{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T03:26:10Z","timestamp":1782789970238,"version":"3.54.5"},"reference-count":107,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2023,11,10]],"date-time":"2023-11-10T00:00:00Z","timestamp":1699574400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62102107, 62002074"],"award-info":[{"award-number":["62102107, 62002074"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"National Natural Science Foundation of China for Joint Fund Project","award":["U1936218"],"award-info":[{"award-number":["U1936218"]}]},{"name":"Basic Innovation Project for Full-time Postgraduates of Guangzhou University","award":["2021GDJC-D18"],"award-info":[{"award-number":["2021GDJC-D18"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2024,4,30]]},"abstract":"<jats:p>Machine learning (ML) has gained widespread adoption in a variety of fields, including computer vision and natural language processing. However, ML models are vulnerable to membership inference attacks (MIAs), which can infer whether access data was used in training a target model, thus compromising the privacy of training data. This has led researchers to focus on protecting the privacy of ML. To date, although there have been extensive efforts to defend against MIAs, we still lack a comprehensive understanding of the progress made in this area, which can often impede our ability to design the most effective defense strategies. In this article, we aim to fill this critical knowledge gap by providing a systematic analysis of membership inference defense. Specifically, we classify and summarize the existing membership inference defense schemes, focusing on optimization phase and objective, basic intuition, and key technology, and we discuss possible research directions of membership inference defense in the future.<\/jats:p>","DOI":"10.1145\/3620667","type":"journal-article","created":{"date-parts":[[2023,9,18]],"date-time":"2023-09-18T11:54:35Z","timestamp":1695038075000},"page":"1-34","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":41,"title":["Defenses to Membership Inference Attacks: A Survey"],"prefix":"10.1145","volume":"56","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1453-0996","authenticated-orcid":false,"given":"Li","family":"Hu","sequence":"first","affiliation":[{"name":"Guangzhou University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2854-2931","authenticated-orcid":false,"given":"Anli","family":"Yan","sequence":"additional","affiliation":[{"name":"Guangzhou University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1493-9671","authenticated-orcid":false,"given":"Hongyang","family":"Yan","sequence":"additional","affiliation":[{"name":"Guangzhou University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1279-3418","authenticated-orcid":false,"given":"Jin","family":"Li","sequence":"additional","affiliation":[{"name":"Guangzhou University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7261-6398","authenticated-orcid":false,"given":"Teng","family":"Huang","sequence":"additional","affiliation":[{"name":"Guangzhou University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-8795-8171","authenticated-orcid":false,"given":"Yingying","family":"Zhang","sequence":"additional","affiliation":[{"name":"Guangzhou University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8625-0275","authenticated-orcid":false,"given":"Changyu","family":"Dong","sequence":"additional","affiliation":[{"name":"Guangzhou University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3043-5622","authenticated-orcid":false,"given":"Chunsheng","family":"Yang","sequence":"additional","affiliation":[{"name":"National Research Council Canada, Canada and Guangzhou University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,11,10]]},"reference":[{"key":"e_1_3_1_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"e_1_3_1_3_2","article-title":"Membership privacy protection for image translation models via adversarial knowledge distillation","author":"Alvar Saeed Ranjbar","year":"2022","unstructured":"Saeed Ranjbar Alvar, Lanjun Wang, Jian Pei, and Yong Zhang. 2022. Membership privacy protection for image translation models via adversarial knowledge distillation. arXiv preprint arXiv:2203.05212 (2022).","journal-title":"arXiv preprint arXiv:2203.05212"},{"key":"e_1_3_1_4_2","first-page":"14","article-title":"A survey on membership inference attacks against machine learning","volume":"6","author":"Bai Yang","year":"2021","unstructured":"Yang Bai, Ting Chen, and Mingyu Fan. 2021. A survey on membership inference attacks against machine learning. Management 6 (2021), 14.","journal-title":"Management"},{"key":"e_1_3_1_5_2","article-title":"Membership inference attacks from first principles","author":"Carlini Nicholas","year":"2021","unstructured":"Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. 2021. Membership inference attacks from first principles. arXiv preprint arXiv:2112.03570 (2021).","journal-title":"arXiv preprint arXiv:2112.03570"},{"key":"e_1_3_1_6_2","unstructured":"Nicholas Carlini Florian Tramer Eric Wallace Matthew Jagielski Ariel Herbert-Voss Katherine Lee Adam Roberts Tom Brown Dawn Song Ulfar Erlingsson Oprea Alina and Colin Raffel. 2021. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security\u201921). 2633\u20132650."},{"key":"e_1_3_1_7_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Chen Dingfan","year":"2021","unstructured":"Dingfan Chen, Ning Yu, and Mario Fritz. 2021. RelaxLoss: Defending membership inference attacks without losing utility. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-021-05951-6"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467445"},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1142\/9789811232701_0003"},{"key":"e_1_3_1_11_2","article-title":"Differentially private data generative models","author":"Chen Qingrong","year":"2018","unstructured":"Qingrong Chen, Chong Xiang, Minhui Xue, Bo Li, Nikita Borisov, Dali Kaarfar, and Haojin Zhu. 2018. Differentially private data generative models. arXiv preprint arXiv:1812.02274 (2018).","journal-title":"arXiv preprint arXiv:1812.02274"},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-93206-0_3"},{"key":"e_1_3_1_13_2","first-page":"1964","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Choquette-Choo Christopher A.","year":"2021","unstructured":"Christopher A. Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. 2021. Label-only membership inference attacks. In Proceedings of the International Conference on Machine Learning. PMLR, 1964\u20131974."},{"key":"e_1_3_1_14_2","article-title":"Knowledge cross-distillation for membership privacy","author":"Chourasia Rishav","year":"2021","unstructured":"Rishav Chourasia, Batnyam Enkhtaivan, Kunihiro Ito, Junki Mori, Isamu Teranishi, and Hikaru Tsuchida. 2021. Knowledge cross-distillation for membership privacy. arXiv preprint arXiv:2111.01363 (2021).","journal-title":"arXiv preprint arXiv:2111.01363"},{"key":"e_1_3_1_15_2","article-title":"Membership inference attack using self influence functions","author":"Cohen Gilad","year":"2022","unstructured":"Gilad Cohen and Raja Giryes. 2022. Membership inference attack using self influence functions. arXiv preprint arXiv:2205.13680 (2022).","journal-title":"arXiv preprint arXiv:2205.13680"},{"key":"e_1_3_1_16_2","first-page":"2893","volume-title":"Proceedings of the 32nd International Conference on Neural Information Processing Systems","author":"Crowley Elliot J.","year":"2018","unstructured":"Elliot J. Crowley, Gavin Gray, and Amos J. Storkey. 2018. Moonshine: Distilling with cheap convolutions. In Proceedings of the 32nd International Conference on Neural Information Processing Systems. 2893\u20132903."},{"key":"e_1_3_1_17_2","first-page":"1","volume-title":"Proceedings of the 18th International Conference on the Design of Reliable Communication Networks (DRCN\u201922)","author":"Arcaute Gonzalo Mart\u00ednez Ruiz de","year":"2022","unstructured":"Gonzalo Mart\u00ednez Ruiz de Arcaute, Jos\u00e9 Alberto Hern\u00e1ndez, and Pedro Reviriego. 2022. Assessing the impact of membership inference attacks on classical machine learning algorithms. In Proceedings of the 18th International Conference on the Design of Reliable Communication Networks (DRCN\u201922). IEEE, 1\u20134."},{"key":"e_1_3_1_18_2","article-title":"Leveraging adversarial examples to quantify membership information leakage","author":"Grosso Ganesh Del","year":"2022","unstructured":"Ganesh Del Grosso, Hamid Jalalzai, Georg Pichler, Catuscia Palamidessi, and Pablo Piantanida. 2022. Leveraging adversarial examples to quantify membership information leakage. arXiv preprint arXiv:2203.09566 (2022).","journal-title":"arXiv preprint arXiv:2203.09566"},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.5555\/1791834.1791836"},{"key":"e_1_3_1_20_2","doi-asserted-by":"crossref","unstructured":"Cynthia Dwork Frank McSherry Kobbi Nissim and Adam Smith. 2006. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference TCC\u201906 New York NY USA March 4-7 2006. Proceedings 3 Springer 265\u2013284.","DOI":"10.1007\/11681878_14"},{"key":"e_1_3_1_21_2","unstructured":"Y. X. Fu Y. B. Qin and G. W. Shen. 2019. Sensitive data privacy protection method based on transfer learning. J. Data Acquisition Process 34 3 (2019) 422\u2013431."},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3497772"},{"key":"e_1_3_1_23_2","article-title":"Distilling the knowledge in a neural network","author":"Hinton Geoffrey","year":"2015","unstructured":"Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2015. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531 (2015).","journal-title":"arXiv preprint arXiv:1503.02531"},{"key":"e_1_3_1_24_2","article-title":"Improving neural networks by preventing co-adaptation of feature detectors","author":"Hinton Geoffrey E.","year":"2012","unstructured":"Geoffrey E. Hinton, Nitish Srivastava, Alex Krizhevsky, Ilya Sutskever, and Ruslan R. Salakhutdinov. 2012. Improving neural networks by preventing co-adaptation of feature detectors. arXiv preprint arXiv:1207.0580 (2012).","journal-title":"arXiv preprint arXiv:1207.0580"},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN52387.2021.9534381"},{"key":"e_1_3_1_26_2","doi-asserted-by":"crossref","unstructured":"Hongsheng Hu Zoran Salcic Lichao Sun Gillian Dobbie Philip S. Yu and Xuyun Zhang. 2022. Membership inference attacks on machine learning: A survey. ACM Computing Surveys 54 11s (2022) 1\u201337.","DOI":"10.1145\/3523273"},{"key":"e_1_3_1_27_2","doi-asserted-by":"crossref","unstructured":"Li Hu Jin Li Guanbiao Lin Shiyu Peng Zhenxin Zhang Yingying Zhang and Changyu Dong. 2022. Defending against membership inference attacks with high utility by GAN. IEEE Transactions on Dependable and Secure Computing 20 3 (2022) 2144\u20132157.","DOI":"10.1109\/TDSC.2022.3174569"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.4236\/jcc.2021.95007"},{"key":"e_1_3_1_29_2","doi-asserted-by":"crossref","unstructured":"Hongwei Huang Weiqi Luo Guoqiang Zeng Jian Weng Yue Zhang and Anjia Yang. 2021. Damia: leveraging domain adaptation as a defense against membership inference attacks. IEEE Transactions on Dependable and Secure Computing 19 5 (2021) 3183\u20133199.","DOI":"10.1109\/TDSC.2021.3088480"},{"key":"e_1_3_1_30_2","article-title":"Practical blind membership inference attack via differential comparisons","author":"Hui Bo","year":"2021","unstructured":"Bo Hui, Yuchen Yang, Haolin Yuan, Philippe Burlina, Neil Zhenqiang Gong, and Yinzhi Cao. 2021. Practical blind membership inference attack via differential comparisons. arXiv preprint arXiv:2101.01341 (2021).","journal-title":"arXiv preprint arXiv:2101.01341"},{"key":"e_1_3_1_31_2","article-title":"Differentially private learning does not bound membership inference","author":"Humphries Thomas","year":"2020","unstructured":"Thomas Humphries, Matthew Rafuse, Lindsey Tulloch, Simon Oya, Ian Goldberg, Urs Hengartner, and Florian Kerschbaum. 2020. Differentially private learning does not bound membership inference. arXiv preprint arXiv:2010.12112 (2020).","journal-title":"arXiv preprint arXiv:2010.12112"},{"key":"e_1_3_1_32_2","article-title":"Students parrot their teachers: Membership inference on model distillation","author":"Jagielski Matthew","year":"2023","unstructured":"Matthew Jagielski, Milad Nasr, Christopher Choquette-Choo, Katherine Lee, and Nicholas Carlini. 2023. Students parrot their teachers: Membership inference on model distillation. arXiv preprint arXiv:2303.03446 (2023).","journal-title":"arXiv preprint arXiv:2303.03446"},{"key":"e_1_3_1_33_2","article-title":"MIAShield: Defending membership inference attacks via preemptive exclusion of members","author":"Jarin Ismat","year":"2022","unstructured":"Ismat Jarin and Birhanu Eshete. 2022. MIAShield: Defending membership inference attacks via preemptive exclusion of members. arXiv preprint arXiv:2203.00915 (2022).","journal-title":"arXiv preprint arXiv:2203.00915"},{"key":"e_1_3_1_34_2","first-page":"1895","volume-title":"Proceedings of the 28th USENIX Security Symposium (USENIX Security\u201919)","author":"Jayaraman Bargav","year":"2019","unstructured":"Bargav Jayaraman and David Evans. 2019. Evaluating differentially private machine learning in practice. In Proceedings of the 28th USENIX Security Symposium (USENIX Security\u201919). 1895\u20131912."},{"key":"e_1_3_1_35_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363201"},{"key":"e_1_3_1_36_2","article-title":"Deduplicating training data mitigates privacy risks in language models","author":"Kandpal Nikhil","year":"2022","unstructured":"Nikhil Kandpal, Eric Wallace, and Colin Raffel. 2022. Deduplicating training data mitigates privacy risks in language models. arXiv preprint arXiv:2202.06539 (2022).","journal-title":"arXiv preprint arXiv:2202.06539"},{"key":"e_1_3_1_37_2","first-page":"5345","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Kaya Yigitcan","year":"2021","unstructured":"Yigitcan Kaya and Tudor Dumitras. 2021. When does data augmentation help with membership inference attacks? In Proceedings of the International Conference on Machine Learning. PMLR, 5345\u20135355."},{"key":"e_1_3_1_38_2","article-title":"On the effectiveness of regularization against membership inference attacks","author":"Kaya Yigitcan","year":"2020","unstructured":"Yigitcan Kaya, Sanghyun Hong, and Tudor Dumitras. 2020. On the effectiveness of regularization against membership inference attacks. arXiv preprint arXiv:2006.05336 (2020).","journal-title":"arXiv preprint arXiv:2006.05336"},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102378"},{"key":"e_1_3_1_40_2","first-page":"1605","volume-title":"Proceedings of the 29th USENIX Security Symposium (USENIX Security\u201920)","author":"Leino Klas","year":"2020","unstructured":"Klas Leino and Matt Fredrikson. 2020. Stolen memories: Leveraging model memorization for calibrated white-box membership inference. In Proceedings of the 29th USENIX Security Symposium (USENIX Security\u201920). 1605\u20131622."},{"key":"e_1_3_1_41_2","doi-asserted-by":"publisher","DOI":"10.1145\/3422337.3447836"},{"key":"e_1_3_1_42_2","first-page":"arXiv\u20132007","article-title":"Label-leaks: Membership inference attack with label","author":"Li Zheng","year":"2020","unstructured":"Zheng Li and Yang Zhang. 2020. Label-leaks: Membership inference attack with label. arXiv e-prints (2020), arXiv\u20132007.","journal-title":"arXiv e-prints"},{"issue":"3","key":"e_1_3_1_43_2","first-page":"15","article-title":"Membership inference attacks in black-box machine learning models","volume":"6","author":"Liu Gaoyang","year":"2021","unstructured":"Gaoyang Liu, Yutong Li, Borui Wan, Chen Wang, and Kai Peng. 2021. Membership inference attacks in black-box machine learning models. J. Cyber Secur. 6, 3 (2021), 15.","journal-title":"J. Cyber Secur."},{"key":"e_1_3_1_44_2","unstructured":"Yaru Liu Hongcheng Li Gang Huang and Wei Hua. 2022. OPUPO: Defending against membership inference Attacks With Order-Preserving and Utility-preserving obfuscation. IEEE Transactions on Dependable and Secure Computing (2022) 1\u201312."},{"key":"e_1_3_1_45_2","doi-asserted-by":"publisher","DOI":"10.1109\/MWC.01.1900525"},{"key":"e_1_3_1_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560684"},{"key":"e_1_3_1_47_2","article-title":"Understanding membership inferences on well-generalized learning models","author":"Long Yunhui","year":"2018","unstructured":"Yunhui Long, Vincent Bindschaedler, Lei Wang, Diyue Bu, Xiaofeng Wang, Haixu Tang, Carl A. Gunter, and Kai Chen. 2018. Understanding membership inferences on well-generalized learning models. arXiv preprint arXiv:1802.04889 (2018).","journal-title":"arXiv preprint arXiv:1802.04889"},{"key":"e_1_3_1_48_2","doi-asserted-by":"publisher","DOI":"10.1145\/3560830.3563721"},{"key":"e_1_3_1_49_2","article-title":"privGAN: Protecting GANs from membership inference attacks at low cost","author":"Mukherjee Sumit","year":"2019","unstructured":"Sumit Mukherjee, Yixi Xu, Anusua Trivedi, and Juan Lavista Ferres. 2019. privGAN: Protecting GANs from membership inference attacks at low cost. arXiv preprint arXiv:2001.00071 (2019).","journal-title":"arXiv preprint arXiv:2001.00071"},{"key":"e_1_3_1_50_2","first-page":"arXiv\u20132009","article-title":"Toward robustness and privacy in federated learning: Experimenting with local and central differential privacy","author":"Naseri Mohammad","year":"2020","unstructured":"Mohammad Naseri, Jamie Hayes, and Emiliano De Cristofaro. 2020. Toward robustness and privacy in federated learning: Experimenting with local and central differential privacy. arXiv e-prints (2020), arXiv\u20132009.","journal-title":"arXiv e-prints"},{"key":"e_1_3_1_51_2","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243855"},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"e_1_3_1_53_2","article-title":"Adversary instantiation: Lower bounds for differentially private machine learning","author":"Nasr Milad","year":"2021","unstructured":"Milad Nasr, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlini. 2021. Adversary instantiation: Lower bounds for differentially private machine learning. arXiv preprint arXiv:2101.04535 (2021).","journal-title":"arXiv preprint arXiv:2101.04535"},{"key":"e_1_3_1_54_2","article-title":"Semi-supervised knowledge transfer for deep learning from private training data","author":"Papernot Nicolas","year":"2016","unstructured":"Nicolas Papernot, Mart\u00edn Abadi, Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar. 2016. Semi-supervised knowledge transfer for deep learning from private training data. arXiv preprint arXiv:1610.05755 (2016).","journal-title":"arXiv preprint arXiv:1610.05755"},{"key":"e_1_3_1_55_2","first-page":"174","volume-title":"Clinical Image-based Procedures, Distributed and Collaborative Learning, Artificial Intelligence for Combating COVID-19 and Secure and Privacy-preserving Machine Learning","author":"Paul William","year":"2021","unstructured":"William Paul, Yinzhi Cao, Miaomiao Zhang, and Phil Burlina. 2021. Defending medical image diagnostics against privacy attacks using generative methods: Application to retinal diagnostics. In Clinical Image-based Procedures, Distributed and Collaborative Learning, Artificial Intelligence for Combating COVID-19 and Secure and Privacy-preserving Machine Learning. Springer, 174\u2013187."},{"key":"e_1_3_1_56_2","doi-asserted-by":"publisher","DOI":"10.1145\/3474369.3486876"},{"issue":"1","key":"e_1_3_1_57_2","first-page":"61","article-title":"Membership inference attack against differentially private deep learning model.","volume":"11","author":"Rahman Md Atiqur","year":"2018","unstructured":"Md Atiqur Rahman, Tanzila Rahman, Robert Lagani\u00e8re, Noman Mohammed, and Yang Wang. 2018. Membership inference attack against differentially private deep learning model. Trans. Data Priv. 11, 1 (2018), 61\u201379.","journal-title":"Trans. Data Priv."},{"key":"e_1_3_1_58_2","article-title":"A survey of privacy attacks in machine learning","author":"Rigaki Maria","year":"2020","unstructured":"Maria Rigaki and Sebastian Garcia. 2020. A survey of privacy attacks in machine learning. arXiv preprint arXiv:2007.07646 (2020).","journal-title":"arXiv preprint arXiv:2007.07646"},{"key":"e_1_3_1_59_2","first-page":"5558","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Sablayrolles Alexandre","year":"2019","unstructured":"Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Herv\u00e9 J\u00e9gou. 2019. White-box vs black-box: Bayes optimal strategies for membership inference. In Proceedings of the International Conference on Machine Learning. PMLR, 5558\u20135567."},{"key":"e_1_3_1_60_2","article-title":"ML-leaks: Model and data independent membership inference attacks and defenses on machine learning models","author":"Salem Ahmed","year":"2018","unstructured":"Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2018. ML-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246 (2018).","journal-title":"arXiv preprint arXiv:1806.01246"},{"key":"e_1_3_1_61_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01455"},{"key":"e_1_3_1_62_2","doi-asserted-by":"publisher","DOI":"10.5555\/1756006.1953019"},{"key":"e_1_3_1_63_2","article-title":"Membership privacy for machine learning models through knowledge transfer","author":"Shejwalkar Virat","year":"2019","unstructured":"Virat Shejwalkar and Amir Houmansadr. 2019. Membership privacy for machine learning models through knowledge transfer. arXiv preprint arXiv:1906.06589 (2019).","journal-title":"arXiv preprint arXiv:1906.06589"},{"key":"e_1_3_1_64_2","doi-asserted-by":"crossref","unstructured":"Yi Shi and Yalin Sagduyu. 2022. Membership inference attack and defense for wireless signal classifiers with deep learning. IEEE Transactions on Mobile Computing 22 7 (2022) 4032\u20134043.","DOI":"10.1109\/TMC.2022.3148690"},{"key":"e_1_3_1_65_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_1_66_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.ajhg.2015.09.010"},{"key":"e_1_3_1_67_2","volume-title":"Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)","author":"Song Liwei","year":"2021","unstructured":"Liwei Song and Prateek Mittal. 2021. Systematic evaluation of privacy risks of machine learning models. In Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)."},{"key":"e_1_3_1_68_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"e_1_3_1_69_2","article-title":"Benign overparameterization in membership inference with early stopping","author":"Tan Jasper","year":"2022","unstructured":"Jasper Tan, Daniel LeJeune, Blake Mason, Hamid Javadi, and Richard G. Baraniuk. 2022. Benign overparameterization in membership inference with early stopping. arXiv preprint arXiv:2205.14055 (2022).","journal-title":"arXiv preprint arXiv:2205.14055"},{"key":"e_1_3_1_70_2","article-title":"Mitigating membership inference attacks by self-distillation through a novel ensemble architecture","author":"Tang Xinyu","year":"2021","unstructured":"Xinyu Tang, Saeed Mahloujifar, Liwei Song, Virat Shejwalkar, Milad Nasr, Amir Houmansadr, and Prateek Mittal. 2021. Mitigating membership inference attacks by self-distillation through a novel ensemble architecture. arXiv preprint arXiv:2110.08324 (2021).","journal-title":"arXiv preprint arXiv:2110.08324"},{"issue":"1","key":"e_1_3_1_71_2","first-page":"15","article-title":"Research progress and challenges of membership inference attacks in machine learning","volume":"12","author":"Ting Gao","year":"2022","unstructured":"Gao Ting. 2022. Research progress and challenges of membership inference attacks in machine learning. Oper. Res. Fuzziol. 12, 1 (2022), 15.","journal-title":"Oper. Res. Fuzziol."},{"key":"e_1_3_1_72_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298664"},{"key":"e_1_3_1_73_2","article-title":"Data and model dependencies of membership inference attack","author":"Tonni Shakila Mahjabin","year":"2020","unstructured":"Shakila Mahjabin Tonni, Dinusha Vatsalan, Farhad Farokhi, Dali Kaafar, Zhigang Lu, and Gioacchino Tangari. 2020. Data and model dependencies of membership inference attack. arXiv preprint arXiv:2002.06856 (2020).","journal-title":"arXiv preprint arXiv:2002.06856"},{"key":"e_1_3_1_74_2","article-title":"Generating artificial data for private deep learning","author":"Triastcyn Aleksei","year":"2018","unstructured":"Aleksei Triastcyn and Boi Faltings. 2018. Generating artificial data for private deep learning. arXiv preprint arXiv:1803.03148 (2018).","journal-title":"arXiv preprint arXiv:1803.03148"},{"key":"e_1_3_1_75_2","doi-asserted-by":"publisher","DOI":"10.1145\/3378679.3394533"},{"key":"e_1_3_1_76_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPS-ISA48467.2019.00019"},{"key":"e_1_3_1_77_2","doi-asserted-by":"crossref","unstructured":"Stacey Truex Ling Liu Mehmet Emre Gursoy Lei Yu and Wenqi Wei. 2019. Demystifying membership inference attacks in machine learning as a service. IEEE Transactions on Services Computing 14 6 (2019) 2073\u20132089.","DOI":"10.1109\/TSC.2019.2897554"},{"key":"e_1_3_1_78_2","article-title":"Defending against membership inference attacks on Beacon services","author":"Venkatesaramani Rajagopal","year":"2021","unstructured":"Rajagopal Venkatesaramani, Zhiyu Wan, Bradley A. Malin, and Yevgeniy Vorobeychik. 2021. Defending against membership inference attacks on Beacon services. arXiv preprint arXiv:2112.13301 (2021).","journal-title":"arXiv preprint arXiv:2112.13301"},{"issue":"2","key":"e_1_3_1_79_2","first-page":"87","article-title":"Controlling the signal: Practical privacy protection of genomic data sharing through Beacon services","volume":"10","author":"Wan Zhiyu","year":"2017","unstructured":"Zhiyu Wan, Yevgeniy Vorobeychik, Murat Kantarcioglu, and Bradley Malin. 2017. Controlling the signal: Practical privacy protection of genomic data sharing through Beacon services. BMC Med. Genom. 10, 2 (2017), 87\u2013100.","journal-title":"BMC Med. Genom."},{"key":"e_1_3_1_80_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSUSC.2019.2930526"},{"key":"e_1_3_1_81_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33011190"},{"issue":"10","key":"e_1_3_1_82_2","first-page":"7","article-title":"A survey on membership inference on training datasets in machine learning","volume":"10","author":"Wang Lulu","year":"2019","unstructured":"Lulu Wang, Peng Zhang, Zheng Yan, and Xiaokang Zhou. 2019. A survey on membership inference on training datasets in machine learning. Cybersp. Secur. 10, 10 (2019), 7.","journal-title":"Cybersp. Secur."},{"key":"e_1_3_1_83_2","doi-asserted-by":"crossref","unstructured":"Yijue Wang Chenghong Wang Zigeng Wang Shanglin Zhou Hang Liu Jinbo Bi Caiwen Ding and Sanguthevar Rajasekaran. 2020. Against membership inference attack: Pruning is all you need. arXiv preprint arXiv:2008.13578 (2020).","DOI":"10.24963\/ijcai.2021\/432"},{"key":"e_1_3_1_84_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR48806.2021.9413067"},{"key":"e_1_3_1_85_2","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-016-0043-6"},{"key":"e_1_3_1_86_2","article-title":"Canary in a coalmine: Better membership inference with ensembled adversarial queries","author":"Wen Yuxin","year":"2022","unstructured":"Yuxin Wen, Arpit Bansal, Hamid Kazemi, Eitan Borgnia, Micah Goldblum, Jonas Geiping, and Tom Goldstein. 2022. Canary in a coalmine: Better membership inference with ensembled adversarial queries. arXiv preprint arXiv:2210.10750 (2022).","journal-title":"arXiv preprint arXiv:2210.10750"},{"key":"e_1_3_1_87_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.6107"},{"key":"e_1_3_1_88_2","article-title":"Generalization in generative adversarial networks: A novel perspective from privacy protection","volume":"32","author":"Wu Bingzhe","year":"2019","unstructured":"Bingzhe Wu, Shiwan Zhao, Chaochao Chen, Haoyang Xu, Li Wang, Xiaolu Zhang, Guangyu Sun, and Jun Zhou. 2019. Generalization in generative adversarial networks: A novel perspective from privacy protection. Adv. Neural Inf. Process. Syst. 32 (2019).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"e_1_3_1_89_2","article-title":"Differentially private generative adversarial network","author":"Xie Liyang","year":"2018","unstructured":"Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. 2018. Differentially private generative adversarial network. arXiv preprint arXiv:1802.06739 (2018).","journal-title":"arXiv preprint arXiv:1802.06739"},{"key":"e_1_3_1_90_2","article-title":"NeuGuard: Lightweight neuron-guided defense against membership inference attacks","author":"Xu Nuo","year":"2022","unstructured":"Nuo Xu, Binghui Wang, Ran Ran, Wujie Wen, and Parv Venkitasubramaniam. 2022. NeuGuard: Lightweight neuron-guided defense against membership inference attacks. arXiv preprint arXiv:2206.05565 (2022).","journal-title":"arXiv preprint arXiv:2206.05565"},{"key":"e_1_3_1_91_2","article-title":"Use the spear as a shield: A novel adversarial example based privacy-preserving technique against membership inference attacks","author":"Xue Mingfu","year":"2020","unstructured":"Mingfu Xue, Chengxiang Yuan, Can He, Zhiyu Wu, Yushu Zhang, Zhe Liu, and Weiqiang Liu. 2020. Use the spear as a shield: A novel adversarial example based privacy-preserving technique against membership inference attacks. arXiv preprint arXiv:2011.13696 (2020).","journal-title":"arXiv preprint arXiv:2011.13696"},{"key":"e_1_3_1_92_2","article-title":"Privacy-preserving generative framework against membership inference attacks","author":"Yang Ruikang","year":"2022","unstructured":"Ruikang Yang, Jianfeng Ma, Yinbin Miao, and Xindi Ma. 2022. Privacy-preserving generative framework against membership inference attacks. arXiv preprint arXiv:2202.05469 (2022).","journal-title":"arXiv preprint arXiv:2202.05469"},{"key":"e_1_3_1_93_2","article-title":"Defending model inversion and membership inference attacks via prediction purification","author":"Yang Ziqi","year":"2020","unstructured":"Ziqi Yang, Bin Shao, Bohan Xuan, Ee-Chien Chang, and Fan Zhang. 2020. Defending model inversion and membership inference attacks via prediction purification. arXiv preprint arXiv:2005.03915 (2020).","journal-title":"arXiv preprint arXiv:2005.03915"},{"key":"e_1_3_1_94_2","article-title":"Purifier: Defending data inference attacks via transforming confidence scores","author":"Yang Ziqi","year":"2022","unstructured":"Ziqi Yang, Lijin Wang, Da Yang, Jie Wan, Ziming Zhao, Ee-Chien Chang, Fan Zhang, and Kui Ren. 2022. Purifier: Defending data inference attacks via transforming confidence scores. arXiv preprint arXiv:2212.00612 (2022).","journal-title":"arXiv preprint arXiv:2212.00612"},{"key":"e_1_3_1_95_2","article-title":"Enhanced membership inference attacks against machine learning models","author":"Ye Jiayuan","year":"2021","unstructured":"Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. 2021. Enhanced membership inference attacks against machine learning models. arXiv preprint arXiv:2111.09679 (2021).","journal-title":"arXiv preprint arXiv:2111.09679"},{"key":"e_1_3_1_96_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"key":"e_1_3_1_97_2","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467444"},{"key":"e_1_3_1_98_2","doi-asserted-by":"publisher","DOI":"10.1145\/3411501.3419428"},{"key":"e_1_3_1_99_2","unstructured":"Yu FU and others. 2019. Multi-source data privacy protection based on transfer learning. Computer Engineering & Science 41 4 (2019) 641."},{"key":"e_1_3_1_100_2","article-title":"Privacy for all: Demystify vulnerability disparity of differential privacy against membership inference attack","author":"Zhang Bo","year":"2020","unstructured":"Bo Zhang, Ruotong Yu, Haipei Sun, Yanying Li, Jun Xu, and Hui Wang. 2020. Privacy for all: Demystify vulnerability disparity of differential privacy against membership inference attack. arXiv preprint arXiv:2001.08855 (2020).","journal-title":"arXiv preprint arXiv:2001.08855"},{"key":"e_1_3_1_101_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484770"},{"key":"e_1_3_1_102_2","article-title":"Privacy-preserving machine learning through data obfuscation","author":"Zhang Tianwei","year":"2018","unstructured":"Tianwei Zhang, Zecheng He, and Ruby B. Lee. 2018. Privacy-preserving machine learning through data obfuscation. arXiv preprint arXiv:1807.01860 (2018).","journal-title":"arXiv preprint arXiv:1807.01860"},{"key":"e_1_3_1_103_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01237-3_12"},{"key":"e_1_3_1_104_2","unstructured":"Xinyang Zhang Shouling Ji and Ting Wang. 2018. Differentially private releasing via deep generative model (technical report). arXiv preprint arXiv:1801.01594 (2018)."},{"key":"e_1_3_1_105_2","article-title":"Evaluating membership inference through adversarial robustness","author":"Zhang Zhaoxi","year":"2022","unstructured":"Zhaoxi Zhang, Leo Yu Zhang, Xufei Zheng, Bilal Hussain Abbasi, and Shengshan Hu. 2022. Evaluating membership inference through adversarial robustness. arXiv preprint arXiv:2205.06986 (2022).","journal-title":"arXiv preprint arXiv:2205.06986"},{"key":"e_1_3_1_106_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909559"},{"key":"e_1_3_1_107_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.04.082"},{"key":"e_1_3_1_108_2","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3501279"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3620667","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3620667","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T00:03:43Z","timestamp":1750291423000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3620667"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,10]]},"references-count":107,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2024,4,30]]}},"alternative-id":["10.1145\/3620667"],"URL":"https:\/\/doi.org\/10.1145\/3620667","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,11,10]]},"assertion":[{"value":"2022-07-22","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-08-22","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-11-10","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}