{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:14:59Z","timestamp":1766441699804,"version":"3.48.0"},"publisher-location":"New York, NY, USA","reference-count":58,"publisher":"ACM","funder":[{"name":"IBM-RPI AIRC","award":["A72193"],"award-info":[{"award-number":["A72193"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3744818","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:32:38Z","timestamp":1763854358000},"page":"1724-1738","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-7056-596X","authenticated-orcid":false,"given":"Zhiqi","family":"Wang","sequence":"first","affiliation":[{"name":"Rensselaer Polytechnic Institute, Troy, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-2851-0840","authenticated-orcid":false,"given":"Chengyu","family":"Zhang","sequence":"additional","affiliation":[{"name":"Rensselaer Polytechnic Institute, Troy, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2125-1119","authenticated-orcid":false,"given":"Yuetian","family":"Chen","sequence":"additional","affiliation":[{"name":"Rensselaer Polytechnic Institute, Troy, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9469-045X","authenticated-orcid":false,"given":"Nathalie","family":"Baracaldo","sequence":"additional","affiliation":[{"name":"IBM Research - Almaden, San Jose, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2006-1030","authenticated-orcid":false,"given":"Swanand R","family":"Kadhe","sequence":"additional","affiliation":[{"name":"IBM Research - Almaden, San Jose, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5968-0344","authenticated-orcid":false,"given":"Lei","family":"Yu","sequence":"additional","affiliation":[{"name":"Rensselaer Polytechnic Institute, Troy, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690194"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00019"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833649"},{"key":"e_1_3_2_1_4_1","first-page":"2633","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Carlini Nicholas","year":"2021","unstructured":"Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al., 2021. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21). 2633-2650."},{"key":"e_1_3_2_1_5_1","unstructured":"Dingfan Chen Ning Yu and Mario Fritz. 2022. RelaxLoss: Defending Membership Inference Attacks without Losing Utility. arXiv:2207.05801 [cs.LG] https:\/\/arxiv.org\/abs\/2207.05801"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417238"},{"key":"e_1_3_2_1_7_1","unstructured":"Dasol Choi and Dongbin Na. 2023. Towards Machine Unlearning Benchmarks: Forgetting the Personal Identities in Facial Recognition Systems. arXiv:2311.02240 [cs.CV] https:\/\/arxiv.org\/abs\/2311.02240"},{"key":"e_1_3_2_1_8_1","volume-title":"International conference on machine learning. PMLR","author":"Choquette-Choo Christopher A","year":"2021","unstructured":"Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. 2021. Label-only membership inference attacks. In International conference on machine learning. PMLR, 1964-1974."},{"key":"e_1_3_2_1_9_1","unstructured":"Debeshee Das Jie Zhang and Florian Tram\u00e8r. 2025. Blind Baselines Beat Membership Inference Attacks for Foundation Models. arXiv:2406.16201 [cs.CR] https:\/\/arxiv.org\/abs\/2406.16201"},{"key":"e_1_3_2_1_10_1","volume-title":"Do membership inference attacks work on large language models? arXiv preprint arXiv:2402.07841","author":"Duan Michael","year":"2024","unstructured":"Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. 2024. Do membership inference attacks work on large language models? arXiv preprint arXiv:2402.07841 (2024)."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP43922.2022.9746975"},{"key":"e_1_3_2_1_12_1","volume-title":"Deep ensembles: A loss landscape perspective. arXiv preprint arXiv:1912.02757","author":"Fort Stanislav","year":"2019","unstructured":"Stanislav Fort, Huiyi Hu, and Balaji Lakshminarayanan. 2019. Deep ensembles: A loss landscape perspective. arXiv preprint arXiv:1912.02757 (2019)."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i11.29092"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243834"},{"key":"e_1_3_2_1_16_1","unstructured":"Kaiming He Xiangyu Zhang Shaoqing Ren and Jian Sun. 2015. Deep Residual Learning for Image Recognition. arXiv:1512.03385 [cs.CV]"},{"key":"e_1_3_2_1_17_1","unstructured":"Geoffrey Hinton Oriol Vinyals and Jeff Dean. 2015. Distilling the Knowledge in a Neural Network. arXiv:1503.02531"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3523273"},{"key":"e_1_3_2_1_19_1","volume-title":"Bhanu Pratap Singh Rawat, and Hong Yu","author":"Jagannatha Abhyuday","year":"2021","unstructured":"Abhyuday Jagannatha, Bhanu Pratap Singh Rawat, and Hong Yu. 2021. Membership inference attack susceptibility of clinical language models. arXiv preprint arXiv:2104.08305 (2021)."},{"key":"e_1_3_2_1_20_1","unstructured":"Jinyuan Jia Ahmed Salem Michael Backes Yang Zhang and Neil Zhenqiang Gong. 2019. MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples. arXiv:1909.10594 [cs.CR]"},{"key":"e_1_3_2_1_21_1","volume-title":"PANORAMIA: Privacy Auditing of Machine Learning Models without Retraining. arXiv preprint arXiv:2402.09477","author":"Kazmi Mishaal","year":"2024","unstructured":"Mishaal Kazmi, Hadrien Lautraite, Alireza Akbari, Mauricio Soroco, Qiaoyue Tang, Tao Wang, S\u00e9bastien Gambs, and Mathias L\u00e9cuyer. 2024. PANORAMIA: Privacy Auditing of Machine Learning Models without Retraining. arXiv preprint arXiv:2402.09477 (2024)."},{"key":"e_1_3_2_1_22_1","volume-title":"Workshop on Hot Topics in Privacy Enhancing Technologies (HotPETs).","author":"Kumar Sasi","year":"2020","unstructured":"Sasi Kumar and Reza Shokri. 2020. ML Privacy Meter: Aiding regulatory compliance by quantifying the privacy risks of machine learning. In Workshop on Hot Topics in Privacy Enhancing Technologies (HotPETs)."},{"key":"e_1_3_2_1_23_1","unstructured":"Meghdad Kurmanji Peter Triantafillou Jamie Hayes and Eleni Triantafillou. 2023a. Towards Unbounded Machine Unlearning. arXiv:2302.09880 [cs.LG] https:\/\/arxiv.org\/abs\/2302.09880"},{"key":"e_1_3_2_1_24_1","first-page":"1957","volume-title":"Levine (Eds.)","volume":"36","author":"Kurmanji Meghdad","year":"2023","unstructured":"Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. 2023b. Towards Unbounded Machine Unlearning. In Advances in Neural Information Processing Systems, A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (Eds.), Vol. 36. Curran Associates, Inc., 1957-1987. https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2023\/file\/062d711fb777322e2152435459e6e9d9-Paper-Conference.pdf"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3422337.3447836"},{"key":"e_1_3_2_1_26_1","volume-title":"Proceedings of the 33rd USENIX Conference on Security Symposium","author":"Li Jiacheng","year":"2024","unstructured":"Jiacheng Li, Ninghui Li, and Bruno Ribeiro. 2024b. MIST: defending against membership inference attacks through membership-invariant subspace training. In Proceedings of the 33rd USENIX Conference on Security Symposium (Philadelphia, PA, USA) (SEC '24). USENIX Association, USA, Article 134, 18 pages."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.14778\/3681954.3681994"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCSS.2019.2916086"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00120"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560684"},{"key":"e_1_3_2_1_31_1","volume-title":"SGDR: Stochastic Gradient Descent with Warm Restarts. arXiv:1608.03983 [cs.LG]","author":"Loshchilov Ilya","year":"2017","unstructured":"Ilya Loshchilov and Frank Hutter. 2017. SGDR: Stochastic Gradient Descent with Warm Restarts. arXiv:1608.03983 [cs.LG]"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW59333.2023.00013"},{"key":"e_1_3_2_1_33_1","volume-title":"Membership inference attacks against language models via neighbourhood comparison. arXiv preprint arXiv:2305.18462","author":"Mattern Justus","year":"2023","unstructured":"Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Sch\u00f6lkopf, Mrinmaya Sachan, and Taylor Berg-Kirkpatrick. 2023. Membership inference attacks against language models via neighbourhood comparison. arXiv preprint arXiv:2305.18462 (2023)."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"crossref","unstructured":"Matthieu Meeus Igor Shilov Shubham Jain Manuel Faysse Marek Rei and Yves-Alexandre de Montjoye. 2025. SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It). arXiv:2406.17975 [cs.CL] https:\/\/arxiv.org\/abs\/2406.17975","DOI":"10.1109\/SaTML64287.2025.00028"},{"key":"e_1_3_2_1_35_1","volume-title":"Quantifying privacy risks of masked language models using membership inference attacks. arXiv preprint arXiv:2203.03929","author":"Mireshghallah Fatemehsadat","year":"2022","unstructured":"Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri. 2022. Quantifying privacy risks of masked language models using membership inference attacks. arXiv preprint arXiv:2203.03929 (2022)."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00069"},{"key":"e_1_3_2_1_38_1","volume-title":"Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen.","author":"Nguyen Thanh Tam","year":"2022","unstructured":"Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. 2022. A survey of machine unlearning. arXiv preprint arXiv:2209.02299 (2022)."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.5555\/1953048.2078195"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179463"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3624010"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"crossref","unstructured":"Mark Sandler Andrew Howard Menglong Zhu Andrey Zhmoginov and Liang-Chieh Chen. 2019. MobileNetV2: Inverted Residuals and Linear Bottlenecks. arXiv:1801.04381 [cs.CV]","DOI":"10.1109\/CVPR.2018.00474"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_2_1_45_1","volume-title":"Very Deep Convolutional Networks for Large-Scale Image Recognition. In International Conference on Learning Representations.","author":"Simonyan Karen","year":"2015","unstructured":"Karen Simonyan and Andrew Zisserman. 2015. Very Deep Convolutional Networks for Large-Scale Image Recognition. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_46_1","first-page":"2615","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Song Liwei","year":"2021","unstructured":"Liwei Song and Prateek Mittal. 2021. Systematic evaluation of privacy risks of machine learning models. In 30th USENIX Security Symposium (USENIX Security 21). 2615-2632."},{"key":"e_1_3_2_1_47_1","unstructured":"Nexhi Sula Abhinav Kumar Jie Hou Han Wang and Reza Tourani. 2024. Silver Linings in the Shadows: Harnessing Membership Inference for Machine Unlearning. arXiv:2407.00866 [cs.LG] https:\/\/arxiv.org\/abs\/2407.00866"},{"key":"e_1_3_2_1_48_1","volume-title":"Debugging differential privacy: A case study for privacy auditing. arXiv preprint arXiv:2202.12219","author":"Tramer Florian","year":"2022","unstructured":"Florian Tramer, Andreas Terzis, Thomas Steinke, Shuang Song, Matthew Jagielski, and Nicholas Carlini. 2022. Debugging differential privacy: A case study for privacy auditing. arXiv preprint arXiv:2202.12219 (2022)."},{"key":"e_1_3_2_1_49_1","volume-title":"Lds-fl: Loss differential strategy based federated learning for privacy preserving","author":"Wang Taiyu","year":"2023","unstructured":"Taiyu Wang, Qinglin Yang, Kaiming Zhu, Junbo Wang, Chunhua Su, and Kento Sato. 2023. Lds-fl: Loss differential strategy based federated learning for privacy preserving. IEEE Transactions on Information Forensics and Security (2023)."},{"key":"e_1_3_2_1_50_1","volume-title":"Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble. arXiv preprint arXiv: 2506.13972","author":"Wang Zhiqi","year":"2025","unstructured":"Zhiqi Wang, Chengyu Zhang, Yuetian Chen, Nathalie Baracaldo, Swanand Kadhe, and Lei Yu. 2025. Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemble. arXiv preprint arXiv: 2506.13972 (2025)."},{"key":"e_1_3_2_1_51_1","volume-title":"On the Importance of Difficulty Calibration in Membership Inference Attacks. In International Conference on Learning Representations. https:\/\/openreview.net\/forum?id=3eIrli0TwQ","author":"Watson Lauren","year":"2022","unstructured":"Lauren Watson, Chuan Guo, Graham Cormode, and Alexandre Sablayrolles. 2022. On the Importance of Difficulty Calibration in Membership Inference Attacks. In International Conference on Learning Representations. https:\/\/openreview.net\/forum?id=3eIrli0TwQ"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560675"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"key":"e_1_3_2_1_54_1","volume-title":"A Survey of Privacy Threats and Defense in Vertical Federated Learning: From Model Life Cycle Perspective. arXiv preprint arXiv: 2402.03688","author":"Yu Lei","year":"2024","unstructured":"Lei Yu, Meng Han, Yiming Li, Changting Lin, Yao Zhang, Mingyang Zhang, Yan Liu, Haiqin Weng, Yuseok Jeon, Ka-Ho Chow, and Stacy Patterson. 2024. A Survey of Privacy Threats and Defense in Vertical Federated Learning: From Model Life Cycle Perspective. arXiv preprint arXiv: 2402.03688 (2024)."},{"key":"e_1_3_2_1_55_1","unstructured":"Sergey Zagoruyko and Nikos Komodakis. 2017. Wide Residual Networks. arXiv:1605.07146 [cs.CV]"},{"key":"e_1_3_2_1_56_1","unstructured":"Sajjad Zarifzadeh Philippe Liu and Reza Shokri. 2024. Low-Cost High-Power Membership Inference Attacks. arXiv:2312.03262 [stat.ML] https:\/\/arxiv.org\/abs\/2312.03262"},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"crossref","unstructured":"Jie Zhang Debeshee Das Gautam Kamath and Florian Tram\u00e8r. 2025. Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Data. arXiv:2409.19798 [cs.LG] https:\/\/arxiv.org\/abs\/2409.19798","DOI":"10.1109\/SaTML64287.2025.00025"},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484770"}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Taipei Taiwan","acronym":"CCS '25"},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3744818","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:08:42Z","timestamp":1766441322000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3744818"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":58,"alternative-id":["10.1145\/3719027.3744818","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3744818","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}