Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

CompLeak: Deep Learning Model Compression Exacerbates Privacy Leakage

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Compressing a model for deployment makes membership leakage worse, especially when multiple compressed versions are available.

desk verdict Solid empirical result on compression amplifying membership inference, but the Section 6.2 inference step is described circularly as written and must be fixed before the headline numbers are credible. read the letter →

arxiv 2507.16872 v1 pith:WLNDXX4M submitted 2025-07-22 cs.CR cs.AI

Na Li , Yansong Gao , Hongsheng Hu , Boyu Kuang , Anmin Fu This is my paper
classification cs.CRcs.AI
keywords membershipinferenceattackmodelcompressionpruningquantizationweightclusteringprivacyleakagemachinelearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that three standard model-compression operations—pruning, quantization, and weight clustering—increase privacy leakage rather than merely preserving it. Looking through membership inference attacks (can an adversary tell whether a given sample was in the training set?), it finds that attacking a compressed model alone usually leaks no more than attacking the original. The leakage appears when the original and a compressed model are paired, and grows when several compressed versions of the same model are combined. With all three compression operations and eight compressed models, the best attack reaches roughly 99.9% AUC and 95.7% true-positive rate at 0.1% false-positive rate on Mini-ImageNet, a level no single-model attack approaches. The paper concludes that providers who publish several compressed checkpoints are exposing more than they intend.

What carries the argument

The load-bearing object is the concatenated loss-and-posterior feature across compressed versions, called loss concatenation and posterior concatenation in CompLeakMR. Membership inference is the task of deciding whether a sample was in a model's training set. The mechanism works because as compression degree increases, the cross-entropy loss of members rises while non-member loss fluctuates, and because separate compression configurations produce slightly different membership predictions on the same samples; concatenating these signals amplifies the difference.

What would settle it

Run CompLeakMR with the ordering of compressed models randomized or with compression configurations withheld from the adversary; if AUC and TPR at 0.1% FPR stay near the reported values, the ordering assumption is not load-bearing, and if they collapse, the advertised leakage depends on metadata the paper assumes the provider discloses.

Watch

Extended reading notes

Core claim

The paper's central discovery is that compression operations affect training-set members and non-members differently, and that this differential effect is the usable signal. A single compressed model is usually no more vulnerable to membership inference than the original; sometimes it is less vulnerable because capacity loss suppresses overfitting. But the posterior shift caused by compression is systematically larger for members, and the loss computed on members rises with compression degree while non-member loss fluctuates. CompLeakSR concatenates the original and compressed posteriors and trains a meta-classifier on this paired feature; CompLeakMR concatenates the losses and attack meta-posteriors across all accessible compressed versions, ordered by compression degree, and stacks them for an MLP meta-classifier. On the paper's main benchmark this raises AUC from about 66% for the best single-model attack to 93.2% for one compressed reference and 99.9% when all three operations' versions are combined.

Load-bearing premise

The attack's strongest variant presumes the adversary knows exactly which compression operation and degree produced each accessible model, and can order the models by compression degree before concatenating loss features.

Editorial extensions

If this is right

  • Practitioners who publish multiple compressed checkpoints of the same model for different device tiers should treat the set of checkpoints as a single privacy corpus, not as independent models.
  • Privacy auditing of compressed deployments should include at least one paired original-plus-compressed query, since single-model audits understate leakage.
  • Membership inference on compressed foundation models such as fine-tuned BERT and GPT-2 also improves with a paired reference, so the compression risk extends beyond image classifiers.
  • Defenses like DP-SGD reduce but do not remove the extra leakage identified by paired-reference attacks; the compression-induced signal persists at weaker defense levels.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the ordering requirement is the real bottleneck, one testable mitigation for providers is to randomize or hide compression degree per checkpoint, which would directly attack the loss-concatenation feature.
  • The same differential-membership logic could apply to other model transformations that change capacity in a controlled way, such as distillation or low-rank factorization, suggesting the finding is not limited to the three operations tested.
  • For auditors, the paper's Shapley result on vulnerable members implies that compression does not merely add noise; it selectively exposes high-value training samples, which could change how data-valuation and unlearning audits weight compressed deployments.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper proposes CompLeak, a framework for evaluating membership inference leakage from compressed deep learning models. It contains three attack variants: CompLeakNR, which applies existing single-model MIAs to each compressed model; CompLeakSR, which pairs the original model with one compressed model and trains a meta-classifier on concatenated posteriors; and CompLeakMR, which aggregates signals from multiple compressed versions, either with or without access to the original model. Experiments cover pruning, quantization, and weight clustering across six datasets and seven architectures, including BERT and GPT-2. The paper reports that CompLeakSR substantially improves over single-model attacks, and that CompLeakMR further improves TPR@0.1% FPR, AUC, and balanced accuracy. The central claim is that model compression exacerbates privacy leakage, especially when an adversary can use the original model or multiple compressed versions as references.

Significance. If the reference-based leakage amplification is real, the paper makes a useful contribution by showing that the privacy risk of compression is not captured by single-model MIA and that multi-version access can substantially increase empirical leakage. The experimental scope is broad, with multiple compression operations, datasets, architectures, and foundation models, and it includes relevant controls such as a duplication baseline, DP-SGD defenses, and TPR at low FPR. The paper also explicitly identifies that highly compressed single models can be less vulnerable, which is an honest qualification of the per-model results. The main reservation is that the central CompLeakMR result depends on a threat-model clarification that is currently ambiguous in Section 6.2, and the general claim in the abstract is broader than the evidence supports.

major comments (4)
  1. [Section 6.2, Attack Meta-classifier Membership Inference] The inference step of CompLeakMR is described as follows: “First, the adversary performs CompLeakSR on each victim's compressed models to train the victim CompLeakSR attack meta-classifiers M_v_SR1, M_v_SR2, ... M_v_SRn.” This conflicts with the black-box threat model of Section 3 and with CompLeakSR's own procedure in Section 5.2, where attack classifiers are trained only on shadow models and then applied to victim outputs. If the sentence is literal, the CompLeakMR meta-classifier is trained on the victim's own outputs with known member/non-member labels, making the 99.9% AUC and 95.7% TPR@0.1% FPR in Table 9 an artifact of circular training rather than evidence that compression exacerbates leakage. The authors must state unambiguously that only shadow-trained CompLeakSR classifiers are applied to victim outputs; otherwise the central CompLeakMR result is not validated.
  2. [Abstract, Section 1.2, and Section 7] The abstract claims that the results prove “model compression exacerbates privacy leakage,” and the conclusion repeats this without qualification. This is contradicted by the paper's own Section 4.3 and Table 2, which show that highly compressed single models can be less vulnerable than the original model (e.g., AUC drops from 66.0% on the original VGG16 to 60.7% at 90% pruning). The accurate claim is that compression creates additional leakage when the adversary uses the original model as a reference (CompLeakSR) or aggregates multiple compressed versions (CompLeakMR). The abstract, introduction, and conclusion should be revised to state this qualified claim.
  3. [Sections 3 and 6.2, Loss Concatenation: Implementation] The CompLeakMR attack requires the adversary to know, for each accessible compressed model, the exact compression operation and degree, and to order the models strictly in ascending compression degree before constructing the loss-concatenation feature. This assumption is stated in the threat model, but no robustness experiments test what happens when the ordering is unknown or the compression configuration is not disclosed. Since the loss feature is sensitive to misalignment, the practical scope of the claimed amplification should be explicitly limited, or the authors should provide a sensitivity analysis that varies the accuracy of the adversary's ordering knowledge.
  4. [Sections 5.1 and 6.2, Design Rationale] The feature choices in CompLeakSR and CompLeakMR appear to have been selected after observing the evaluation datasets: the KL-divergence visualization in Figure 2 and the loss-evolution pattern in Figure 10 motivated the posterior-concatenation and loss-concatenation features. Because these patterns were identified on the same datasets used for the headline results, the reported performance may be somewhat optimistic due to feature-selection bias. The paper should either demonstrate the attacks on datasets not used for feature selection or explicitly discuss this limitation when presenting the gains.
minor comments (6)
  1. [Section 1.1] The related work [28] is first referred to as “Li et al.” but later correctly as “Yuan et al.”; the citation name should be consistent.
  2. [Section 5.2] The text says “The first five stages are performed once during offline,” but the enumerated pipeline contains exactly five stages including the online membership-inference stage; the wording should be corrected.
  3. [Section 6.3, Table 10] The text reports a 7.39% improvement in TPR@0.1% FPR for the three-operation setting, while Table 10 states 7.5%; the numbers should be reconciled.
  4. [Appendix D, Table 17] The table headers contain typos: “RseNet50” should be “ResNet50” and “MobilNetV2” should be “MobileNetV2.”
  5. [Section 6.4, Table 21] The CompLeakMR row in Table 21 is visually unclear: it appears to list values under the columns original, R1–R4, and prune, but the caption does not explain how the multi-model attack is constructed for the baseline setting; please clarify the column alignment.
  6. [Section 6.3, Tables 9 and 10] The tables report averages over five repetitions but do not report standard deviations or confidence intervals; adding variability measures would help assess the stability of the headline improvements.

Circularity Check

1 steps flagged · score 6.0 of 10

CompLeakMR's inference step as written trains its base meta-classifiers on the victim's own models, making the headline 99.9% AUC circular; the separately reported CompLeakSR results remain independent.

  1. self definitional [Section 6.2, 'Attack Meta-classifier Membership Inference']
    "First, the adversary performs CompLeakSR on each victim’s compressed models to train the victim CompLeakSR attack meta-classifiers M v SR1 , M v SR2 , . . . ,M v SRn (for Adversary 2, this step is not required)."

    Under the Section 3 threat model the adversary does not know victim membership labels, and CompLeakSR classifiers are defined as trained on shadow models (Section 5.2, 'Attack Meta-classifier Training'). Read literally, this step trains the base meta-classifiers on the victim's own compressed models using known member/non-member status, so the posterior features P v SR fed into MMR are produced by classifiers fitted to the victim's membership signal. The reported 99.9% AUC and 95.7% TPR at 0.1% FPR (Table 9) are then evaluated on data already used during construction of the features, making the shadow-model stage superfluous and the headline 'proving that model compression exacerbates privacy leakage' an artifact of the training protocol rather than a compression effect.

full rationale

The core CompLeakSR pipeline is non-circular: attack meta-classifiers are trained on shadow models and then applied to victim posterior pairs, and the loss-concatenation feature in CompLeakMR is computed from cross-entropy losses using ground-truth labels, which the threat model grants the adversary. The main circularity is the CompLeakMR 'Attack Meta-classifier Membership Inference' passage, which explicitly says the adversary trains victim CompLeakSR meta-classifiers. If taken literally, it violates the black-box threat model and makes the headline multi-compression result circular by construction. Self-citations such as [12], [25], and [57] are not load-bearing for the central claim. The exploratory selection of loss/posterior concatenation features after observing separability on the evaluation datasets is a validity concern, but it is not a construction-level circularity. Overall, the paper has substantial independent content, but the strongest reported result is compromised by the wording of one load-bearing step, so the appropriate score is 6 rather than 0-2 or 8-10.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new theoretical constructs or fitted parameters. It relies on standard MIA assumptions (shadow data, architecture knowledge, faithful shadow models). The compression levels tested (sprivy rates 0.6-0.9, cluster counts 4-16, int8 quantization) are experimental conditions, not fitted free parameters.

assumptions (3)
  • domain assumption The adversary possesses a shadow dataset Ds with the same distribution as the victim's training data but with no overlap.
    Stated in Section 3 (Adversary Knowledge). This is a standard assumption in MIA literature and is load-bearing because the attack meta-classifiers are trained only on shadow model outputs.
  • domain assumption The adversary knows the victim model architecture and the exact compression configuration (operation type and degree such as sparsity level or cluster count).
    Stated in Section 3 and used in Section 6.2 for ordering compressed models by compression degree. This knowledge is not always available in practice and is essential for the loss concatenation feature.
  • domain assumption Shadow models trained with the same pipeline and compression algorithms faithfully mimic the victim model's compression-induced behavior changes.
    Implicit throughout Sections 5 and 6. The attack's success relies on the transferability of the observed member/non-member differences from shadow to victim models.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CompLeak: Deep Learning Model Compression Exacerbates Privacy Leakage." pith.science (2026). https://pith.science/paper/WLNDXX4M

@misc{pith2026250716872,
  author       = {Pith},
  title        = {Pith review of: CompLeak: Deep Learning Model Compression Exacerbates Privacy Leakage},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WLNDXX4M}},
  note         = {Machine review of arXiv:2507.16872}
}
read the original abstract

Model compression is crucial for minimizing memory storage and accelerating inference in deep learning (DL) models, including recent foundation models like large language models (LLMs). Users can access different compressed model versions according to their resources and budget. However, while existing compression operations primarily focus on optimizing the trade-off between resource efficiency and model performance, the privacy risks introduced by compression remain overlooked and insufficiently understood. In this work, through the lens of membership inference attack (MIA), we propose CompLeak, the first privacy risk evaluation framework examining three widely used compression configurations that are pruning, quantization, and weight clustering supported by the commercial model compression framework of Google's TensorFlow-Lite (TF-Lite) and Facebook's PyTorch Mobile. CompLeak has three variants, given available access to the number of compressed models and original model. CompLeakNR starts by adopting existing MIA methods to attack a single compressed model, and identifies that different compressed models influence members and non-members differently. When the original model and one compressed model are available, CompLeakSR leverages the compressed model as a reference to the original model and uncovers more privacy by combining meta information (e.g., confidence vector) from both models. When multiple compressed models are available with/without accessing the original model, CompLeakMR innovatively exploits privacy leakage info from multiple compressed versions to substantially signify the overall privacy leakage. We conduct extensive experiments on seven diverse model architectures (from ResNet to foundation models of BERT and GPT-2), and six image and textual benchmark datasets.

Figures

Figures reproduced from arXiv: 2507.16872 by the authors.

Figure 1
Figure 1. Compression scenarios targeted by the three [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The KL divergence between the two posteri [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The same weight matrix subjected to pruning, [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Attack pipeline overview of CompLeakSR. 5.1. Design Insight We hypothesize that the compression operation affects members and non-members differently, although it is not obvious if we only look at the overall MIA accuracy given a specific compressed model version, as w…
Figure 7
Figure 7. Figure 7: The prediction accuracy of the original and com [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 6
Figure 6. Figure 6: KNN-Shapley values of total member and vulner [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 8
Figure 8. Figure 8: General attack pipeline of CompLeakMR, using two compressed models for example. Adversary 1: Consistent with the threat model described in Section 3, the adversary is assumed to have black-box access to the original model as well as its multiple compressed versions. Mo…
Figure 9
Figure 9. Figure 9: Using t-SNE to visualize the four distributions. [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Bits and Memories: Measuring Verbatim Extraction Across LLM Quantization

    cs.LG 2026-07 conditional novelty 7.0 of 10

    Quantizing LLMs selectively forgets memorized text faster than capability, but 1B-scale 4-bit models still extract ~72% of memorized sequences, so quantization is not a privacy defense.

Reference graph

Works this paper leans on

89 extracted references · 61 canonical work pages · cited by 1 Pith paper

  1. [1]

    Deep learning based caching for self-driving cars in multi-access edge com- puting,

    A. Ndikumana, N. H. Tran, K. T. Kim, C. S. Hong et al. , “Deep learning based caching for self-driving cars in multi-access edge com- puting,” IEEE Transactions on Intelligent Transportation Systems , vol. 22, no. 5, pp. 2862–2877, 2020

    2020

  2. [2]

    Highly accurate protein structure prediction with alphafold,

    J. Jumper, R. Evans, A. Pritzel, T. Green, M. Figurnov, O. Ron- neberger, K. Tunyasuvunakool, R. Bates, A. ˇZ´ıdek, A. Potapenko et al., “Highly accurate protein structure prediction with alphafold,” nature, vol. 596, no. 7873, pp. 583–589, 2021

    2021

  3. [3]

    What chatgpt and generative ai mean for science,

    C. Stokel-Walker and R. Van Noorden, “What chatgpt and generative ai mean for science,” Nature, vol. 614, no. 7947, pp. 214–216, 2023

    2023

  4. [4]

    Diffusion models: A comprehensive survey of methods and applications,

    L. Yang, Z. Zhang, Y . Song, S. Hong, R. Xu, Y . Zhao, W. Zhang, B. Cui, and M.-H. Yang, “Diffusion models: A comprehensive survey of methods and applications,”ACM Computing Surveys, vol. 56, no. 4, pp. 1–39, 2023

    2023

  5. [5]

    Model compression and acceleration for deep neural networks: The principles, progress, and challenges,

    Y . Cheng, D. Wang, P. Zhou, and T. Zhang, “Model compression and acceleration for deep neural networks: The principles, progress, and challenges,” IEEE Signal Processing Magazine , vol. 35, no. 1, pp. 126–136, 2018

    2018

  6. [6]

    Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding,

    S. Han, H. Mao, and W. J. Dally, “Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding,” arXiv preprint arXiv:1510.00149 , 2015

    arXiv 2015

  7. [7]

    A com- prehensive survey on model compression and acceleration,

    T. Choudhary, V . Mishra, A. Goswami, and J. Sarangapani, “A com- prehensive survey on model compression and acceleration,” Artificial Intelligence Review, vol. 53, pp. 5113–5155, 2020

    2020

  8. [8]

    Sparse double descent: Where network pruning aggravates overfitting,

    Z. He, Z. Xie, Q. Zhu, and Z. Qin, “Sparse double descent: Where network pruning aggravates overfitting,” in International Conference on Machine Learning . PMLR, 2022, pp. 8635–8659

    2022

Show all 89 references
  1. [9]

    Spar- sity in deep learning: Pruning and growth for efficient inference and training in neural networks,

    T. Hoefler, D. Alistarh, T. Ben-Nun, N. Dryden, and A. Peste, “Spar- sity in deep learning: Pruning and growth for efficient inference and training in neural networks,” Journal of Machine Learning Research , vol. 22, no. 241, pp. 1–124, 2021

    2021

  2. [10]

    Variational dropout spar- sifies deep neural networks,

    D. Molchanov, A. Ashukha, and D. Vetrov, “Variational dropout spar- sifies deep neural networks,” in International conference on machine learning. PMLR, 2017, pp. 2498–2507

    2017

  3. [11]

    A survey on model com- pression for large language models,

    X. Zhu, J. Li, Y . Liu, C. Ma, and W. Wang, “A survey on model com- pression for large language models,” Transactions of the Association for Computational Linguistics , vol. 12, pp. 1556–1577, 2024

    2024

  4. [12]

    Quantization backdoors to deep learning commercial frameworks,

    H. Ma, H. Qiu, Y . Gao, Z. Zhang, A. Abuadbba, M. Xue, A. Fu, J. Zhang, S. F. Al-Sarawi, and D. Abbott, “Quantization backdoors to deep learning commercial frameworks,” IEEE Transactions on Dependable and Secure Computing , 2023

    2023

  5. [13]

    Albert: A lite bert for self-supervised learning of language represen- tations,

    Z. Lan, M. Chen, S. Goodman, K. Gimpel, P. Sharma, and R. Soricut, “Albert: A lite bert for self-supervised learning of language represen- tations,” arXiv preprint arXiv:1909.11942 , 2019

    1909 arXiv

  6. [14]

    Loraprune: Structured pruning meets low-rank parameter-efficient fine-tuning,

    M. Zhang, H. Chen, C. Shen, Z. Yang, L. Ou, X. Yu, and B. Zhuang, “Loraprune: Structured pruning meets low-rank parameter-efficient fine-tuning,” in Findings of the Association for Computational Lin- guistics, ACL 2024, Bangkok, Thailand and virtual meeting, August 11-16, 2024...

    2024

  7. [15]

    Q8bert: Quan- tized 8bit bert,

    O. Zafrir, G. Boudoukh, P. Izsak, and M. Wasserblat, “Q8bert: Quan- tized 8bit bert,” in 2019 Fifth Workshop on Energy Efficient Machine Learning and Cognitive Computing-NeurIPS Edition (EMC2-NIPS) . IEEE, 2019, pp. 36–39

    2019

  8. [16]

    Atom: Low-bit quanti- zation for efficient and accurate llm serving,

    Y . Zhao, C.-Y . Lin, K. Zhu, Z. Ye, L. Chen, S. Zheng, L. Ceze, A. Krishnamurthy, T. Chen, and B. Kasikci, “Atom: Low-bit quanti- zation for efficient and accurate llm serving,” Proceedings of Machine Learning and Systems , vol. 6, pp. 196–209, 2024

    2024

  9. [17]

    Exploiting llm quantization,

    K. Egashira, M. Vero, R. Staab, J. He, and M. Vechev, “Exploiting llm quantization,” in NeurIPS 2024, 2024

    2024

  10. [18]

    Auditing membership leakages of multi-exit networks,

    Z. Li, Y . Liu, X. He, N. Yu, M. Backes, and Y . Zhang, “Auditing membership leakages of multi-exit networks,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 1917–1931

    2022

  11. [19]

    Member- ship inference attacks and generalization: A causal perspective,

    T. Baluta, S. Shen, S. Hitarth, S. Tople, and P. Saxena, “Member- ship inference attacks and generalization: A causal perspective,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 249–262

    2022

  12. [20]

    Enhanced membership inference attacks against machine learning models,

    J. Ye, A. Maddi, S. K. Murakonda, V . Bindschaedler, and R. Shokri, “Enhanced membership inference attacks against machine learning models,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 3093–3106

    2022

  13. [21]

    Membership inference attacks and defenses in classification models,

    J. Li, N. Li, and B. Ribeiro, “Membership inference attacks and defenses in classification models,” in Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy , 2021, pp. 5–16

    2021

  14. [22]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18

    2017

  15. [23]

    Membership inference attacks from first principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership inference attacks from first principles,” in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1897– 1914

    2022

  16. [24]

    Seqmia: Sequential-metric based membership inference attack,

    H. Li, Z. Li, S. Wu, C. Hu, Y . Ye, M. Zhang, D. Feng, and Y . Zhang, “Seqmia: Sequential-metric based membership inference attack,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 3496–3510

    2024

  17. [25]

    Is difficulty calibration all we need? towards more practical membership inference attacks,

    Y . He, B. Li, Y . Wang, M. Yang, J. Wang, H. Hu, and X. Zhao, “Is difficulty calibration all we need? towards more practical membership inference attacks,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 1226–1240

    2024

  18. [26]

    Gan-leaks: A taxonomy of membership inference attacks against generative models,

    D. Chen, N. Yu, Y . Zhang, and M. Fritz, “Gan-leaks: A taxonomy of membership inference attacks against generative models,” in Pro- ceedings of the 2020 ACM SIGSAC conference on computer and communications security, 2020, pp. 343–362

    2020

  19. [27]

    https://gdpr-info.eu/

  20. [28]

    Membership inference attacks and defenses in neural network pruning,

    X. Yuan and L. Zhang, “Membership inference attacks and defenses in neural network pruning,” in 31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 4561–4578

    2022

  21. [29]

    Machine learning with membership privacy using adversarial regularization,

    M. Nasr, R. Shokri, and A. Houmansadr, “Machine learning with membership privacy using adversarial regularization,” in Proceedings of the 2018 ACM SIGSAC conference on computer and communica- tions security, 2018, pp. 634–646

    2018

  22. [30]

    Systematic evaluation of privacy risks of machine learning models,

    L. Song and P. Mittal, “Systematic evaluation of privacy risks of machine learning models,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 2615–2632

    2021

  23. [31]

    Privacy risk in machine learning: Analyzing the connection to overfitting,

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in 2018 IEEE 31st computer security foundations symposium (CSF) . IEEE, 2018, pp. 268–282

    2018

  24. [32]

    Against membership inference attack: Pruning is all you need,

    Y . Wang, C. Wang, Z. Wang, S. Zhou, H. Liu, J. Bi, C. Ding, and S. Rajasekaran, “Against membership inference attack: Pruning is all you need,” in Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI 2021, Virtual Event / Montreal, Can...

    2021

  25. [33]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi`ere, N. Goyal, E. Hambro, F. Azhar et al., “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971, 2023

    2023 arXiv

  26. [34]

    https://openai.com/research/

  27. [35]

    Quantization and training of neural networks for efficient integer-arithmetic-only inference,

    B. Jacob, S. Kligys, B. Chen, M. Zhu, M. Tang, A. Howard, H. Adam, and D. Kalenichenko, “Quantization and training of neural networks for efficient integer-arithmetic-only inference,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. ...

    2018

  28. [36]

    Structured pruning of deep con- volutional neural networks,

    S. Anwar, K. Hwang, and W. Sung, “Structured pruning of deep con- volutional neural networks,” ACM Journal on Emerging Technologies in Computing Systems (JETC) , vol. 13, no. 3, pp. 1–18, 2017

    2017

  29. [37]

    A survey of quantization methods for efficient neural network inference,

    A. Gholami, S. Kim, Z. Dong, Z. Yao, M. W. Mahoney, and K. Keutzer, “A survey of quantization methods for efficient neural network inference,” in Low-Power Computer Vision. Chapman and Hall/CRC, 2022, pp. 291–326

    2022

  30. [38]

    Quantization networks,

    J. Yang, X. Shen, J. Xing, X. Tian, H. Li, B. Deng, J. Huang, and X.-s. Hua, “Quantization networks,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2019, pp. 7308–7316

    2019

  31. [39]

    Pruning filters for efficient convnets,

    H. Li, A. Kadav, I. Durdanovic, H. Samet, and H. P. Graf, “Pruning filters for efficient convnets,” ArXiv, vol. abs/1608.08710,

    arXiv

  32. [40]

    Shortgpt: Layers in large language models are more redundant than you expect,

    X. Men, M. Xu, Q. Zhang, B. Wang, H. Lin, Y . Lu, X. Han, and W. Chen, “Shortgpt: Layers in large language models are more redundant than you expect,” arXiv preprint arXiv:2403.03853 , 2024

    2024 arXiv

  33. [41]

    Accurate post training quantization with small calibration sets,

    I. Hubara, Y . Nahshan, Y . Hanani, R. Banner, and D. Soudry, “Accurate post training quantization with small calibration sets,” in International Conference on Machine Learning . PMLR, 2021, pp. 4466–4475

    2021

  34. [42]

    Analyzing inference privacy risks through gradients in machine learning,

    Z. Li, A. Lowy, J. Liu, T. Koike-Akino, K. Parsons, B. Malin, and Y . Wang, “Analyzing inference privacy risks through gradients in machine learning,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 3466–3480

    2024

  35. [43]

    Mitigating membership inference attacks by {Self-Distillation} through a novel ensemble architecture,

    X. Tang, S. Mahloujifar, L. Song, V . Shejwalkar, M. Nasr, A. Houmansadr, and P. Mittal, “Mitigating membership inference attacks by {Self-Distillation} through a novel ensemble architecture,” in 31st USENIX security symposium (USENIX security 22) , 2022, pp. 1433–1450

    2022

  36. [44]

    Defending against membership inference attacks on iteratively pruned deep neural networks,

    J. Shang, J. Wang, K. Wang, J. Liu, N. Jiang, M. Armanuzzaman, and Z. Zhao, “Defending against membership inference attacks on iteratively pruned deep neural networks,” in 32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, Feb...

    2025

  37. [45]

    Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,

    A. Salem, Y . Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” arXiv preprint arXiv:1806.01246, 2018

    2018 arXiv

  38. [46]

    Please tell me more: Privacy impact of explainability through the lens of membership inference attack,

    H. Liu, Y . Wu, Z. Yu, and N. Zhang, “Please tell me more: Privacy impact of explainability through the lens of membership inference attack,” in 2024 IEEE Symposium on Security and Privacy (SP) . IEEE, 2024, pp. 4791–4809

    2024

  39. [47]

    Does training with synthetic data truly protect privacy?

    Y . Zhao and J. Zhang, “Does training with synthetic data truly protect privacy?” in The Thirteenth International Conference on Learning Representations , 2025. [Online]. Available: https: //openreview.net/forum?id=C8niXBHjfO

    2025

  40. [48]

    When machine unlearning jeopardizes privacy,

    M. Chen, Z. Zhang, T. Wang, M. Backes, M. Humbert, and Y . Zhang, “When machine unlearning jeopardizes privacy,” in Proceedings of the 2021 ACM SIGSAC conference on computer and communications security, 2021, pp. 896–911

    2021

  41. [49]

    A unified membership inference method for visual self-supervised encoder via part-aware capability,

    J. Zhu, J. Zha, D. Li, and L. Wang, “A unified membership inference method for visual self-supervised encoder via part-aware capability,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 1241–1255

    2024

  42. [50]

    SLMIA-SR: speaker-level member- ship inference attacks against speaker recognition systems,

    G. Chen, Y . Zhang, and F. Song, “SLMIA-SR: speaker-level member- ship inference attacks against speaker recognition systems,” in 31st Annual Network and Distributed System Security Symposium, NDSS 2024, San Diego, California, USA, February 26 - March 1, 2024 . The Internet So...

    2024

  43. [51]

    Querychee- tah: Fast automated discovery of attribute inference attacks against query-based systems,

    B. Stevanoski, A.-M. Cretu, and Y .-A. de Montjoye, “Querychee- tah: Fast automated discovery of attribute inference attacks against query-based systems,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 3451–3465

    2024

  44. [52]

    Diffence: Fencing mem- bership privacy with diffusion models,

    Y . Peng, A. Naseh, and A. Houmansadr, “Diffence: Fencing mem- bership privacy with diffusion models,” in 32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24-28, 2025 . The Internet Society, 2025

    2025

  45. [53]

    Black-box membership inference attacks against fine-tuned diffusion models,

    Y . Pang and T. Wang, “Black-box membership inference attacks against fine-tuned diffusion models,” in 32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24-28, 2025 . The Internet Society, 2025

    2025

  46. [54]

    Did the neurons read your book? document-level membership inference for large language models,

    M. Meeus, S. Jain, M. Rei, and Y .-A. de Montjoye, “Did the neurons read your book? document-level membership inference for large language models,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 2369–2385

    2024

  47. [55]

    Membership inference attacks against in-context learning,

    R. Wen, Z. Li, M. Backes, and Y . Zhang, “Membership inference attacks against in-context learning,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Secu- rity, 2024, pp. 3481–3495

    2024

  48. [56]

    Cache telepathy: Leverag- ing shared resource attacks to learn {DNN} architectures,

    M. Yan, C. W. Fletcher, and J. Torrellas, “Cache telepathy: Leverag- ing shared resource attacks to learn {DNN} architectures,” in 29th USENIX Security Symposium (USENIX Security 20), 2020, pp. 2003– 2020

    2020

  49. [57]

    Deeptheft: Stealing dnn model architectures through power side channel,

    Y . Gao, H. Qiu, Z. Zhang, B. Wang, H. Ma, A. Abuadbba, M. Xue, A. Fu, and S. Nepal, “Deeptheft: Stealing dnn model architectures through power side channel,” in 2024 IEEE Symposium on Security and Privacy (SP) . IEEE, 2024, pp. 3311–3326

    2024

  50. [58]

    https://www.cs.toronto.edu/ ∼kriz/cifar.html

  51. [59]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

    2016

  52. [60]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014

    2014 arXiv

  53. [61]

    Mobilenetv2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “Mobilenetv2: Inverted residuals and linear bottlenecks,” in Pro- ceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 4510–4520

    2018

  54. [62]

    Membership inference attacks by exploiting loss trajectory,

    Y . Liu, Z. Zhao, M. Backes, and Y . Zhang, “Membership inference attacks by exploiting loss trajectory,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2085–2098

    2022

  55. [63]

    Genomic privacy and limits of individual detection in a pool,

    S. Sankararaman, G. Obozinski, M. I. Jordan, and E. Halperin, “Genomic privacy and limits of individual detection in a pool,”Nature genetics, vol. 41, no. 9, pp. 965–967, 2009

    2009

  56. [64]

    A simple weight decay can improve general- ization,

    A. Krogh and J. Hertz, “A simple weight decay can improve general- ization,” Advances in neural information processing systems , vol. 4, 1991

    1991

  57. [65]

    Early stopping-but when?

    L. Prechelt, “Early stopping-but when?” in Neural Networks: Tricks of the trade . Springer, 2002, pp. 55–69

    2002

  58. [66]

    https://github.com/microsoft/nni

  59. [67]

    What is the state of neural network pruning?

    D. Blalock, J. J. Gonzalez Ortiz, J. Frankle, and J. Guttag, “What is the state of neural network pruning?” Proceedings of machine learning and systems , vol. 2, pp. 129–146, 2020

    2020

  60. [68]

    On information and sufficiency,

    S. Kullback and R. A. Leibler, “On information and sufficiency,” The annals of mathematical statistics , vol. 22, no. 1, pp. 79–86, 1951

    1951

  61. [69]

    Property inference attacks on fully connected neural networks using permu- tation invariant representations,

    K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov, “Property inference attacks on fully connected neural networks using permu- tation invariant representations,” in Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, 2018, pp. 619–633

    2018

  62. [70]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , 2016, pp. 308–318

    2016

  63. [71]

    Understanding data importance in machine learning attacks: Does valuable data pose greater harm?

    R. Wen, M. Backes, and Y . Zhang, “Understanding data importance in machine learning attacks: Does valuable data pose greater harm?” arXiv preprint arXiv:2409.03741 , 2024

    2024 arXiv

  64. [72]

    Efficient task-specific data valuation for nearest neighbor algorithms,

    R. Jia, D. Dao, B. Wang, F. A. Hubis, N. M. Gurel, B. Li, C. Zhang, C. J. Spanos, and D. Song, “Efficient task-specific data valuation for nearest neighbor algorithms,” arXiv preprint arXiv:1908.08619, 2019

    1908 arXiv

  65. [73]

    A comprehensive survey on pretrained foundation models: A history from bert to chatgpt,

    C. Zhou, Q. Li, C. Li, J. Yu, Y . Liu, G. Wang, K. Zhang, C. Ji, Q. Yan, L. He et al. , “A comprehensive survey on pretrained foundation models: A history from bert to chatgpt,” International Journal of Machine Learning and Cybernetics , pp. 1–65, 2024

    2024

  66. [74]

    Recursive deep models for semantic compositionality over a sentiment treebank,

    R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Y . Ng, and C. Potts, “Recursive deep models for semantic compositionality over a sentiment treebank,” in Proceedings of the 2013 conference on empirical methods in natural language processing , 2013, pp. 1631– 1642

    2013

  67. [75]

    Calibrating noise to sensitivity in private data analysis,

    C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” in Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3. Springer, 2006, pp. 265–284

    2006

  68. [76]

    Visualizing data using t-sne

    L. Van der Maaten and G. Hinton, “Visualizing data using t-sne.” Journal of machine learning research , vol. 9, no. 11, 2008

    2008

  69. [77]

    Matching networks for one shot learning,

    O. Vinyals, C. Blundell, T. Lillicrap, D. Wierstra et al. , “Matching networks for one shot learning,” Advances in neural information processing systems, vol. 29, 2016

    2016

  70. [78]

    Tiny imagenet visual recognition challenge,

    Y . Le and X. Yang, “Tiny imagenet visual recognition challenge,” CS 231N, vol. 7, no. 7, p. 3, 2015. Appendix

    2015

  71. [80]

    CIFAR-10

    Datasets Description Below is a brief description of each dataset. CIFAR-10. CIFAR-10 [58] is a widely used benchmark dataset in image classification, consisting of 60,000 32 ×32 color images across 10 distinct classes: airplane, automobile, bird, cat, deer, dog, frog, horse, ...

  72. [81]

    One method is based on direct concate- nation, i.e., P s o ∥ Ps c ∥ y, and the other is based on calculat- ing the L2 distance, i.e., ∥P s o − Ps c ∥2 ∥ y

    Other Meta-data Construction Methods and Performance We present two additional meta-data construction meth- ods, similar to [48]. One method is based on direct concate- nation, i.e., P s o ∥ Ps c ∥ y, and the other is based on calculat- ing the L2 distance, i.e., ∥P s o − Ps c...

  73. [82]

    TABLE 13: Architecture of the FCN

    The Architecture of FCN The FCN’s structure as described in the Table 13. TABLE 13: Architecture of the FCN. Layer Units Activation Regularization Layer 1 (Input, 256) ReLU Dropout (0.1) Layer 2 (256, 128) ReLU Dropout (0.1) Layer 3 (128, Output) - -

  74. [83]

    Evaluation of Pruning

    Evaluation of CompLeakNR and CompLeakSR for other datasets 4.1. Evaluation of Pruning. The attack results for pruning at different sparsities are presented for Location in Table 14, Tiny-ImageNet in Table 15, and CIFAR-10 in Table 16

  75. [84]

    https://sites.google.com/site/yangdingqi/home/foursquare-dataset

  76. [85]

    https://www.dshs.texas.gov/THCIC/Hospitals/Download.shtm TABLE 14: Attack performance of different attacks on varying pruned rate (FCN+Location). Attack TPR @ 0.1% FPR (%) Balanced Accuracy (%) AUC (%) Method original 60% 70% original 60% 70% original 60% 70% CompLeakNR[22] (L...

  77. [86]

    Here, we focus on ex- amining the influence of datasets on attacks by using the same model architecture with different datasets

    The Impact of the Victim’s Dataset Dataset of the Victim Model. Here, we focus on ex- amining the influence of datasets on attacks by using the same model architecture with different datasets. Specifi- cally, we trained the VGG16 model on Mini-ImageNet and CIFAR-10. As shown i...

  78. [87]

    Attack performance on baseline The attack results for the baseline methods are presented in Table 21

  79. [88]

    To validate the contribution of each meta-data component, we evaluate at- tack performance using each component individually

    Performance of Individual Component As CompLeakMR utilizes the loss concatenation and posterior concatenation to form meta-data. To validate the contribution of each meta-data component, we evaluate at- tack performance using each component individually. As shown in Table 22, ...

  80. [89]

    Other Results TABLE 15: Attack performance of different attacks on varying pruned rate (MobilNetV2+Tiny-ImageNet). Attack TPR @ 0.1% FPR (%) Balanced Accuracy (%) AUC (%) Method original 40% 50% 60% 70% original 40% 50% 60% 70% original 40% 50% 60% 70% CompLeakNR[22] (LR) 0.2 ...

  81. [2016]

    Available: https://api.semanticscholar.org/CorpusID: 14089312

    [Online]. Available: https://api.semanticscholar.org/CorpusID: 14089312

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.