger. Multi-Scale Dense Networks for Resource Efficient Image Classification. In International Conference on Learning Representations (ICLR)","author":"Huang Gao","year":"2018","unstructured":"Gao Huang , Danlu Chen , Tianhong Li , Felix Wu , Laurens van der Maaten, and Kilian Q . Weinberger. Multi-Scale Dense Networks for Resource Efficient Image Classification. In International Conference on Learning Representations (ICLR) , 2018 . Gao Huang, Danlu Chen, Tianhong Li, Felix Wu, Laurens van der Maaten, and Kilian Q. Weinberger. Multi-Scale Dense Networks for Resource Efficient Image Classification. In International Conference on Learning Representations (ICLR), 2018."},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3358192"},{"key":"e_1_3_2_2_28_1","first-page":"615","volume-title":"Lingjia Tang. Neurosurgeon: Collaborative Intelligence Between the Cloud and Mobile Edge. In International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS)","author":"Kang Yiping","year":"2017","unstructured":"Yiping Kang , Johann Hauswald , Cao Gao , Austin Rovinski , Trevor Mudge , Jason Mars , and Lingjia Tang. Neurosurgeon: Collaborative Intelligence Between the Cloud and Mobile Edge. In International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) , pages 615 -- 629 . ACM, 2017 . Yiping Kang, Johann Hauswald, Cao Gao, Austin Rovinski, Trevor Mudge, Jason Mars, and Lingjia Tang. Neurosurgeon: Collaborative Intelligence Between the Cloud and Mobile Edge. In International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), pages 615--629. ACM, 2017."},{"key":"e_1_3_2_2_29_1","first-page":"3301","volume-title":"Tudor Dumitras. Shallow-Deep Networks: Understanding and Mitigating Network Overthinking. In International Conference on Machine Learning (ICML)","author":"Kaya Yigitcan","year":"2019","unstructured":"Yigitcan Kaya , Sanghyun Hong , and Tudor Dumitras. Shallow-Deep Networks: Understanding and Mitigating Network Overthinking. In International Conference on Machine Learning (ICML) , pages 3301 -- 3310 . PMLR, 2019 . Yigitcan Kaya, Sanghyun Hong, and Tudor Dumitras. Shallow-Deep Networks: Understanding and Mitigating Network Overthinking. In International Conference on Machine Learning (ICML), pages 3301--3310. PMLR, 2019."},{"key":"e_1_3_2_2_30_1","volume-title":"Multi-Exit Semantic Segmentation Networks. CoRR abs\/2106.03527","author":"Kouris Alexandros","year":"2021","unstructured":"Alexandros Kouris , Stylianos I. Venieris , Stefanos Laskaridis , and Nicholas D. Lane . Multi-Exit Semantic Segmentation Networks. CoRR abs\/2106.03527 , 2021 . Alexandros Kouris, Stylianos I. Venieris, Stefanos Laskaridis, and Nicholas D. Lane. Multi-Exit Semantic Segmentation Networks. CoRR abs\/2106.03527, 2021."},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5869"},{"key":"e_1_3_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372224.3419194"},{"key":"e_1_3_2_2_33_1","first-page":"1605","volume-title":"USENIX Security Symposium (USENIX Security)","author":"Leino Klas","year":"2020","unstructured":"Klas Leino and Matt Fredrikson . Stolen Memories : Leveraging Model Memo- rization for Calibrated White-Box Membership Inference . In USENIX Security Symposium (USENIX Security) , pages 1605 -- 1622 . USENIX, 2020 . Klas Leino and Matt Fredrikson. Stolen Memories: Leveraging Model Memo- rization for Calibrated White-Box Membership Inference. In USENIX Security Symposium (USENIX Security), pages 1605--1622. USENIX, 2020."},{"key":"e_1_3_2_2_34_1","first-page":"31","volume-title":"Edge Intelligence: On-Demand Deep Learning Model Co-Inference with Device-Edge Synergy","author":"Li En","year":"2018","unstructured":"En Li , Zhi Zhou , and Xu Chen . Edge Intelligence: On-Demand Deep Learning Model Co-Inference with Device-Edge Synergy . In ACM Special Interest Group on Data Communication (SIGCOMM), pages 31 -- 36 . ACM, 2018 . En Li, Zhi Zhou, and Xu Chen. Edge Intelligence: On-Demand Deep Learning Model Co-Inference with Device-Edge Synergy. In ACM Special Interest Group on Data Communication (SIGCOMM), pages 31--36. ACM, 2018."},{"key":"e_1_3_2_2_35_1","first-page":"5","volume-title":"Bruno Ribeiro. Membership Inference Attacks and Defenses in Classification Models. In ACM Conference on Data and Application Security and Privacy (CODASPY)","author":"Li Jiacheng","year":"2021","unstructured":"Jiacheng Li , Ninghui Li , and Bruno Ribeiro. Membership Inference Attacks and Defenses in Classification Models. In ACM Conference on Data and Application Security and Privacy (CODASPY) , pages 5 -- 16 . ACM, 2021 . Jiacheng Li, Ninghui Li, and Bruno Ribeiro. Membership Inference Attacks and Defenses in Classification Models. In ACM Conference on Data and Application Security and Privacy (CODASPY), pages 5--16. ACM, 2021."},{"key":"e_1_3_2_2_36_1","volume-title":"Auditing Membership Leakages of Multi-Exit Networks. CoRR abs\/2208.11180","author":"Li Zheng","year":"2022","unstructured":"Zheng Li , Yiyong Liu , Xinlei He , Ning Yu , Michael Backes , and Yang Zhang . Auditing Membership Leakages of Multi-Exit Networks. CoRR abs\/2208.11180 , 2022 . Zheng Li, Yiyong Liu, Xinlei He, Ning Yu, Michael Backes, and Yang Zhang. Auditing Membership Leakages of Multi-Exit Networks. CoRR abs\/2208.11180, 2022."},{"key":"e_1_3_2_2_37_1","first-page":"880","volume-title":"Li and Yang Zhang. Membership Leakage in Label-Only Exposures. In ACM SIGSAC Conference on Computer and Communications Security (CCS)","author":"Zheng","year":"2021","unstructured":"Zheng Li and Yang Zhang. Membership Leakage in Label-Only Exposures. In ACM SIGSAC Conference on Computer and Communications Security (CCS) , pages 880 -- 895 . ACM, 2021 . Zheng Li and Yang Zhang. Membership Leakage in Label-Only Exposures. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 880--895. ACM, 2021."},{"key":"e_1_3_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.537"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.1982.1056489"},{"key":"e_1_3_2_2_40_1","volume-title":"An Efficient K Nearest Neighbors Searching Algorithm for A Query Line. Theoretical Computer Science","author":"Nandy Subhas C.","year":"2003","unstructured":"Subhas C. Nandy , Sandip Das , and Partha P . Goswami . An Efficient K Nearest Neighbors Searching Algorithm for A Query Line. Theoretical Computer Science , 2003 . Subhas C. Nandy, Sandip Das, and Partha P. Goswami. An Efficient K Nearest Neighbors Searching Algorithm for A Query Line. Theoretical Computer Science, 2003."},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243855"},{"key":"e_1_3_2_2_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"e_1_3_2_2_43_1","first-page":"1355","volume-title":"Phuong and Christoph Lampert. Distillation-Based Training for Multi-Exit Architectures. In IEEE International Conference on Computer Vision (ICCV)","author":"Mary","year":"2019","unstructured":"Mary Phuong and Christoph Lampert. Distillation-Based Training for Multi-Exit Architectures. In IEEE International Conference on Computer Vision (ICCV) , pages 1355 -- 1364 . IEEE, 2019 . Mary Phuong and Christoph Lampert. Distillation-Based Training for Multi-Exit Architectures. In IEEE International Conference on Computer Vision (ICCV), pages 1355--1364. IEEE, 2019."},{"key":"e_1_3_2_2_44_1","volume-title":"Yoshua Bengio. FitNets: Hints for Thin Deep Nets. In International Conference on Learning Representations (ICLR)","author":"Romero Adriana","year":"2015","unstructured":"Adriana Romero , Nicolas Ballas , Samira Ebrahimi Kahou , Antoine Chassang , Carlo Gatta , and Yoshua Bengio. FitNets: Hints for Thin Deep Nets. In International Conference on Learning Representations (ICLR) , 2015 . Adriana Romero, Nicolas Ballas, Samira Ebrahimi Kahou, Antoine Chassang, Carlo Gatta, and Yoshua Bengio. FitNets: Hints for Thin Deep Nets. In International Conference on Learning Representations (ICLR), 2015."},{"key":"e_1_3_2_2_45_1","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177728190"},{"key":"e_1_3_2_2_46_1","volume-title":"Michael Backes. ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. In Network and Distributed System Security Symposium (NDSS). Internet Society","author":"Salem Ahmed","year":"2019","unstructured":"Ahmed Salem , Yang Zhang , Mathias Humbert , Pascal Berrang , Mario Fritz , and Michael Backes. ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. In Network and Distributed System Security Symposium (NDSS). Internet Society , 2019 . Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. In Network and Distributed System Security Symposium (NDSS). Internet Society, 2019."},{"key":"e_1_3_2_2_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00474"},{"key":"e_1_3_2_2_48_1","volume-title":"of the ACM","author":"Schwartz Roy","year":"2020","unstructured":"Roy Schwartz , Jesse Dodge , Noah A. Smith , and Oren Etzioni . Green AI. Commun . of the ACM , 2020 . Roy Schwartz, Jesse Dodge, Noah A. Smith, and Oren Etzioni. Green AI. Commun. of the ACM, 2020."},{"key":"e_1_3_2_2_49_1","first-page":"3","volume-title":"Vitaly Shmatikov. Membership Inference Attacks Against Machine Learning Models. In IEEE Symposium on Security and Privacy (S&P)","author":"Shokri Reza","year":"2017","unstructured":"Reza Shokri , Marco Stronati , Congzheng Song , and Vitaly Shmatikov. Membership Inference Attacks Against Machine Learning Models. In IEEE Symposium on Security and Privacy (S&P) , pages 3 -- 18 . IEEE, 2017 . Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership Inference Attacks Against Machine Learning Models. In IEEE Symposium on Security and Privacy (S&P), pages 3--18. IEEE, 2017."},{"key":"e_1_3_2_2_50_1","volume-title":"Simonyan and Andrew Zisserman. Very Deep Convolutional Networks for Large-Scale Image Recognition. In International Conference on Learning Representations (ICLR)","author":"Karen","year":"2015","unstructured":"Karen Simonyan and Andrew Zisserman. Very Deep Convolutional Networks for Large-Scale Image Recognition. In International Conference on Learning Representations (ICLR) , 2015 . Karen Simonyan and Andrew Zisserman. Very Deep Convolutional Networks for Large-Scale Image Recognition. In International Conference on Learning Representations (ICLR), 2015."},{"key":"e_1_3_2_2_51_1","volume-title":"Song and Prateek Mittal. Systematic Evaluation of Privacy Risks of Machine Learning Models. In USENIX Security Symposium (USENIX Security). USENIX","author":"Liwei","year":"2021","unstructured":"Liwei Song and Prateek Mittal. Systematic Evaluation of Privacy Risks of Machine Learning Models. In USENIX Security Symposium (USENIX Security). USENIX , 2021 . Liwei Song and Prateek Mittal. Systematic Evaluation of Privacy Risks of Machine Learning Models. In USENIX Security Symposium (USENIX Security). USENIX, 2021."},{"key":"e_1_3_2_2_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354211"},{"key":"e_1_3_2_2_53_1","volume-title":"Rob Fergus. Intriguing Properties of Neural Networks. In International Conference on Learning Representations (ICLR)","author":"Szegedy Christian","year":"2014","unstructured":"Christian Szegedy , Wojciech Zaremba , Ilya Sutskever , Joan Bruna , Dumitru Erhan , Ian Goodfellow , and Rob Fergus. Intriguing Properties of Neural Networks. In International Conference on Learning Representations (ICLR) , 2014 . Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing Properties of Neural Networks. In International Conference on Learning Representations (ICLR), 2014."},{"key":"e_1_3_2_2_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR.2016.7900006"},{"key":"e_1_3_2_2_55_1","first-page":"10218","volume-title":"Wang and Yingming Li. Harmonized Dense Knowledge Distillation Training for Multi-Exit Architectures. In AAAI Conference on Artificial Intelligence (AAAI)","author":"Xinglu","year":"2021","unstructured":"Xinglu Wang and Yingming Li. Harmonized Dense Knowledge Distillation Training for Multi-Exit Architectures. In AAAI Conference on Artificial Intelligence (AAAI) , pages 10218 -- 10226 . AAAI, 2021 . Xinglu Wang and Yingming Li. Harmonized Dense Knowledge Distillation Training for Multi-Exit Architectures. In AAAI Conference on Artificial Intelligence (AAAI), pages 10218--10226. AAAI, 2021."},{"key":"e_1_3_2_2_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSTSP.2020.2979669"},{"key":"e_1_3_2_2_57_1","first-page":"2246","volume-title":"Annual Meeting of the Association for Computational Linguistics (ACL)","author":"Xin Ji","year":"2020","unstructured":"Ji Xin , Raphael Tang , Jaejun Lee , Yaoliang Yu , and Jimmy Lin . DeeBERT : Dy- namic Early Exiting for Accelerating BERT Inference . In Annual Meeting of the Association for Computational Linguistics (ACL) , pages 2246 -- 2251 . ACL, 2020 . Ji Xin, Raphael Tang, Jaejun Lee, Yaoliang Yu, and Jimmy Lin. DeeBERT: Dy- namic Early Exiting for Accelerating BERT Inference. In Annual Meeting of the Association for Computational Linguistics (ACL), pages 2246--2251. ACL, 2020."},{"key":"e_1_3_2_2_58_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"key":"e_1_3_2_2_59_1","volume-title":"Zagoruyko and Nikos Komodakis. Wide Residual Networks. In Proceedings of the British Machine Vision Conference (BMVC). BMVA Press","author":"Sergey","year":"2016","unstructured":"Sergey Zagoruyko and Nikos Komodakis. Wide Residual Networks. In Proceedings of the British Machine Vision Conference (BMVC). BMVA Press , 2016 . Sergey Zagoruyko and Nikos Komodakis. Wide Residual Networks. In Proceedings of the British Machine Vision Conference (BMVC). BMVA Press, 2016."},{"key":"e_1_3_2_2_60_1","volume-title":"USENIX","author":"Zhou Li","year":"2019","unstructured":"Li Zhou , Hao Wen , Radu Teodorescu , and David H. C. Du . Distributing Deep Neural Networks with Containerized Partitions at the Edge. In Hot Topics in Edge Computing (HotEdge) . USENIX , 2019 . Li Zhou, Hao Wen, Radu Teodorescu, and David H. C. Du. Distributing Deep Neural Networks with Containerized Partitions at the Edge. In Hot Topics in Edge Computing (HotEdge). USENIX, 2019."},{"key":"e_1_3_2_2_61_1","volume-title":"Furu Wei. BERT Loses Patience: Fast and Robust Inference with Early Exit. In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS","author":"Zhou Wangchunshu","year":"2020","unstructured":"Wangchunshu Zhou , Canwen Xu , Tao Ge , Julian J. McAuley , Ke Xu , and Furu Wei. BERT Loses Patience: Fast and Robust Inference with Early Exit. In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS , 2020 . Wangchunshu Zhou, Canwen Xu, Tao Ge, Julian J. McAuley, Ke Xu, and Furu Wei. BERT Loses Patience: Fast and Robust Inference with Early Exit. In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2020."}],"event":{"name":"CCS '22: 2022 ACM SIGSAC Conference on Computer and Communications Security","location":"Los Angeles CA USA","acronym":"CCS '22","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3548606.3559359","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3548606.3559359","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:50:57Z","timestamp":1750182657000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3548606.3559359"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,11,7]]},"references-count":61,"alternative-id":["10.1145\/3548606.3559359","10.1145\/3548606"],"URL":"https:\/\/doi.org\/10.1145\/3548606.3559359","relation":{},"subject":[],"published":{"date-parts":[[2022,11,7]]},"assertion":[{"value":"2022-11-07","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}