AugMixCloak: A Defense against Membership Inference Attacks via Image Transformation

Alberto Huertas; Burkhard Stiller; Chao Feng; Heqing Ren

REVIEW 2 major objections 6 minor 25 references

AugMixCloak: A Defense against Membership Inference Attacks via Image Transformation

T0 review · 2 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read AugMixCloak claims training-free, test-time image transformations that push all evaluated membership inference attacks to F1-scores near 0.5.

desk verdict Clever test-time MIA defense that undermines its own evidence by tuning defense parameters to the attack metric on the same data. read the letter →

arxiv 2505.07149 v1 pith:USQCKLRR submitted 2025-05-11 cs.LG

Heqing Ren , Chao Feng , Alberto Huertas , Burkhard Stiller This is my paper · ORCID

classification cs.LG

keywords membershipinferenceattackdecentralizedfederatedlearningtest-timedefenseperceptualhashingdataaugmentationPCAinformationfusionimagetransformationprivacy

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that membership inference in decentralized federated learning can be defeated at query time, without retraining or model modification, by transforming any submitted image whose perceptual hash matches a locally stored training-image hash. The transformation, deterministic data augmentation followed by PCA-based fusion with a class prototype, erases the overfitting signature that makes members distinguishable from non-members. Reported results across CIFAR-10, CIFAR-100, Fashion-MNIST, Tiny-ImageNet, and ImageNet-10 under fully connected, ring, and star topologies show binary-classifier MIA and three metric-based MIAs dropping to F1-scores near 0.5, while test accuracy stays essentially unchanged. If correct, this gives federated deployments a lightweight, training-free defense that masks membership signals only for suspicious queries and leaves benign predictions alone.

What carries the argument

The load-bearing mechanism is the deterministic query pipeline: a perceptual-hash ($\mathrm{pHash}$) gate, hash-indexed augmentation, and PCA fusion. For each query, the participant checks the image's pHash against local and neighbor pHash lists; only on a match is the image transformed. The transformation selects $k$ augmentation operations from a fixed list of 12 via $\mathit{aug\_key} = \mathit{pHash}_{\mathrm{dec}} \bmod 12$, and selects a per-class PCA-reconstructed prototype via $\mathit{PCA\_key} = \mathit{pHash}_{\mathrm{dec}} \bmod n_{\mathrm{cls}}$, fusing pixel-wise as $I_{\mathrm{fused}}(i,j) = \alpha I_{\mathrm{aug}}(i,j) + (1-\alpha) I_{\mathrm{pca}}(i,j)$. The pHash gate makes the defense reactive; the hash-derived indices make it deterministic and reproducible; and the PCA prototype pulls member images toward class-level structure, erasing sample-specific overfitting cues. An automatic tuning script chooses the augmentation count and $\alpha$ so that all four attack F1-scores sit within $[0.35, 0.65]$ and as close to 0.5 as possible.

What would settle it

Take a training image from one of the five datasets, add a small perturbation that changes its pHash but leaves the model's high confidence on that image intact, and query the defended model: if a binary-classifier or metric MIA returns an F1-score meaningfully above 0.5 on such queries, the gate has been bypassed. A simpler oracle test: query the same image twice, once exactly and once with a pixel-level tweak that flips the pHash; if the two model outputs differ, the difference itself reveals membership.

Watch

Extended reading notes

Core claim

The central claim is that MIA's root cause, overfitting-induced output differences between member and non-member images, can be removed at inference time by modifying the input rather than the model or its confidence scores. AugMixCloak does this by detecting suspicious queries through pHash matching against training-set hash lists, then applying a query-specific augmentation sequence and linearly blending the result with a PCA-reconstructed image of the matched class. Because the selection of augmentations and prototypes is derived from the hash, the defense is deterministic: repeated identical queries receive identical processed images. The paper reports that after defense, training accuracy (Acc1) drops substantially while test accuracy (Acc2) remains essentially unchanged, and all four attack F1-scores fall in [0.4, 0.6] across datasets and topologies, implying that attackers cannot distinguish members from non-members. It further claims stronger protection than L2 regularization on CIFAR-10 and Fashion-MNIST and better generalization than confidence clipping, which fails against binary MIA on Tiny-ImageNet.

Load-bearing premise

All protection rests on the assumption that an attacker cannot submit a membership-revealing image whose perceptual hash differs from every stored training-set hash, because any such image bypasses the transformation and keeps its membership signal.

Editorial extensions

If this is right

On the evaluated settings, both binary-classifier and metric-based MIAs fall to F1-scores near 0.5, so membership inference becomes statistically indistinguishable from random guessing.
Because the defense is applied only at test time, it can protect an already trained DFL model without re-running federated training, changing aggregation, or adding per-round communication cost.
The deterministic hash-indexed transformation means the same query image always yields the same processed image, so attackers cannot exploit randomness in the defense.
Defense parameters transfer across fully connected, ring, and star topologies and across lightweight CNN, VGG16, ResNet18, and ResNet50 models, according to the reported results.
The automatic intensity script lets a practitioner tune augmentation count and fusion weight to bring all four attack F1-scores close to 0.5 on a new dataset.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

An attacker who can craft a membership-revealing image whose pHash differs from every stored training hash would bypass the defense entirely; this adaptive attack is not evaluated in the paper and is the natural next test.
Because the transformation is deterministic and keyed on pHash, an attacker with black-box access could compare outputs for an exact copy and a slightly altered copy of a candidate image; any output difference acts as a membership oracle, so the defense's privacy guarantee depends on the gate being unavoidable.
The mechanism is effectively a test-time regularizer: pulling member images toward class prototypes removes sample-specific memorization cues, which suggests it might also blunt other memorization-based attacks such as attribute inference, though the paper does not test this.
The per-query cost is one hash lookup plus one augmentation and one linear blend, so if the gate assumption holds, the defense could be deployed on resource-constrained FL clients without training-phase overhead.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The core idea is genuinely worth a look: a test-time, training-free defense that gates on perceptual hash and then transforms suspicious inputs via augmentation and PCA fusion. That is a new mechanism in the DFL setting, and the paper shows real care in the threat model and in preserving benign-user accuracy (Acc2 barely moves). The multi-dataset, multi-topology sweep is a reasonable effort.

The problem is that the main evidence is partly a selection artifact. Section 3.2 describes a script that iterates over defense configurations and picks the one whose F1-scores are closest to 0.5 on the exact attack evaluation used in Tables 3-6. That is not a neutral measurement; it is parameter fitting against the reported outcome. The paper is transparent about it, which is good, but it means the near-0.5 F1 values are constructed, not discovered. This is load-bearing, because the whole claim of "reducing MIA to random guessing" rests on those numbers.

The other soft spot is that the pHash gate is trivially bypassable in a realistic threat model: a small adversarial perturbation that flips the perceptual hash but leaves the overfitting signal intact would walk straight through. The paper does not evaluate adaptive attacks, and the deterministic transformation (which is only partially deterministic, given the probability weights in Table 2) creates an easy oracle. These are addressable, but they matter for a security claim.

On balance, the mechanism is plausible and the direction is useful, but the central empirical claim is not yet supported. The right fix is to select parameters on a held-out attack partition, report variance across seeds, and evaluate at least one adaptive attack. I would not cite this in its current form, but it is a serious paper that deserves a referee and a request for revision rather than a desk reject.

Referee Report

2 major / 6 minor

Summary. The paper proposes AugMixCloak, a test-time defense against membership inference attacks in decentralized federated learning (DFL). The defense first uses perceptual hashing (pHash) to check whether a query image matches or closely resembles any image in the local training set; if so, it applies a deterministic combination of data augmentation and PCA-based image fusion before the image is fed to the model. The authors report experiments on five datasets and three DFL topologies, claiming that after defense the F1-scores of binary classifier-based and three metric-based MIAs fall near 0.5 (random guessing) while test accuracy (Acc2) is essentially unchanged. They also compare AugMixCloak with L2 regularization and confidence score masking, reporting stronger defense effectiveness and better generalization.

Significance. If validated, AugMixCloak would be a novel and practical contribution: it is training-free, operates purely at test time, is deterministic, and targets a setting (DFL) for which few lightweight defenses exist. The idea of using pHash-based detection followed by query transformation is creative and addresses a real gap. However, the current evidence for the central effectiveness claim is weakened by two issues. First, the defense parameters are selected by a script that minimizes the deviation of the exact reported MIA F1-scores from 0.5 on the same datasets and topologies used for the final evaluation, making the near-0.5 results partly a product of fitting. Second, the entire defense rests on the pHash gate being non-evadable, but the paper does not evaluate adaptive attackers who perturb queries to change the pHash while preserving the membership signal. Both issues are fixable in revision, but they currently prevent the paper from supporting its main claim. The manuscript also provides no code, no variance estimates, and a few inconsistencies in the evaluation description.

major comments (2)

[Section 3.2, Table 2, Tables 3-6]
[Section 3.1, Step 1]

minor comments (6)

[Algorithm 1]
[Equation 4]
[Section 5.2, Tables 3-6]
[Figures 5-8]
[Table 1]
[Section 4.1]

Circularity Check

1 steps flagged · score 7.0 of 10

Defense parameters are tuned to drive the reported MIA F1-scores to 0.5, so Tables 3-6 show selection artifacts rather than independent evidence of effectiveness.

fitted input called prediction [Section 3.2 (Automatic Determination of Defense Intensity), results reported in Section 5.2, Tables 3-6]
"The core idea of the script is to iterate over different values of α, and for each α, identify the predefined defense parameter combination (num, weights) that yields F1-scores within the range of [0.35, 0.65] and has the smallest deviation from 0.5, denoted as best_config. It then refines the parameter combination based on best_config to bring the F1-scores even closer to 0.5, and finally selects the configuration with the overall smallest deviation."

The reported post-defense F1-scores in Tables 3-6 are generated using exactly the configurations the script selects by minimizing deviation from 0.5 on the same binary-classifier and metric-based MIA evaluations that are later presented as evidence. There is no held-out attack partition or fixed default parameter set; Table 2 simply lists the selected configurations, and Section 5.3 confirms that 'by adjusting the values of data augmentation intensity and α, all the four F1-scores can be brought as close to 0.5 as possible.' Thus the central claim that AugMixCloak 'effectively mitigates' MIA is not independently measured: F1 ≈ 0.5 is the search objective, so the conclusion is an artifact of parameter fitting rather than a prediction from first principles.

full rationale

The central load-bearing evidence for AugMixCloak's effectiveness is the post-defense F1 ≈ 0.5 reported in Tables 3-6. However, Section 3.2 explicitly describes a script that selects (num, weights, α) by minimizing the deviation of those exact F1-scores from 0.5 on the same evaluation setup used to declare success. This is a textbook case of a fitted input being presented as a prediction: the 'Yes' rows in Tables 3-6 are the output of the search objective, not an independent evaluation of a pre-specified defense. Section 5.3 reinforces this by stating that all four F1-scores can be brought as close to 0.5 as possible by adjusting intensity and α. No held-out attack data, seed-level variability, or default parameter set is reported, so the apparent success could be obtained by any sufficiently flexible transformation family tuned on the same metrics. There is no load-bearing self-citation circularity: reference [1] is background, and the other citations are standard. The circularity is therefore concentrated in the experimental validation, but because that validation is the entirety of the paper's central claim, the score is 7 rather than lower.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim rests on two fitted parameters per dataset/topology (α and augmentation intensity) and, more importantly, on the untested assumption that the pHash gate cannot be evaded by adaptive attackers. No new physical entities are postulated.

free parameters (2)

fusion weight α per dataset/topology = 0.5 to 0.9 depending on dataset/topology (Table 2)
Selected by the search script in Section 3.2 to bring membership inference F1-scores closest to 0.5 on the same datasets and topologies used for the reported evaluation.
data augmentation intensity (number of augmentations and probability weights) per dataset/topology = e.g., n=[0,1], w=[0.7,0.3] for CIFAR-10 fully connected (Table 2)
Also selected by the search script on the same evaluation data, so the reported near-0.5 F1 values are partially a result of fitting.

assumptions (4)

domain assumption pHash values are stable for near-identical images and rarely collide between training and test sets.
Section 3.1 and Figures 2-3 use this to argue that true members are detected and benign test images are almost never transformed.
domain assumption The defender can compute pHash lists of all local training images and use them to gate queries in real time.
Step 1 of Section 3.1 assumes the participant can access its local data during inference to build and search the pHash list.
ad hoc to paper An adversary will not adapt to the pHash gate or the deterministic transformation.
The paper evaluates only non-adaptive attacks that submit exact or unmodified images, and does not discuss perturbation attacks or query-difference oracles.
domain assumption The first principal component of a class's images captures the structural information needed so that fused images remain classifiable by the original model.
Section 3.1 Step 3 and Figure 4 assume PCA reconstruction preserves enough semantics to maintain model utility for transformed members.

how reviews work

0 comments

Cite this review

Pith. "Pith review of AugMixCloak: A Defense against Membership Inference Attacks via Image Transformation." pith.science (2026). https://pith.science/paper/USQCKLRR

@misc{pith2026250507149,
  author       = {Pith},
  title        = {Pith review of: AugMixCloak: A Defense against Membership Inference Attacks via Image Transformation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/USQCKLRR}},
  note         = {Machine review of arXiv:2505.07149}
}

read the original abstract

Traditional machine learning (ML) raises serious privacy concerns, while federated learning (FL) mitigates the risk of data leakage by keeping data on local devices. However, the training process of FL can still leak sensitive information, which adversaries may exploit to infer private data. One of the most prominent threats is the membership inference attack (MIA), where the adversary aims to determine whether a particular data record was part of the training set. This paper addresses this problem through a two-stage defense called AugMixCloak. The core idea is to apply data augmentation and principal component analysis (PCA)-based information fusion to query images, which are detected by perceptual hashing (pHash) as either identical to or highly similar to images in the training set. Experimental results show that AugMixCloak successfully defends against both binary classifier-based MIA and metric-based MIA across five datasets and various decentralized FL (DFL) topologies. Compared with regularization-based defenses, AugMixCloak demonstrates stronger protection. Compared with confidence score masking, AugMixCloak exhibits better generalization.

Figures

Figures reproduced from arXiv: 2505.07149 by the authors.

**Figure 1.** Methodology There are two primary reasons for choosing pHash over average hashing (aHash) and difference hashing (dHash). First, pHash assigns identical hash values to images with slight differences. Therefore, query images that are highly similar to a training set image are also likely to be identified as part of the training set. Second, the number of duplicate pHash values in the training dataset and the frequ… view at source ↗

**Figure 2.** Duplicate Hashes in Training Set pHash aHash dHash 0 4 8 12 16 2 12 0 [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 4.** illustrates the fusion process between a data-augmented image and a PCA-reconstructed image. The image on the left is a horizontally flipped dog image from the CIFAR-10 dataset. The center image is a PCA-reconstructed image generated from the automobile class in the CIFAR-10 dataset, which clearly reveals distinctive features of automobiles. These two images are linearly combined with α = 80%, indicating that 80% … view at source ↗

Figures from the paper (3 more)

**Figure 5.** Figure 5: Accuracy vs Intensity 0.0 0.2 0.4 0.6 0.8 1.0 Alpha 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 Accuracy Train Accuracy Test Accuracy [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

**Figure 7.** Figure 7: F1-score vs Intensity 0.0 0.2 0.4 0.6 0.8 1.0 Alpha 0.0 0.1 0.2 0.3 0.4 0.5 F1-score Binary M1 M2 M3 [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]

**Figure 9.** Figure 9: Comparison in CIFAR10 Binary M1 M2 M3 0.2 0.4 0.6 0.8 0.517 0.567 0.526 0.601 0.433 0.450 0.522 0.600 AugMixCloak Regularization [PITH_FULL_IMAGE:figures/full_fig_p007_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

25 extracted references · 20 canonical work pages

[1]

E. T. M. Beltrán, M. Q. Pérez, P. M. S. Sánchez, S. L. Bernal, G. Bovet, M. G. Pérez, G. M. Pérez, and A. H. Celdrán. Decentralized federated learning: Fundamentals, state of the art, frameworks, trends, and chal- lenges. IEEE Communications Surveys & Tutorials, 25(4):2983–3013, 2023

work page 2023
[2]

Bonawitz, V

K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth. Practical secure aggregation for privacy-preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1175–1191, 2017

work page 2017
[3]

Bouacida and P

N. Bouacida and P. Mohapatra. Vulnerabilities in federated learning. IEEe Access, 9:63229–63249, 2021

work page 2021
[4]

D. Chen, N. Yu, Y . Zhang, and M. Fritz. Gan-leaks: A taxonomy of membership inference attacks against generative models. In Proceed- ings of the 2020 ACM SIGSAC conference on computer and communi- cations security, pages 343–362, 2020

work page 2020
[5]

J. Chen, W. H. Wang, and X. Shi. Differential privacy protection against membership inference attack on machine learning for genomic data. In BIOCOMPUTING 2021: Proceedings of the Pacific Symposium, pages 26–37. World Scientific, 2020

work page 2021
[6]

Chen and K

Z. Chen and K. Pattabiraman. Overconfidence is a dangerous thing: Mitigating membership inference attacks by enforcing less confident prediction. arXiv preprint arXiv:2307.01610, 2023

arXiv 2023
[7]

Creswell, T

A. Creswell, T. White, V . Dumoulin, K. Arulkumaran, B. Sengupta, and A. A. Bharath. Generative adversarial networks: An overview. IEEE signal processing magazine, 35(1):53–65, 2018

2018
[8]

Y . Gu, Y . Bai, and S. Xu. Cs-mia: Membership inference attack based on prediction confidence series in federated learning. Journal of Infor- mation Security and Applications, 67:103201, 2022

work page 2022

Show all 25 references

[9]

Hastie, R

T. Hastie, R. Tibshirani, J. H. Friedman, and J. H. Friedman. The el- ements of statistical learning: data mining, inference, and prediction , volume 2. Springer, 2009

2009
[10]

Hinton, O

G. Hinton, O. Vinyals, and J. Dean. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531, 2015

2015 arXiv
[11]

L. Hu, J. Li, G. Lin, S. Peng, Z. Zhang, Y . Zhang, and C. Dong. Defend- ing against membership inference attacks with high utility by gan.IEEE Transactions on Dependable and Secure Computing, 20(3):2144–2157, 2022

2022
[12]

J. Jia, A. Salem, M. Backes, Y . Zhang, and N. Z. Gong. Memguard: Defending against black-box membership inference attacks via adver- sarial examples. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pages 259–274, 2019

2019
[13]

I. T. Jolliffe. Principal Component Analysis. Springer, 2002

2002
[14]

Kaya and T

Y . Kaya and T. Dumitras. When does data augmentation help with membership inference attacks? In International conference on machine learning, pages 5345–5355. PMLR, 2021

2021
[15]

Y . Liu, J. Peng, J. Kang, A. M. Iliyasu, D. Niyato, and A. A. Abd El- Latif. A secure federated learning framework for 5g networks. IEEE Wireless Communications, 27(4):24–31, 2020

2020
[16]

Mazzone, L

F. Mazzone, L. Van Den Heuvel, M. Huber, C. Verdecchia, M. Everts, F. Hahn, and A. Peter. Repeated knowledge distillation with confidence masking to mitigate membership inference attacks. In Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security , pages 1...

2022
[17]

Melis, C

L. Melis, C. Song, E. De Cristofaro, and V . Shmatikov. Exploiting un- intended feature leakage in collaborative learning. In 2019 IEEE sym- posium on security and privacy (SP), pages 691–706. IEEE, 2019

2019
[18]

M. Nasr, R. Shokri, and A. Houmansadr. Comprehensive privacy anal- ysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP), pages 739–753. IEEE, 2019

2019
[19]

M. A. Rahman, T. Rahman, R. Laganière, N. Mohammed, and Y . Wang. Membership inference attack against differentially private deep learning model. Trans. Data Priv., 11(1):61–79, 2018

2018
[20]

Shokri, M

R. Shokri, M. Stronati, C. Song, and V . Shmatikov. Membership infer- ence attacks against machine learning models. In2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017

2017
[21]

Srivastava, G

N. Srivastava, G. Hinton, A. Krizhevsky, I. Sutskever, and R. Salakhut- dinov. Dropout: a simple way to prevent neural networks from over- fitting. The journal of machine learning research , 15(1):1929–1958, 2014

1929
[22]

Truex, L

S. Truex, L. Liu, M. E. Gursoy, L. Yu, and W. Wei. Demystifying mem- bership inference attacks in machine learning as a service. IEEE trans- actions on services computing, 14(6):2073–2089, 2019

2019
[23]

Z. Ying, Y . Zhang, and X. Liu. Privacy-preserving in defending against membership inference attacks. In Proceedings of the 2020 Workshop on Privacy-Preserving Machine Learning in Practice, pages 61–63, 2020

2020
[24]

Zhang, J

J. Zhang, J. Zhang, J. Chen, and S. Yu. Gan enhanced membership inference: A passive local attack in federated learning. In ICC 2020- 2020 IEEE International Conference on Communications (ICC), pages 1–6. IEEE, 2020

2020
[25]

Zheng, Y

J. Zheng, Y . Cao, and H. Wang. Resisting membership inference attacks through knowledge distillation. Neurocomputing, 452:114–126, 2021

2021

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

E. T. M. Beltrán, M. Q. Pérez, P. M. S. Sánchez, S. L. Bernal, G. Bovet, M. G. Pérez, G. M. Pérez, and A. H. Celdrán. Decentralized federated learning: Fundamentals, state of the art, frameworks, trends, and chal- lenges. IEEE Communications Surveys & Tutorials, 25(4):2983–3013, 2023

work page 2023

[2] [2]

Bonawitz, V

K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth. Practical secure aggregation for privacy-preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1175–1191, 2017

work page 2017

[3] [3]

Bouacida and P

N. Bouacida and P. Mohapatra. Vulnerabilities in federated learning. IEEe Access, 9:63229–63249, 2021

work page 2021

[4] [4]

D. Chen, N. Yu, Y . Zhang, and M. Fritz. Gan-leaks: A taxonomy of membership inference attacks against generative models. In Proceed- ings of the 2020 ACM SIGSAC conference on computer and communi- cations security, pages 343–362, 2020

work page 2020

[5] [5]

J. Chen, W. H. Wang, and X. Shi. Differential privacy protection against membership inference attack on machine learning for genomic data. In BIOCOMPUTING 2021: Proceedings of the Pacific Symposium, pages 26–37. World Scientific, 2020

work page 2021

[6] [6]

Chen and K

Z. Chen and K. Pattabiraman. Overconfidence is a dangerous thing: Mitigating membership inference attacks by enforcing less confident prediction. arXiv preprint arXiv:2307.01610, 2023

arXiv 2023

[7] [7]

Creswell, T

A. Creswell, T. White, V . Dumoulin, K. Arulkumaran, B. Sengupta, and A. A. Bharath. Generative adversarial networks: An overview. IEEE signal processing magazine, 35(1):53–65, 2018

2018

[8] [8]

Y . Gu, Y . Bai, and S. Xu. Cs-mia: Membership inference attack based on prediction confidence series in federated learning. Journal of Infor- mation Security and Applications, 67:103201, 2022

work page 2022