Pith. sign in

REVIEW 4 major objections 5 minor 65 references

Amplifying Machine Learning Attacks Through Strategic Compositions

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Composing inference-time attacks—using property inference to rebalance attribute inference training data, or adversarial perturbation distances as extra features for membership and property inference—sharply amplifies attack accuracy, and…

desk verdict Useful taxonomy and empirical exploration of attack composition, but the headline PropInf2AttrInf result may be mostly dataset rebalancing rather than true amplification. read the letter →

arxiv 2506.18870 v1 pith:5LYWPOS7 submitted 2025-06-23 cs.CR

Yugeng Liu , Zheng Li , Hai Huang , Michael Backes , Yang Zhang This is my paper · ORCID
classification cs.CR
keywords attackcompositioninference-timeattacksmembershipinferencepropertyattributeadversarialexamplesdifferentialprivacymachinelearningsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the common practice of studying machine learning attacks in isolation underestimates real-world risk: an adversary with several inference-time attacks at their disposal can use one attack to amplify another. It proposes a taxonomy of attack compositions based on the stage of the attack pipeline where the support attack plugs in—preparation, execution, or evaluation—and identifies four concrete pairings tested across three model architectures and three image datasets. Headline results include property inference raising attribute inference from 0.500 to 0.894 accuracy, and adversarial examples raising black-box membership inference from 0.664 to 0.851. If the claim holds, privacy and security evaluations that measure attacks one at a time understate how much a deployed model leaks.

What carries the argument

The load-bearing machinery is a three-stage taxonomy of the attack pipeline—preparation, execution, evaluation—plus two concrete enhancement signals. The first is dataset rebalancing driven by property-inference posteriors: sampling the attribute-inference training dataset according to the inferred property proportion removes the bias that makes standalone attribute inference collapse to chance. The second is the L2 norm of the perturbation needed to mislead the model, computed by Square (black-box) or PGD (white-box) attacks; this distance is fed as an extra feature into membership and property inference attack models, exploiting the distributional separation it creates between members and non-members and between different property proportions. At the evaluation stage, a learned encoder selects the calibration strength lambda when using the inferred property proportion to rescore membership inference, including LiRA.

What would settle it

Run PropInf2AttrInf with a property-inference posterior that is deliberately wrong, for example an auxiliary dataset whose property proportion is mismatched with the target training data, and observe whether attribute inference accuracy drops back toward the 0.500 standalone baseline; similarly, run ADV2MemInf on models where the adversarial perturbation distances for members and non-members fully overlap, in which case the accuracy gain should vanish.

Watch

Extended reading notes

Core claim

The central discovery is that the output of one inference-time attack can serve as a practical enhancement signal for another attack at a specific point in the attack pipeline. Property inference determines the proportion of a sensitive attribute in the victim model's training data, and using that proportion to rebalance the auxiliary dataset lifts attribute inference from chance-level accuracy (0.500) to 0.894 on ResNet18 trained on CIFAR10. Adversarial examples provide a perturbation distance that separates members from non-members, and also separates models trained on different property proportions; adding the L2 distance between original and adversarial images as a feature lifts black-box membership inference from 0.664 to 0.851 and property inference from 0.890 to 0.960. Property inference can also calibrate membership inference scores at the evaluation stage, improving accuracy from 0.631 to 0.669 in a black-box partial-data setting. The same mechanisms remain effective even when targets are trained with differential privacy: DP weakens standalone membership inference, but the composed attacks partially recover the signal.

Load-bearing premise

The composed attacks assume the adversary has access to auxiliary datasets drawn from the same distribution as the target model's training data, including shadow datasets and query datasets with controlled property proportions; if the adversary lacks such aligned data, the reported gains should shrink.

Editorial extensions

If this is right

  • Privacy risk assessments that test single attacks will systematically underestimate the leakage of deployed models, since the paper's compositions consistently outperform standalone attacks.
  • Defenses need to target composed pipelines rather than single attacks: differential privacy, which strongly defends standalone membership inference, can be partially bypassed when adversarial examples or property inference are added.
  • Property inference is not just a standalone privacy leak; it can serve as a preparation tool that makes attribute inference viable when the auxiliary dataset has biased property proportions.
  • The adversarial perturbation distance reduces the number of shadow models needed for practical property inference, with the reported 0.890-to-0.960 accuracy gain equivalent to saving roughly 300 shadow models.
  • The COAT toolkit offers a modular benchmark that lets future work plug in new attacks, datasets, and models to evaluate composed attack pipelines systematically.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the three-level taxonomy and the two enhancement mechanisms (posterior rebalancing and perturbation-distance features) are domain-agnostic; nothing about them is specific to image classification, so similar compositions may transfer to text, graphs, or transformer-based models.
  • A broader principle suggested by the results, though not stated by the authors, is that any support attack that produces a confident statistic about the target model or its training distribution could be used as a preparation or calibration signal, not just property inference.
  • The ADV2MemInf gains imply a measurable correlation between adversarial perturbation magnitude and training membership; if that correlation holds, then adversarial training aimed simply at robustness may also shrink the signal these compositions exploit—a testable question the paper does not address.
  • A natural extension, beyond what the paper tests, is to build longer chains of three or more coordinated attacks and measure when the accumulated confidence stops improving the final attack's accuracy.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper studies strategic combinations of four inference-time attacks against machine learning models: adversarial examples, attribute inference, membership inference, and property inference. It introduces a taxonomy of attack compositions based on the preparation, execution, and evaluation stages of the attack pipeline, and proposes four concrete compositions: property inference assisting attribute inference during preparation (PropInf2AttrInf), adversarial examples assisting membership inference and property inference during execution (ADV2MemInf and ADV2PropInf), and property inference assisting membership inference during evaluation (PropInf2MemInf). Experiments are reported across three model architectures (DenseNet121, ResNet18, VGG19) and three datasets (CelebA, CIFAR10, Places), with additional evaluations under differential privacy and for chains of compositions. The authors also present COAT, a modular toolkit for evaluating attack compositions.

Significance. If the empirical claims hold, the paper makes a useful contribution by systematically demonstrating that attacks can be combined across pipeline stages to improve effectiveness, and by providing a taxonomy that may organize future work in this area. The toolkit COAT is a constructive artifact, although the code is only promised for the final version. The paper is a measurements paper with no formal derivation; its value rests on the soundness of the experimental comparisons. However, the headline PropInf2AttrInf result is currently measured against a baseline the authors themselves describe as severely biased, which leaves the central claim of 'amplification' for that composition unestablished. The other three compositions appear more robust to this particular concern, but all results lack variance information, making significance assessment difficult for the smaller gains.

major comments (4)
  1. [§4.2.1, §7.2.1, Table 3] The PropInf2AttrInf improvement (e.g., accuracy 0.500 to 0.894 for ResNet18/CIFAR10) is evaluated against an 'Origin' baseline that the paper itself characterizes as severely biased: Section 7.2.1 states that 'simply collecting datasets will easily cause severe bias in property proportions, making original AttrInf challenging to achieve.' The proposed method uses PropInf only to estimate the target property proportion and then re-samples the auxiliary dataset. Consequently, the reported gain may reflect the correction of a deliberately poor baseline rather than information contributed by the PropInf attack. To support the composition claim, the authors should add a control that uses the true property proportion (or class-balanced sampling) to rebalance the auxiliary dataset without invoking PropInf, and show whether the 0.894 accuracy persists; if it does, the gain is a rebalancing artifact, and if it does not, the composition claim would be substantiated.
  2. [§7 (Tables 3, 4, 9, 10; Figures 3–17)] All empirical results are reported as single point estimates with no error bars, no number of random seeds, and no statistical significance tests. This is particularly problematic for the smaller claimed gains, such as PropInf2MemInf (accuracy 0.631 vs. 0.669 in §7.4.1) and TPR @0.1% FPR values that often sit in the range 0.000–0.015 (Table 10). Without variance information, the reader cannot determine whether these improvements are reproducible or within noise. The paper should report results from multiple seeds (at least 3–5) as mean ± std, or otherwise justify why single-run numbers suffice for the central claims.
  3. [§4.2.1, Eq. (5)] The empirical sampling procedure for PropInf2AttrInf is under-specified. The text says 'For the proportion of the property p, given the confidence c, the ratio of sampling is c × (1−p)' but does not define what 'ratio of sampling' means, how the auxiliary dataset is re-sampled, or how the theoretical setting uses 'the predicted label from PropInf into the sampling function.' This lack of algorithmic detail prevents reproduction of the reported results. The authors should provide a precise, step-by-step description (or pseudocode) of the dataset construction for both empirical and theoretical settings.
  4. [§7.4.1, §7.5, Abstract] The paper describes PropInf2MemInf both as an 'effective' composition in the abstract and as producing only slight improvements in many cases ('In many cases, the assistance of PropInf slightly improves MemInf's accuracy', §7.4.1). The global conclusions in §7.5 and the abstract state that the four compositions 'notably amplify' the primary attacks without acknowledging the heterogeneity across the nine model/dataset configurations. The authors should either present a quantitative summary of how many configurations show statistically significant gains, or qualify the global claim so that it is consistent with the measurement results.
minor comments (5)
  1. [§11] The conclusion says 'three model architectures and two benchmark datasets', but the experiments use three datasets (CelebA, CIFAR10, Places); this inconsistency should be corrected.
  2. [§7.2.1] The sentence 'the original AttrInf achieves a random guess for three scenarios' is not consistent with Table 3, where only three of the nine Origin rows show accuracy 0.500; the statement should be rephrased to refer to specific rows.
  3. [§9, reference [68]] The text refers to 'Chen et al. [68]', but the first author of reference [68] is Zhou; please correct the citation.
  4. [§4.2.1] The term 'theoretical setting' is misleading because it does not refer to a theoretical bound but to a variant that uses the predicted label from PropInf rather than the confidence; consider renaming it 'label-based setting' or similar.
  5. [§5] The COAT toolkit is described as 'already available upon request' but has no public repository or URL; for a paper whose contribution includes a reusable toolkit, a public, versioned release would improve reproducibility and follow standard practice in this area.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; all four compositions are empirical measurements whose reported gains are not fixed by construction from their inputs.

full rationale

This is an empirical measurements paper: the claimed amplifications are observed accuracies of attack pipelines, not quantities derived from the support attack by definition. None of the four compositions defines its success metric in terms of its support-attack output. PropInf2AttrInf uses PropInf only to choose a sampling ratio for the AttrInf auxiliary set; the reported 0.894 accuracy is measured on held-out target attributes rather than read off from the PropInf posterior. ADV2MemInf and ADV2PropInf add an L2-distance feature to a meta-classifier that is trained and evaluated on separate data; the gains (e.g., black-box MemInf accuracy from 0.664 to 0.851) are empirical outcomes, not algebraic consequences. PropInf2MemInf calibrates membership scores with a property prior, but the final membership labels are still evaluated independently against ground truth. The paper's self-citations implement standard attacks and are not used to forbid alternatives or to import a uniqueness theorem that forces the composition choice. The passage in Section 7.2.1 stating that 'simply collecting datasets will easily cause severe bias in property proportions, making original AttrInf challenging to achieve' is a baseline-validity limitation rather than circularity: it suggests the Origin comparison may be weak, but no equation or fitted parameter makes the predicted accuracy equal to an input. Consequently, no self-definitional, fitted-input-called-prediction, or self-citation-load-bearing circularity is present, so the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

The paper is empirical and does not introduce mathematically fitted constants. The key design choices, such as the sampling ratio c times (1 minus p) in PropInf2AttrInf, are methodological choices rather than free parameters with fitted values. No new theoretical entities are introduced.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Amplifying Machine Learning Attacks Through Strategic Compositions." pith.science (2026). https://pith.science/paper/5LYWPOS7

@misc{pith2026250618870,
  author       = {Pith},
  title        = {Pith review of: Amplifying Machine Learning Attacks Through Strategic Compositions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5LYWPOS7}},
  note         = {Machine review of arXiv:2506.18870}
}
read the original abstract

Machine learning (ML) models are proving to be vulnerable to a variety of attacks that allow the adversary to learn sensitive information, cause mispredictions, and more. While these attacks have been extensively studied, current research predominantly focuses on analyzing each attack type individually. In practice, however, adversaries may employ multiple attack strategies simultaneously rather than relying on a single approach. This prompts a crucial yet underexplored question: When the adversary has multiple attacks at their disposal, are they able to mount or amplify the effect of one attack with another? In this paper, we take the first step in studying the strategic interactions among different attacks, which we define as attack compositions. Specifically, we focus on four well-studied attacks during the model's inference phase: adversarial examples, attribute inference, membership inference, and property inference. To facilitate the study of their interactions, we propose a taxonomy based on three stages of the attack pipeline: preparation, execution, and evaluation. Using this taxonomy, we identify four effective attack compositions, such as property inference assisting attribute inference at its preparation level and adversarial examples assisting property inference at its execution level. We conduct extensive experiments on the attack compositions using three ML model architectures and three benchmark image datasets. Empirical results demonstrate the effectiveness of these four attack compositions. We implement and release a modular reusable toolkit, COAT. Arguably, our work serves as a call for researchers and practitioners to consider advanced adversarial settings involving multiple attack strategies, aiming to strengthen the security and robustness of AI systems.

Figures

Figures reproduced from arXiv: 2506.18870 by the authors.

Figure 1
Figure 1. Given a target model, the adversary can launch dif [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of the workflow of COAT. developed several software tools to measure the potential se￾curity/privacy risks of ML models, such as DEEPSEC [39] and CleverHans [51] for evaluating adversarial example at￾tacks, TROJANZOO [50] for backdoor attacks, and ML￾Doctor [42] for jointly analyzing the relationships among different attacks. Inspired by this work, we design a system￾atic framework to modularize our experim… view at source ↗
Figure 3
Figure 3. Accuracy of ADV2MemInf under different threat models, datasets, and target model architectures. our focus will be on preprocessing the dataset. As mentioned before, we demonstrate this attack level through PropInf2 AttrInf. 7.2.1 PropInf2AttrInf We present the performance of PropInf2AttrInf by compar￾ing it with the original AttrInf first [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (14 more)
Figure 4
Figure 4. Figure 4: Accuracy of PropInf2MemInf under different threat models, datasets, and target model architectures [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Accuracy of ADV2MemInf under different threat models, datasets, and target model architectures with adding DP [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Accuracy of PropInf2MemInf under different threat models, datasets, and target model architectures with adding DP [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Accuracy of ADV2PropInf2MemInf under different threat models, datasets, and target model architectures. exploits. Takeaways. The chain of composition is an interesting phe￾nomenon that shows significant improvement compared to the original method. We will explore the d…
Figure 8
Figure 8. Figure 8: F1 score of ADV2MemInf under different threat models, datasets, and target model architectures. 17 [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]
Figure 9
Figure 9. Figure 9: AUC of ADV2MemInf under different threat models, datasets, and target model architectures. DenseNet121 ResNet18 VGG19 Model 0.4 0.6 0.8 1.0 F1 Score CelebA Origin DenseNet121 ResNet18 VGG19 Model 0.4 0.6 0.8 1.0 CelebA Composition DenseNet121 ResNet18 VGG19 Model 0.4 0…
Figure 10
Figure 10. Figure 10: F1 score of PropInf2MemInf under different threat models, datasets, and target model architectures. DenseNet121 ResNet18 VGG19 Model 0.4 0.6 0.8 1.0 AUC CelebA Origin DenseNet121 ResNet18 VGG19 Model 0.4 0.6 0.8 1.0 CelebA Composition DenseNet121 ResNet18 VGG19 Model …
Figure 11
Figure 11. Figure 11: AUC of PropInf2MemInf under different threat models, datasets, and target model architectures. 18 [PITH_FULL_IMAGE:figures/full_fig_p018_11.png]
Figure 12
Figure 12. Figure 12: F1 score of ADV2MemInf under different threat models, datasets, and target model architectures with adding DP. CelebA CIFAR10 Places Dataset 0.0 0.2 0.4 0.6 0.8 1.0 AUC Origin ( = 10) CelebA CIFAR10 Places Dataset 0.0 0.2 0.4 0.6 0.8 1.0 Composition ( = 10) CelebA C…
Figure 13
Figure 13. Figure 13: AUC of ADV2MemInf under different threat models, datasets, and target model architectures with adding DP. CelebA CIFAR10 Places Dataset 0.0 0.2 0.4 0.6 0.8 1.0 F1 Score Origin ( = 10) CelebA CIFAR10 Places Dataset 0.0 0.2 0.4 0.6 0.8 1.0 Composition ( = 10) CelebA C…
Figure 14
Figure 14. Figure 14: F1 score of PropInf2MemInf under different threat models, datasets, and target model architectures with adding DP. 19 [PITH_FULL_IMAGE:figures/full_fig_p019_14.png]
Figure 15
Figure 15. Figure 15: AUC of PropInf2MemInf under different threat models, datasets, and target model architectures with adding DP. DenseNet121 ResNet18 VGG19 Model 0.4 0.6 0.8 1.0 F1 Score CelebA Origin DenseNet121 ResNet18 VGG19 Model 0.4 0.6 0.8 1.0 CelebA Composition DenseNet121 ResNet…
Figure 16
Figure 16. Figure 16: F1 Score of ADV2PropInf2MemInf under different threat models, datasets, and target model architectures. DenseNet121 ResNet18 VGG19 Model 0.4 0.6 0.8 1.0 AUC CelebA Origin DenseNet121 ResNet18 VGG19 Model 0.4 0.6 0.8 1.0 CelebA Composition DenseNet121 ResNet18 VGG19 Mo…
Figure 17
Figure 17. Figure 17: AUC of ADV2PropInf2MemInf under different threat models, datasets, and target model architectures. 20 [PITH_FULL_IMAGE:figures/full_fig_p020_17.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

65 extracted references · 54 canonical work pages

  1. [4]

    Srivastava, and Kai-Wei Chang

    Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani B. Srivastava, and Kai-Wei Chang. Generating Natural Language Adversarial Examples. InConference on Empirical Methods in Natural Lan- guage Processing (EMNLP), pages 2890–2896. ACL,

    work page

  2. [5]

    Square Attack: A Query-Efficient Black-Box Adversarial Attack via Ran- dom Search

    Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square Attack: A Query-Efficient Black-Box Adversarial Attack via Ran- dom Search. InEuropean Conference on Computer Vi- sion (ECCV), pages 484–501. Springer, 2020. 3, 5, 12

    work page 2020

  3. [6]

    PLATO: Pre-trained Dialogue Generation Model with Discrete Latent Variable

    Siqi Bao, Huang He, Fan Wang, Hua Wu, and Haifeng Wang. PLATO: Pre-trained Dialogue Generation Model with Discrete Latent Variable. InAnnual Meet- ing of the Association for Computational Linguistics (ACL), pages 85–96. ACL, 2020. 1

    work page 2020

  4. [7]

    Synthetic and Natural Noise Both Break Neural Machine Translation

    Yonatan Belinkov and Yonatan Bisk. Synthetic and Natural Noise Both Break Neural Machine Translation. InInternational Conference on Learning Representa- tions (ICLR), 2018. 2

    work page 2018

  5. [8]

    Freund, B

    Philippe Burlina, David E. Freund, B. Dupas, and Neil M. Bressler. Automatic Screening of Age-related Macular Degeneration and Retinal Abnormalities. In Annual International Conference of the IEEE Engi- neering in Medicine and Biology Society (EMBC), pages 3962–3966. IEEE, 2011. 1

    work page 2011

  6. [9]

    Membership Inference Attacks From First Principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. Membership Inference Attacks From First Principles. InIEEE Sym- posium on Security and Privacy (S&P), pages 1897–

  7. [10]

    Towards Evaluat- ing the Robustness of Neural Networks

    Nicholas Carlini and David Wagner. Towards Evaluat- ing the Robustness of Neural Networks. InIEEE Sym- posium on Security and Privacy (S&P), pages 39–57. IEEE, 2017. 2, 3

    work page 2017

  8. [11]

    Exclusionary Populism and Islamophobia: A comparative analysis of Italy and Spain.Religions,

    Laura Cervi. Exclusionary Populism and Islamophobia: A comparative analysis of Italy and Spain.Religions,

    work page

Show all 65 references
  1. [12]

    GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models

    Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models. InACM SIGSAC Conference on Computer and Communications Secu- rity (CCS), pages 343–362. ACM, 2020. 3, 9, 12

    2020

  2. [13]

    Jordan, and Martin J

    Jianbo Chen, Michael I. Jordan, and Martin J. Wain- wright. HopSkipJumpAttack: A Query-Efficient Decision-Based Attack. InIEEE Symposium on Secu- rity and Privacy (S&P), pages 1277–1294. IEEE, 2020. 3

    2020

  3. [14]

    When Ma- chine Unlearning Jeopardizes Privacy

    Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. When Ma- chine Unlearning Jeopardizes Privacy. InACM SIGSAC Conference on Computer and Communications Secu- rity (CCS), pages 896–911. ACM, 2021. 3, 9, 12

    2021

  4. [15]

    Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning.CoRR abs/1712.05526, 2017

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning.CoRR abs/1712.05526, 2017. 1

    2017 arXiv

  5. [16]

    Amplifying Membership Exposure via Data Poisoning

    Yufei Chen, Chao Shen, Yun Shen, Cong Wang, and Yang Zhang. Amplifying Membership Exposure via Data Poisoning. InAnnual Conference on Neural Infor- mation Processing Systems (NeurIPS). NeurIPS, 2022. 13

    2022

  6. [17]

    BERT: Pre-training of Deep Bidi- rectional Transformers for Language Understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of Deep Bidi- rectional Transformers for Language Understanding. In Conference of the North American Chapter of the As- sociation for Computational Linguistics: Human Lan- guage Technologies (...

    2019

  7. [18]

    Now Publishers Inc., 2014

    Cynthia Dwork and Aaron Roth.The Algorithmic F oundations of Differential Privacy. Now Publishers Inc., 2014. 9

    2014

  8. [19]

    Practical Membership Infer- ence Attacks against Fine-tuned Large Language Mod- els via Self-prompt Calibration.CoRR abs/2311.06062,

    Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Practical Membership Infer- ence Attacks against Fine-tuned Large Language Mod- els via Self-prompt Calibration.CoRR abs/2311.06062,

    arXiv

  9. [20]

    Gunter, and Nikita Borisov

    Karan Ganju, Qi Wang, Wei Yang, Carl A. Gunter, and Nikita Borisov. Property Inference Attacks on Fully Connected Neural Networks using Permutation Invari- ant Representations. InACM SIGSAC Conference on Computer and Communications Security (CCS), pages 619–633. ACM, 2018. 4, 13

    2018

  10. [21]

    Explaining and Harnessing Adversarial Ex- amples

    Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and Harnessing Adversarial Ex- amples. InInternational Conference on Learning Rep- resentations (ICLR), 2015. 2, 3, 4, 12

    2015

  11. [22]

    Badnets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain.CoRR abs/1708.06733,

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Grag. Badnets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain.CoRR abs/1708.06733,

    arXiv

  12. [23]

    Deep Residual Learning for Image Recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep Residual Learning for Image Recognition. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778. IEEE, 2016. 2, 7

    2016

  13. [24]

    Membership-Doctor: Comprehensive As- sessment of Membership Inference Against Machine Learning Models.CoRR abs/2208.10445, 2022

    Xinlei He, Zheng Li, Weilin Xu, Cory Cornelius, and Yang Zhang. Membership-Doctor: Comprehensive As- sessment of Membership Inference Against Machine Learning Models.CoRR abs/2208.10445, 2022. 7

    2022 arXiv

  14. [25]

    Quantifying and Mitigat- ing Privacy Risks of Contrastive Learning

    Xinlei He and Yang Zhang. Quantifying and Mitigat- ing Privacy Risks of Contrastive Learning. InACM 14 SIGSAC Conference on Computer and Communica- tions Security (CCS), pages 845–863. ACM, 2021. 9

    2021

  15. [26]

    Weinberger

    Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q. Weinberger. Densely Connected Convolu- tional Networks. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2261–

  16. [27]

    Adversarial Example Generation with Syntactically Controlled Paraphrase Networks

    Mohit Iyyer, John Wieting, Kevin Gimpel, and Luke Zettlemoyer. Adversarial Example Generation with Syntactically Controlled Paraphrase Networks. InCon- ference of the North American Chapter of the Associa- tion for Computational Linguistics: Human Language Technologies (NAACL-...

  17. [28]

    Evaluating Differentially Private Machine Learning in Practice

    Bargav Jayaraman and David Evans. Evaluating Differentially Private Machine Learning in Practice. InUSENIX Security Symposium (USENIX Security), pages 1895–1912. USENIX, 2019. 9

    1912

  18. [29]

    MemGuard: De- fending against Black-Box Membership Inference At- tacks via Adversarial Examples

    Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong. MemGuard: De- fending against Black-Box Membership Inference At- tacks via Adversarial Examples. InACM SIGSAC Conference on Computer and Communications Secu- rity (CCS), pages 259–274. ACM, 2019. 3

    2019

  19. [30]

    Seitz, Daniel Miller, and Evan Brossard

    Ira Kemelmacher-Shlizerman, Steven M. Seitz, Daniel Miller, and Evan Brossard. The MegaFace Benchmark: 1 Million Faces for Recognition at Scale. InIEEE Con- ference on Computer Vision and Pattern Recognition (CVPR), pages 4873–4882. IEEE, 2016. 1

    2016

  20. [31]

    Kingma and Jimmy Ba

    Diederik P. Kingma and Jimmy Ba. Adam: A Method for Stochastic Optimization. InInternational Confer- ence on Learning Representations (ICLR), 2015. 7

    2015

  21. [32]

    Exarchos, Konstanti- nos P

    Konstantina Kourou, Themis P. Exarchos, Konstanti- nos P. Exarchos, Michalis V . Karamouzis, and Dim- itrios I. Fotiadis. Machine Learning Applications in Cancer Prognosis and Prediction.Computational and Structural Biotechnology Journal, 2015. 1

    2015

  22. [33]

    Stolen Memo- ries: Leveraging Model Memorization for Calibrated White-Box Membership Inference

    Klas Leino and Matt Fredrikson. Stolen Memo- ries: Leveraging Model Memorization for Calibrated White-Box Membership Inference. InUSENIX Secu- rity Symposium (USENIX Security), pages 1605–1622. USENIX, 2020. 3, 9

    2020

  23. [34]

    QEBA: Query-Efficient Boundary-Based Blackbox Attack

    Huichen Li, Xiaojun Xu, Xiaolu Zhang, Shuang Yang, and Bo Li. QEBA: Query-Efficient Boundary-Based Blackbox Attack. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1218–

  24. [35]

    Morgan & Claypool Publishers, 2016

    Ninghui Li, Min Lyu, Dong Su, and Weining Yang.Dif- ferential Privacy: From Theory to Practice. Morgan & Claypool Publishers, 2016. 9

    2016

  25. [36]

    Auditing Membership Leak- ages of Multi-Exit Networks.CoRR abs/2208.11180,

    Zheng Li, Yiyong Liu, Xinlei He, Ning Yu, Michael Backes, and Yang Zhang. Auditing Membership Leak- ages of Multi-Exit Networks.CoRR abs/2208.11180,

    arXiv

  26. [37]

    Auditing Membership Leak- ages of Multi-Exit Networks

    Zheng Li, Yiyong Liu, Xinlei He, Ning Yu, Michael Backes, and Yang Zhang. Auditing Membership Leak- ages of Multi-Exit Networks. InACM SIGSAC Con- ference on Computer and Communications Security (CCS), pages 1917–1931. ACM, 2022. 12

    1917

  27. [38]

    Membership Leakage in Label-Only Exposures

    Zheng Li and Yang Zhang. Membership Leakage in Label-Only Exposures. InACM SIGSAC Conference on Computer and Communications Security (CCS), pages 880–895. ACM, 2021. 1, 2, 3, 5, 12, 13

    2021

  28. [39]

    DEEPSEC: A Uniform Platform for Security Analysis of Deep Learn- ing Model

    Xiang Ling, Shouling Ji, Jiaxu Zou, Jiannan Wang, Chunming Wu, Bo Li, and Ting Wang. DEEPSEC: A Uniform Platform for Security Analysis of Deep Learn- ing Model. InIEEE Symposium on Security and Pri- vacy (S&P), pages 673–690. IEEE, 2019. 6

    2019

  29. [40]

    Trojaning Attack on Neural Networks

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning Attack on Neural Networks. InNetwork and Distributed System Security Symposium (NDSS). Inter- net Society, 2018. 1

    2018

  30. [41]

    Membership Inference Attacks by Exploiting Loss Trajectory.CoRR abs/2208.14933, 2022

    Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. Membership Inference Attacks by Exploiting Loss Trajectory.CoRR abs/2208.14933, 2022. 7

    2022 arXiv

  31. [42]

    ML-Doctor: Holis- tic Risk Assessment of Inference Attacks Against Ma- chine Learning Models

    Yugeng Liu, Rui Wen, Xinlei He, Ahmed Salem, Zhikun Zhang, Michael Backes, Emiliano De Cristo- faro, Mario Fritz, and Yang Zhang. ML-Doctor: Holis- tic Risk Assessment of Inference Attacks Against Ma- chine Learning Models. InUSENIX Security Sympo- sium (USENIX Security), page...

  32. [43]

    Deep Learning Face Attributes in the Wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep Learning Face Attributes in the Wild. InIEEE International Conference on Computer Vision (ICCV), pages 3730–3738. IEEE, 2015. 7

    2015

  33. [44]

    To- wards Deep Learning Models Resistant to Adversarial Attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards Deep Learning Models Resistant to Adversarial Attacks. InInternational Conference on Learning Rep- resentations (ICLR), 2018. 2, 3, 5, 12

    2018

  34. [45]

    Property Inference from Poisoning

    Saeed Mahloujifar, Esha Ghosh, and Melissa Chase. Property Inference from Poisoning. InIEEE Sympo- sium on Security and Privacy (S&P), pages 1120–1137. IEEE, 2022. 4

    2022

  35. [46]

    Exploiting Unintended Feature Leakage in Collaborative Learning

    Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting Unintended Feature Leakage in Collaborative Learning. InIEEE Sympo- sium on Security and Privacy (S&P), pages 497–512. IEEE, 2019. 2, 3, 4, 13

    2019

  36. [47]

    Ma- chine Learning with Membership Privacy using Adver- sarial Regularization

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Ma- chine Learning with Membership Privacy using Adver- sarial Regularization. InACM SIGSAC Conference on Computer and Communications Security (CCS), pages 634–646. ACM, 2018. 1, 2, 3, 7, 9

    2018

  37. [48]

    Com- prehensive Privacy Analysis of Deep Learning: Pas- sive and Active White-box Inference Attacks against 15 Centralized and Federated Learning

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Com- prehensive Privacy Analysis of Deep Learning: Pas- sive and Active White-box Inference Attacks against 15 Centralized and Federated Learning. InIEEE Sympo- sium on Security and Privacy (S&P), pages 1021–1035. IEEE, 2019. 3, 12

    2019

  38. [49]

    Adversary Instanti- ation: Lower Bounds for Differentially Private Machine Learning

    Milad Nasr, Shuang Song, Abhradeep Thakurta, Nico- las Papernot, and Nicholas Carlini. Adversary Instanti- ation: Lower Bounds for Differentially Private Machine Learning. InIEEE Symposium on Security and Privacy (S&P). IEEE, 2021. 9

    2021

  39. [50]

    TROJAN- ZOO: Everything You Ever Wanted to Know about Neural Backdoors (But Were Afraid to Ask).CoRR abs/2012.09302, 2020

    Ren Pang, Zheng Zhang, Xiangshan Gao, Zhaohan Xi, Shouling Ji, Peng Cheng, and Ting Wang. TROJAN- ZOO: Everything You Ever Wanted to Know about Neural Backdoors (But Were Afraid to Ask).CoRR abs/2012.09302, 2020. 6

    2012 arXiv

  40. [51]

    Technical Report on the CleverHans v2.1.0 Adversarial Examples Library.CoRR abs/1610.00768, 2018

    Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Kurakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, Alexander Matyasko, Vahid Behzadan, Karen Hambardzumyan, Zhishuai Zhang, Yi-Lin Juang, Zhi Li, Ryan Sheat- sley, Abhibhav Garg, Jo...

    arXiv

  41. [52]

    McDaniel, Somesh Jha, Matt Fredrikson, Z

    Nicolas Papernot, Patrick D. McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. The Limitations of Deep Learning in Adversar- ial Settings. InIEEE European Symposium on Security and Privacy (Euro S&P), pages 372–387. IEEE, 2016. 2, 3

    2016

  42. [53]

    Semantically Equivalent Adversarial Rules for Debugging NLP models

    Marco Túlio Ribeiro, Sameer Singh, and Carlos Guestrin. Semantically Equivalent Adversarial Rules for Debugging NLP models. InAnnual Meeting of the Association for Computational Linguistics (ACL), pages 856–865. ACL, 2018. 1, 2

    2018

  43. [54]

    White-box vs Black-box: Bayes Optimal Strategies for Membership Inference

    Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. White-box vs Black-box: Bayes Optimal Strategies for Membership Inference. InInternational Conference on Machine Learning (ICML), pages 5558–5567. PMLR, 2019. 3

    2019

  44. [55]

    ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models

    Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. In Network and Distributed System Security Symposium (NDSS). Internet Society, ...

    2019

  45. [56]

    Membership Inference Attacks Against Machine Learning Models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vi- taly Shmatikov. Membership Inference Attacks Against Machine Learning Models. InIEEE Symposium on Se- curity and Privacy (S&P), pages 3–18. IEEE, 2017. 1, 2, 3, 4, 7, 8, 12

    2017

  46. [57]

    Very Deep Convolutional Networks for Large-Scale Image Recog- nition

    Karen Simonyan and Andrew Zisserman. Very Deep Convolutional Networks for Large-Scale Image Recog- nition. InInternational Conference on Learning Rep- resentations (ICLR), 2015. 7

    2015

  47. [58]

    Overlearning Reveals Sensitive Attributes

    Congzheng Song and Vitaly Shmatikov. Overlearning Reveals Sensitive Attributes. InInternational Confer- ence on Learning Representations (ICLR), 2020. 2, 3, 13

    2020

  48. [59]

    Stanfill, Margaret Williams, Susan H

    Mary H. Stanfill, Margaret Williams, Susan H. Fenton, Robert A. Jenders, and William R. Hersh. A System- atic Literature Review of Automated Clinical Coding and Classification Systems.J. Am. Medical Informatics Assoc., 2010. 1

    2010

  49. [60]

    Intriguing Properties of Neural Networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing Properties of Neural Networks. In International Conference on Learning Representations (ICLR), 2014. 2, 12

    2014

  50. [61]

    Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models.CoRR abs/2404.01231,

    Yuxin Wen, Leo Marchyok, Sanghyun Hong, Jonas Geiping, Tom Goldstein, and Nicholas Carlini. Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models.CoRR abs/2404.01231,

    arXiv

  51. [62]

    Gunter, and Bo Li

    Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A. Gunter, and Bo Li. Detecting AI Trojans Using Meta Neural Analysis. InIEEE Symposium on Security and Privacy (S&P). IEEE, 2021. 4

    2021

  52. [63]

    Se- curityNet: Assessing Machine Learning Vulnerabilities on Public Models

    Boyang Zhang, Zheng Li, Ziqing Yang, Xinlei He, Michael Backes, Mario Fritz, and Yang Zhang. Se- curityNet: Assessing Machine Learning Vulnerabilities on Public Models. InUSENIX Security Symposium (USENIX Security). USENIX, 2024. 1, 7

    2024

  53. [64]

    Membership Inference Attacks Against Recommender Systems

    Minxing Zhang, Zhaochun Ren, Zihan Wang, Pengjie Ren, Zhumin Chen, Pengfei Hu, and Yang Zhang. Membership Inference Attacks Against Recommender Systems. InACM SIGSAC Conference on Computer and Communications Security (CCS), pages 864–879. ACM, 2021. 12

    2021

  54. [65]

    ViT-YOLO: Transformer- Based YOLO for Object Detection

    Zixiao Zhang, Xiaoqiang Lu, Guojin Cao, Yuting Yang, Licheng Jiao, and Fang Liu. ViT-YOLO: Transformer- Based YOLO for Object Detection. InIEEE Interna- tional Conference on Computer Vision Workshops (IC- CVW), pages 2799–2808. IEEE, 2021. 1

    2021

  55. [66]

    Cross- Age LFW: A Database for Studying Cross-Age Face Recognition in Unconstrained Environments.CoRR abs/1708.08197, 2017

    Tianyue Zheng, Weihong Deng, and Jiani Hu. Cross- Age LFW: A Database for Studying Cross-Age Face Recognition in Unconstrained Environments.CoRR abs/1708.08197, 2017. 1

    2017 arXiv

  56. [67]

    Places: A 10 Million Image Database for Scene Recognition.IEEE Trans- actions on Pattern Analysis and Machine Intelligence,

    Bolei Zhou, Àgata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 Million Image Database for Scene Recognition.IEEE Trans- actions on Pattern Analysis and Machine Intelligence,

  57. [68]

    Property Inference Attacks Against GANs

    Junhao Zhou, Yufei Chen, Chao Shen, and Yang Zhang. Property Inference Attacks Against GANs. InNetwork and Distributed System Security Symposium (NDSS). Internet Society, 2022. 4, 6, 13 16 Table 9: TPR @0.1% FPR ofADV2MemInf. CelebA CIFAR10 Places Model Mode Origin Composition...

    2022

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.