Pith. sign in

REVIEW 4 major objections 5 minor 46 references

LoMime: Query-Efficient Membership Inference using Model Extraction in Label-Only Settings

T0 review · 4 major / 5 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Extracting a surrogate first makes label-only membership inference cheap and offline.

desk verdict A genuinely useful amortization idea for label-only MIA, but the headline ±1% parity claim only holds on two of three datasets; Texas is 3–4 points off, so the paper overstates itself. read the letter →

arxiv 2602.18934 v2 pith:QWBF3WZA submitted 2026-02-21 cs.LG cs.CR

Abdullah Caglar Oksuz , Anisa Halimi , Erman Ayday This is my paper
classification cs.LGcs.CR
keywords membershipinferenceattackmodelextractionlabel-onlyqueryefficiencyblack-boxsurrogatedecisionboundaryprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that the dominant cost of label-only membership inference—thousands of queries per victim sample—can be shifted into a single model-extraction phase. An attacker queries a black-box target with hard-label outputs only, trains a surrogate that reproduces the target's decision boundaries, and then runs the membership test entirely offline on the surrogate. The load-bearing result is that this surrogate preserves enough of the target's membership leakage for the attack to match direct attacks within about 1% accuracy/AUC, using a budget roughly equal to querying 1% of the training set. If true, this makes large-scale membership auditing practical under strict black-box constraints, and it shows that defenses against label-only attacks must also target extractability.

What carries the argument

The mechanism is a two-stage pipeline. In the extraction stage, the surrogate S is trained by iteratively selecting queries that maximize the mutual information between S's and the target M's prediction distributions: the query pool is built by perturbing a small seed set with feature-flip noise, then filtered by prediction entropy, entropy-gradient clustering, and loss-based proximity to the worst-performing current samples. In the inference stage, the attack measures, for each candidate sample, the minimal L2 perturbation that flips S's label (dboundary), and classifies the sample as a member if this distance is below a threshold τ calibrated as the maximum boundary distance over random in

What would settle it

Run the extraction on the Purchase dataset with the auxiliary set removed and initialization done with random synthetic vectors in the feature domain; if a surrogate trained with the same 10,000-query budget no longer yields membership-inference accuracy within 1% of the target, the '1% budget' claim is an artifact of seed data.

Watch

Extended reading notes

Core claim

The paper's central claim is that membership leakage transfers to a functionally similar surrogate. It shows that an extracted model, trained only on hard labels obtained through active sampling and feature perturbation, reproduces the target's decision-boundary geometry closely enough that the standard label-only membership heuristic—measuring the minimal perturbation needed to change the predicted label—separates members from non-members nearly as well on the surrogate as on the target. On the Purchase benchmark, for instance, a surrogate trained with 100,000 queries reaches a membership-inference AUC of 0.865 against the target's 0.873. The authors attribute this to transferability: the o

Load-bearing premise

The method's query-efficiency claim depends on a small auxiliary dataset (about 10% of training-set size in the experiments) drawn from the target's input domain; if such seed data is unavailable, extraction must fall back to synthetic initialization, which costs more queries or risks unrealistic samples, so the method is not fully data-free.

Editorial extensions

If this is right

  • Once the surrogate is extracted, membership can be tested for any number of samples at zero additional cost to the target API; the attack becomes cheaper per sample as the audited population grows.
  • The query budget needed to match prior label-only attacks is about 1% of the training set (e.g., 10,000 rather than 1,000,000 queries for 100 victims), because extraction cost is amortized over all subsequent membership decisions.
  • Defenses that mainly reduce per-query signal (dropout, confidence masking) have limited effect on this attack; strong differential privacy (DP-SGD at small epsilon) is the most effective countermeasure, at a clear utility cost.
  • Surrogate fidelity is the main driver of membership-inference performance, but the fidelity threshold needed is dataset-dependent; on some datasets partial decision-boundary recovery already reproduces most of the leakage.
  • The attack shows that label-only interfaces remain vulnerable even when the adversary never sees confidence scores or shadow models, so defenses must consider extractability, not just output masking.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The concentration of all query cost into a single extraction burst makes the attack detectable by API monitoring that looks for large volumes of low-entropy queries over a short window; a rate-limited or query-pattern-aware API could blunt the cost advantage even without eliminating the privacy leakage.
  • The reliance on a small auxiliary set suggests a continuum from data-assisted to fully synthetic extraction; future work could replace the seed data with synthetic initialization at the price of more queries or lower fidelity on structured domains.
  • The same steal-then-attack pattern likely extends beyond membership inference to other label-only privacy probes, such as property inference or model auditing, because any attack that needs many calls to M can be re-run offline on S.
  • If membership leakage truly is a function of decision-boundary geometry, then defenses that flatten or smooth decision boundaries (e.g., stronger regularization or adversarial training) are more promising than those that obscure confidence scores.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes LoMime, a label-only membership inference attack framework that first extracts a surrogate model S from a black-box target model M using active sampling, perturbation-based selection, and synthetic data generation, and then performs membership inference on S offline using decision-boundary distance thresholding. The authors claim that a query budget equivalent to testing membership of about 1% of the training set suffices to achieve MIA accuracy within ±1% of attacking M directly. Experiments are reported on Location, Purchase, and Texas Hospital tabular datasets, with additional evaluation of DP-SGD, dropout, and L2 regularization defenses. The core idea—shifting the query cost to a one-time extraction phase and exploiting transferability of membership leakage—is interesting and potentially useful, but the headline accuracy claim is not supported by the paper's own Texas results, and the 'data-free' framing conflicts with the explicit reliance on an auxiliary dataset.

Significance. If the central claim held, LoMime would be a meaningful advance: it would make label-only membership inference dramatically more query-efficient in settings where many membership probes are needed, and it would demonstrate that extracted surrogates preserve membership leakage. The paper's strengths are its use of standard benchmarks, its evaluation of multiple defenses, and its careful separation of extraction and inference phases. However, the headline claim of ±1% parity is contradicted by Table 2 on Texas, and the method requires an auxiliary dataset that conflicts with the 'data-free' presentation. These issues need to be corrected before the contribution can be assessed as stated.

major comments (4)
  1. [Abstract and §4.3, Table 2] The abstract claims that a query budget equivalent to testing membership of approximately 1% of training samples yields MIA accuracy within ±1% of attacking M directly. On Texas, |DM|=10,000, so 1% corresponds to 100 target samples; at the cited ≈10,000 queries per victim sample in [26], this is exactly the S1M budget. Table 2 reports Texas S1M attack accuracy 0.766 vs. 0.810 for M—a 4.4-point gap—and AUC 0.811 vs. 0.842—a 3.1-point gap. Both exceed the abstract's ±1% bound. The contribution bullet's 'within 1–5%' is consistent with these numbers, so the abstract is internally inconsistent with the reported results. This is load-bearing: the central cost-effectiveness claim is false on one of three benchmarks. Please either revise the abstract/contribution to state the observed range (up to ~4.4 pp in accuracy) or provide evidence that the Texas result is an outlier.
  2. [§3.1 and §4.3] The introduction and contribution bullet describe the extraction strategy as 'fully self-contained' and 'data-free,' but the method requires an auxiliary dataset DA: §3.1 states that 'the extraction begins by training an initial surrogate model S0 using DA labeled by M,' and §4.3 concedes 'we rely on a small auxiliary dataset, typically constrained to 10% of the size of the target model's training set.' This is a real dependency on data from the target domain, not a self-contained data-free procedure. The paper should either remove 'data-free' and 'fully self-contained' from the framing or provide a truly data-free initialization and evaluate it.
  3. [§4.2 and Table 1] The query-efficiency claim depends on the assumption that the extraction hyperparameters are set without privileged knowledge. However, ρ is dataset-specific and hand-tuned: Table 1 lists ρ=0.10 for Location, 0.08 for Purchase, and 0.005 for Texas. Section 4.2 says 'parameters used across all datasets during model extraction are set to ρ=σ(|xi>0|), xi∈DA ... k=nj, α=4, γ1=γ2=0.5,' but also says 'ρ is selected based on the distribution of active features within each dataset.' These statements are inconsistent, and if ρ is tuned on the target dataset, the experiment does not establish a parameter-free or strictly black-box procedure. Please clarify the selection rule and report sensitivity to ρ.
  4. [§4.3, cost comparison] The cost-effectiveness comparison to Choquette-Choo et al. [26] uses reported attack accuracies (0.8920, 0.8740, 0.8030) and an assumed ≈10,000 query-per-victim cost, rather than re-running their attack on the same target models, same data splits, and same membership sets. The 'budget equivalent' claim therefore rests on an extrapolation from prior reported numbers that may not match the current experimental setup. Please provide a matched-baseline comparison or explicitly bound the query-cost uncertainty; otherwise the amortization argument is not tightly demonstrated.
minor comments (5)
  1. [Table 2] The table formatting is hard to read because values run together (e.g., '0.6000.6080.597'). Please use proper column separation and decimal alignment. Also, Table 1 reports M's testing accuracy for Location as 0.5984 while Table 2 lists 0.608; clarify which preprocessing/split is used.
  2. [Appendix B] The appendix states that 'reported results are representative runs' and that repeated trials showed negligible variance, but no variance estimates or full repetition results are reported. Given the paper's claims rely on differences between S and M as small as 1 pp, please provide standard deviations, confidence intervals, or at least a multi-seed table.
  3. [§3.2, Eq. (11)] The threshold τ is set as the maximum decision-boundary distance over random feature-space samples Xrandom. The text says 'x_i ∈ R^d \ DS', but DS is a finite discrete set; the complement has measure zero in continuous space, so this notation is informal. More importantly, the behavior of τ with invalid or out-of-distribution random samples should be discussed, especially since τ is a single scalar used for all classes.
  4. [Eqs. (8) and (10)] Equations (8) and (10) describe essentially the same optimization problem, with slightly different formulations. Please unify them to avoid confusion about whether the objective is minimizing ||x_i+δ_i||_2 or ||δ_i||_2, and ensure the definition of decision-boundary distance is consistent with ART's implementation.
  5. [§2, threat model] The threat model says the adversary knows the model type and feature domains, but the extraction algorithm also requires the chosen augmentation factor α, selection fractions γ1 and γ2, and the perturbation probability ρ. Please state which of these are assumed known a priori and which are tuned during the attack; this affects the practical validity of the 'strict black-box' claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the MIA on the surrogate is an empirical transferability result, not a fitted identity; the sole self-citation (AUTOLYCUS) is a non-load-bearing component reference.

full rationale

The derivation chain is: extract surrogate S from M's labels via MARICH/AUTOLYCUS-style query generation; calibrate threshold τ on synthetic samples using S (Eqs. 10–11); compute decision-boundary distances on Dmem (Eq. 8); classify with τ (Eq. 9). Nowhere are the true membership labels of Dmem used during calibration or training, so the reported attack accuracy/AUC is not forced by construction. The comparison of S to M is an empirical measurement (Table 2, Figure 1), and the cost-equivalence claim is an arithmetic comparison to the external per-sample cost of Choquette-Choo et al. [26] (~10,000 queries per victim sample), not a fitted parameter renamed as a prediction. The only self-citation is AUTOLYCUS [37], used for the synthetic perturbation component; the paper's central claims are supported by its own experiments and by external transferability citations [38–41], so the self-citation is not load-bearing. The paper's internal inconsistencies—abstract's '±1%' versus the 4.4-point Texas gap, and 'fully self-contained' versus Section 4.3's reliance on auxiliary data DA—are correctness/overstatement concerns, not circularity. No equation reduces to its own input by construction.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The attack rests on domain assumptions about adversary knowledge (model type, feature domains, auxiliary unlabeled samples) and on the empirical transferability of membership leakage from target to surrogate. The only material hand-tuned free parameter is the perturbation probability ρ, which is set per dataset and directly controls query diversity; α and γ are fixed by the MARICH recipe.

free parameters (3)
  • ρ (perturbation probability) = Location: 0.10, Purchase: 0.08, Texas: 0.005
    Hand-tuned per dataset and called 'a critical hyperparameter that should be tuned to dataset characteristics' in Section 4.2; directly controls query diversity and extraction fidelity.
  • α (augmentation factor) = 4
    Fixed augmentation factor in the MARICH recipe; controls the size of the query dataset but is not tuned to data.
  • γ1 and γ2 (selection fractions) = 0.5 each
    Fixed sampling fractions in MARICH's entropy-gradient and loss sampling stages; set by default, not tuned.
assumptions (5)
  • domain assumption Adversary knows the target model type, number of features, number of classes, and feature value domains.
    Section 2 threat model; required to build a compatible surrogate and generate valid queries.
  • domain assumption An auxiliary unlabeled dataset DA from the target input domain, about 10% of training size, is available to seed extraction.
    Sections 4.2 and 4.3; experiments use DA; presented as a 'practical compromise' but the method is not fully data-free.
  • domain assumption Membership leakage transfers from target M to a high-fidelity surrogate S.
    Section 4.3; the central premise of the attack; empirically supported by fidelity-vs-AUC trends but not proven.
  • domain assumption ℓ2 decision-boundary distance is a valid label-only membership signal.
    Section 3.2; adopted from Choquette-Choo et al. [26]; underlies the MIA stage.
  • ad hoc to paper Random feature-space samples are a proxy for non-members when calibrating τ.
    Section 3.2, Eq. 11; no validation that random samples match the non-member distribution.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LoMime: Query-Efficient Membership Inference using Model Extraction in Label-Only Settings." pith.science (2026). https://pith.science/paper/QWBF3WZA

@misc{pith2026260218934,
  author       = {Pith},
  title        = {Pith review of: LoMime: Query-Efficient Membership Inference using Model Extraction in Label-Only Settings},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QWBF3WZA}},
  note         = {Machine review of arXiv:2602.18934}
}
abstract

Membership inference attacks (MIAs) threaten the privacy of machine learning models by revealing whether a specific data point was used during training. Existing MIAs often rely on impractical assumptions, such as access to public datasets, shadow models, confidence scores, or knowledge of the training data distribution, making them vulnerable to defenses like confidence masking and adversarial regularization. Label-only MIAs, even under strict constraints, suffer from high query requirements per sample. We propose a cost-effective label-only MIA framework based on transferability and model extraction. By querying the target model $M$ using active sampling, perturbation-based selection, and synthetic data, we extract a functionally similar surrogate model $S$ on which membership inference is performed. This shifts the query overhead to a one-time extraction phase, eliminating repeated queries to $M$. Our method matches the performance of state-of-the-art label-only MIAs while significantly reducing query costs and operating under strict black-box constraints. On benchmark tabular datasets, we show that a query budget equivalent to testing the membership of approximately $1%$ of the training samples is sufficient to extract $S$ and achieve membership inference accuracy within $\pm 1%$ of that obtained when attacking $M$ directly. We also evaluate the effectiveness of standard defenses, including DP-SGD and regularization, proposed for label-only MIAs against our attack. Finally, we present preliminary results extending our framework to deep neural networks trained on image datasets, demonstrating promising transferability and membership inference performance under label-only access while highlighting directions for further optimization.

Figures

Figures reproduced from arXiv: 2602.18934 by the authors.

Figure 1
Figure 1. ROC curves for membership inference attack on surrogate and target models across datasets. [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

46 extracted references · 2 linked inside Pith

  1. [26]

    Label-only membership inference attacks,

    C. A. Choquette-Choo, F. Tramèr, N. Carlini, and N. Papernot, “Label-only membership inference attacks,” inProceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event(M. Meila and T. Zhang, eds.), vol. 139 ofProceedings of Machine Learning Research, (USA), pp. 1964–1974, PMLR, 2021

    2021

  2. [1]

    Privacy-preserving machine learning for healthcare: open challenges and future perspectives,

    A. Guerra-Manzanares, L. J. L. Lopez, M. Maniatakos, and F. E. Shamout, “Privacy-preserving machine learning for healthcare: open challenges and future perspectives,” inInternational Workshop on Trustworthy Machine Learning for Healthcare, pp. 25–40, Springer, 2023

    2023

  3. [2]

    Machine learning as a service (mlaas)—an enterprise perspective,

    I. Grigoriadis, E. Vrochidou, I. Tsiatsiou, and G. A. Papakostas, “Machine learning as a service (mlaas)—an enterprise perspective,” inProceedings of International Conference on Data Science and Applications: ICDSA 2022, Volume 2, pp. 261–273, Springer, 2023

    2022

  4. [3]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017, (USA), pp. 3–18, IEEE Computer Society, 2017

    2017

  5. [4]

    Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,

    A. Salem, Y . Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” in26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019, (USA), The Internet Society, 2019

    2019

  6. [5]

    Knock knock, who’s there? membership inference on aggregate location data,

    A. Pyrgelis, C. Troncoso, and E. D. Cristofaro, “Knock knock, who’s there? membership inference on aggregate location data,” in25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018, The Internet Society, 2018

    2018

  7. [6]

    Demystifying membership inference attacks in machine learning as a service,

    S. Truex, L. Liu, M. E. Gursoy, L. Yu, and W. Wei, “Demystifying membership inference attacks in machine learning as a service,”IEEE Trans. Serv. Comput., vol. 14, no. 6, pp. 2073–2089, 2021

  8. [7]

    LOGAN: membership inference attacks against generative models,

    J. Hayes, L. Melis, G. Danezis, and E. D. Cristofaro, “LOGAN: membership inference attacks against generative models,”Proc. Priv. Enhancing Technol., vol. 2019, no. 1, pp. 133–152, 2019

    2019

Show all 46 references
  1. [8]

    Monte carlo and reconstruction membership inference attacks against generative models,

    B. Hilprecht, M. Härterich, and D. Bernau, “Monte carlo and reconstruction membership inference attacks against generative models,”Proc. Priv. Enhancing Technol., vol. 2019, no. 4, pp. 232–249, 2019

    2019

  2. [9]

    Privacy risks of securing machine learning models against adversarial examples,

    L. Song, R. Shokri, and P. Mittal, “Privacy risks of securing machine learning models against adversarial examples,” inProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS 2019, London, UK, November 11-15, 2019(L. Cavallaro, J. Kinder, X. ...

    2019

  3. [10]

    White-box vs black-box: Bayes optimal strategies for membership inference,

    A. Sablayrolles, M. Douze, C. Schmid, Y . Ollivier, and H. Jégou, “White-box vs black-box: Bayes optimal strategies for membership inference,” inProceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, California, USA(K. Chau...

    2019

  4. [11]

    A pragmatic approach to membership inferences on machine learning models,

    Y . Long, L. Wang, D. Bu, V . Bindschaedler, X. Wang, H. Tang, C. A. Gunter, and K. Chen, “A pragmatic approach to membership inferences on machine learning models,” inIEEE European Symposium on Security and Privacy, EuroS&P 2020, Genoa, Italy, September 7-11, 2020, pp. 521–53...

    2020

  5. [12]

    Membership inference attacks and defenses in classification models,

    J. Li, N. Li, and B. Ribeiro, “Membership inference attacks and defenses in classification models,” in Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy, CODASPY ’21, (New York, NY , USA), p. 5–16, Association for Computing Machinery, 2021

    2021

  6. [13]

    Practical blind membership inference attack via differential comparisons,

    B. Hui, Y . Yang, H. Yuan, P. Burlina, N. Z. Gong, and Y . Cao, “Practical blind membership inference attack via differential comparisons,” in28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually, February 21-25, 2021, The Internet Society, 2021

    2021

  7. [14]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 2019,...

    2019

  8. [15]

    Memguard: Defending against black-box membership inference attacks via adversarial examples,

    J. Jia, A. Salem, M. Backes, Y . Zhang, and N. Z. Gong, “Memguard: Defending against black-box membership inference attacks via adversarial examples,” inProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS ’19, (New York, NY , USA), p. 259...

    2019

  9. [16]

    Defending model inversion and membership inference attacks via prediction purification,

    Z. Yang, B. Shao, B. Xuan, E. Chang, and F. Zhang, “Defending model inversion and membership inference attacks via prediction purification,”CoRR, vol. abs/2005.03915, 2020. 10

    2005 arXiv

  10. [17]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” inProceedings of the 2016 ACM SIGSAC Conference on Computer and Commu- nications Security, CCS ’16, (New York, NY , USA), p. 308–318, Association for...

    2016

  11. [18]

    Dropout: a simple way to prevent neural networks from overfitting,

    N. Srivastava, G. E. Hinton, A. Krizhevsky, I. Sutskever, and R. Salakhutdinov, “Dropout: a simple way to prevent neural networks from overfitting,”J. Mach. Learn. Res., vol. 15, no. 1, pp. 1929–1958, 2014

    1929

  12. [19]

    Low-cost high-power membership inference attacks,

    S. Zarifzadeh, P. Liu, and R. Shokri, “Low-cost high-power membership inference attacks,” inForty- first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024, OpenReview.net, 2024

    2024

  13. [20]

    Do membership inference attacks work on large language models?,

    M. Duan, A. Suri, N. Mireshghallah, S. Min, W. Shi, L. Zettlemoyer, Y . Tsvetkov, Y . Choi, D. Evans, and H. Hajishirzi, “Do membership inference attacks work on large language models?,”CoRR, vol. abs/2402.07841, 2024

    2024 arXiv

  14. [21]

    Quantifying privacy risks of masked language models using membership inference attacks,

    F. Mireshghallah, K. Goyal, A. Uniyal, T. Berg-Kirkpatrick, and R. Shokri, “Quantifying privacy risks of masked language models using membership inference attacks,” inProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, EMNLP 2022, Abu Dhabi,...

    2022

  15. [22]

    Membership inference attacks against language models via neighbourhood comparison,

    J. Mattern, F. Mireshghallah, Z. Jin, B. Schölkopf, M. Sachan, and T. Berg-Kirkpatrick, “Membership inference attacks against language models via neighbourhood comparison,” inFindings of the Association for Computational Linguistics: ACL 2023, Toronto, Canada, July 9-14, 2023(...

    2023

  16. [23]

    Please Tell Me More: Privacy Impact of Explainability through the Lens of Membership Inference Attack ,

    H. Liu, Y . Wu, Z. Yu, and N. Zhang, “ Please Tell Me More: Privacy Impact of Explainability through the Lens of Membership Inference Attack ,” in2024 IEEE Symposium on Security and Privacy (SP), (Los Alamitos, CA, USA), pp. 4791–4809, IEEE Computer Society, May 2024

    2024

  17. [24]

    Enhanced membership inference attacks against machine learning models,

    J. Ye, A. Maddi, S. K. Murakonda, V . Bindschaedler, and R. Shokri, “Enhanced membership inference attacks against machine learning models,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS ’22, (New York, NY , USA), p. 3093–3106, As...

    2022

  18. [25]

    Membership inference attacks from first principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramèr, “Membership inference attacks from first principles,” in2022 IEEE Symposium on Security and Privacy (SP), pp. 1897–1914, 2022

    1914

  19. [27]

    Membership leakage in label-only exposures,

    Z. Li and Y . Zhang, “Membership leakage in label-only exposures,” inProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, CCS ’21, (New York, NY , USA), p. 880–895, Association for Computing Machinery, 2021

    2021

  20. [28]

    Privacy risk in machine learning: Analyzing the connection to overfitting,

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in31st IEEE Computer Security Foundations Symposium, CSF 2018, Oxford, United Kingdom, July 9-12, 2018, pp. 268–282, IEEE Computer Society, 2018

    2018

  21. [29]

    Stealing machine learning models via prediction apis,

    F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction apis,” inProceedings of the 25th USENIX Conference on Security Symposium, SEC’16, (USA), p. 601–618, USENIX Association, 2016

    2016

  22. [30]

    Knockoff nets: Stealing functionality of black-box models,

    T. Orekondy, B. Schiele, and M. Fritz, “Knockoff nets: Stealing functionality of black-box models,” in IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, (USA), pp. 4954–4963, Computer Vision Foundation / IEEE, 2019

    2019

  23. [31]

    PRADA: protecting against DNN model stealing attacks,

    M. Juuti, S. Szyller, S. Marchal, and N. Asokan, “PRADA: protecting against DNN model stealing attacks,” inIEEE European Symposium on Security and Privacy, EuroS&P 2019, Stockholm, Sweden, June 17-19, 2019, (USA), pp. 512–527, IEEE, 2019

    2019

  24. [32]

    Practical black-box attacks against machine learning,

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” inProceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, ASIA CCS ’17, (New York, NY , USA), p. 506–519, Associa...

    2017

  25. [33]

    High accuracy and high fidelity extraction of neural networks,

    M. Jagielski, N. Carlini, D. Berthelot, A. Kurakin, and N. Papernot, “High accuracy and high fidelity extraction of neural networks,” in29th USENIX Security Symposium, USENIX Security 2020, August 12-14, 2020(S. Capkun and F. Roesner, eds.), (USA), pp. 1345–1362, USENIX Associ...

    2020

  26. [34]

    Data-free model extraction,

    J. Truong, P. Maini, R. J. Walls, and N. Papernot, “Data-free model extraction,” inIEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021, (USA), pp. 4771–4780, Computer Vision Foundation / IEEE, 2021. 11

    2021

  27. [35]

    Thieves on sesame street! model extraction of bert-based apis,

    K. Krishna, G. S. Tomar, A. P. Parikh, N. Papernot, and M. Iyyer, “Thieves on sesame street! model extraction of bert-based apis,” in8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020, OpenReview.net, 2020

    2020

  28. [36]

    Marich: A query-efficient distributionally equivalent model extraction attack,

    P. Karmakar and D. Basu, “Marich: A query-efficient distributionally equivalent model extraction attack,” inAdvances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - ...

    2023

  29. [37]

    AUTOLYCUS: exploiting explainable artificial intelligence (XAI) for model extraction attacks against interpretable models,

    A. C. Oksuz, A. Halimi, and E. Ayday, “AUTOLYCUS: exploiting explainable artificial intelligence (XAI) for model extraction attacks against interpretable models,”Proc. Priv. Enhancing Technol., vol. 2024, no. 4, pp. 684–699, 2024

    2024

  30. [38]

    Transferability in machine learning: from phenomena to black-box attacks using adversarial samples,

    N. Papernot, P. D. McDaniel, and I. J. Goodfellow, “Transferability in machine learning: from phenomena to black-box attacks using adversarial samples,” 2016

    2016

  31. [39]

    Delving into transferable adversarial examples and black-box attacks,

    Y . Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adversarial examples and black-box attacks,” in5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings, OpenReview.net, 2017

    2017

  32. [40]

    Cross-domain transferability of adversarial perturbations,

    M. Naseer, S. H. Khan, M. H. Khan, F. S. Khan, and F. Porikli, “Cross-domain transferability of adversarial perturbations,” inAdvances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 201...

    2019

  33. [41]

    Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks,

    A. Demontis, M. Melis, M. Pintor, M. Jagielski, B. Biggio, A. Oprea, C. Nita-Rotaru, and F. Roli, “Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks,” inProceedings of the 28th USENIX Conference on Security Symposium, SEC’19, (USA...

    2019

  34. [42]

    Feature selection, l1 vs. l2 regularization, and rotational invariance,

    A. Y . Ng, “Feature selection, l1 vs. l2 regularization, and rotational invariance,” inProceedings of the Twenty-First International Conference on Machine Learning, ICML ’04, (New York, NY , USA), p. 78, Association for Computing Machinery, 2004

    2004

  35. [43]

    A simple weight decay can improve generalization,

    A. Krogh and J. A. Hertz, “A simple weight decay can improve generalization,” inProceedings of the 5th International Conference on Neural Information Processing Systems, NIPS’91, (San Francisco, CA, USA), p. 950–957, Morgan Kaufmann Publishers Inc., 1991

    1991

  36. [44]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” in3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings (Y . Bengio and Y . LeCun, eds.), 2015

    2015

  37. [45]

    Decoupled weight decay regularization,

    I. Loshchilov and F. Hutter, “Decoupled weight decay regularization,” inInternational Conference on Learning Representations, 2019

    2019

  38. [46]

    Adversarial robustness toolbox v1.0.0,

    M.-I. Nicolae, M. Sinn, M. N. Tran, B. Buesser, A. Rawat, M. Wistuba, V . Zantedeschi, N. Baracaldo, B. Chen, H. Ludwig, I. M. Molloy, and B. Edwards, “Adversarial robustness toolbox v1.0.0,” 2019. 12 A Commonly Used Symbols and Notations The following table summarizes the com...

    2019

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.