Pith. sign in

REVIEW 5 major objections 6 minor 85 references

Rethinking Membership Inference Attacks Against Transfer Learning

T0 review · 5 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a white-box attacker with access only to the fine-tuned student model can infer membership in the teacher model's private training data by comparing hidden-layer activation discrepancies with a shadow student model.

desk verdict Genuinely new attack scenario, but the evaluation pipeline doesn't yet show that the reported accuracies measure teacher membership. read the letter →

arxiv 2501.11577 v1 pith:5SOL32JG submitted 2025-01-20 cs.CR cs.LG

Cong Wu , Jing Chen , Qianru Fang , Kun He , Ziming Zhao , Hao Ren , Guowen Xu , Yang Liu
show 1 more author
Yang Xiang
This is my paper · ORCID
classification cs.CRcs.LG
keywords membershipinferenceattacktransferlearningteacher-studentmodelwhite-boxshadowhidden-layerrepresentationdiscrepancyprivacyleakageadaptivethresholdselection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Transfer learning releases the fine-tuned student model but keeps the teacher model private; this paper claims that privacy is not preserved. The proposed attack assumes a white-box view of the student model only, then trains a shadow student model from scratch on data with a similar distribution, and compares the hidden-layer activation vectors of the two models for the same input. The difference between those vectors is treated as evidence that the input was part of the teacher model's training set. On CIFAR-100, Flowers102, and Cats vs. Dogs, the paper reports attack accuracies of 0.581, 0.632, and 0.728, with AUC values approaching or exceeding 0.7, and reports that its method beats the two black-box transfer-learning baselines it compares against. The upshot, if correct, is that fine-tuning a model does not protect the original training data of the model it was derived from.

What carries the argument

The load-bearing object is the differential feature-representation vector, the elementwise absolute difference between the real student model's hidden-layer output and the shadow student model's hidden-layer output for the same input. The paper's assumption is that the student inherits the teacher's frozen feature extractor, so data that shaped the teacher leaves a mark in the student's representations that a from-scratch shadow model does not share. That difference, measured with L2 distance and compared against three median-selected thresholds, is what lets the attack separate teacher-members, student-members, and non-members.

What would settle it

Take a teacher model whose full training set is known, hold out a balanced set of true non-members from the same distribution, and run the attack against both groups. If accuracy on that ground-truth membership split falls to chance while the proxy-labeled accuracy remains high, the claimed teacher-membership signal is an artifact of the proxy labels; repeating the test across several intermediate layers would also show whether the signal depends on an unstated layer choice.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that teacher-membership information survives transfer learning and is detectable from the student alone. The attack labels the absolute difference between the real student's hidden activations and the shadow student's hidden activations, $|M_s(x)-M'_s(x)|$, as 'teacher-member' for inputs in the shadow member set; labels the real student's raw activations $M_s(x)$ as 'student-member'; and labels activations from random noisy images as 'non-member'. A three-class classifier is trained on these labels, and at inference time the attacker measures L2 distances between the target's activation vector and the labeled training vectors, with three median-derived thresholds ($\sigma_1,\sigma_2,\sigma_3$) deciding between the classes. The paper reports the attack succeeds across four teacher architectures and three student datasets, with accuracy increasing as more teacher layers are frozen in the student.

Load-bearing premise

The attack assumes that the L2 discrepancy between the real student's hidden activations and a from-scratch shadow student's activations tracks true teacher membership, even though Algorithm 1 labels those discrepancies as teacher-member without ground-truth teacher labels and without specifying the intermediate layer.

Editorial extensions

If this is right

  • A white-box view of any fine-tuned student model should be treated as partial exposure of the teacher's private training set, even if the teacher is never released.
  • Freezing more layers in the student increases the leak: reported accuracy on Cats vs. Dogs rises from 0.637 with the first two parts frozen to 0.809 with the first four parts frozen.
  • Leakage estimates from black-box transfer-learning attacks understate the risk, because the reported accuracy here exceeds both prior black-box baselines on every student dataset tested.
  • Defenses for transfer learning must address representation-level discrepancies, not just output calibration; the paper lists output randomization, adversarial training, generative obfuscation, model splitting, and pruning as candidate mitigations with no established defense yet.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A stricter test of the claimed signal, not run in the paper, would hold out true teacher members and non-members, since Algorithm 1 labels shadow-member inputs as teacher-members without ground-truth teacher labels; that split would show whether the reported accuracies measure teacher membership or a proxy of it.
  • The paper does not specify which intermediate layer supplies the hidden activations, so a sensitivity analysis across layers would clarify how deep the teacher-membership trace survives and which layer maximizes the discrepancy.
  • The same discrepancy principle could be probed in longer transfer chains (teacher to student to student), where each stage may preserve or dilute the teacher-membership trace; this is a testable extension the authors flag as future work.
  • If the effect is real, a targeted defense would randomize or distill the student's frozen feature extractor specifically to break the correlation between teacher membership and hidden-activation discrepancies, rather than relying on output-level defenses.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes a white-box membership inference attack (MIA) against transfer learning, targeting the teacher model while only accessing the student model (At.T & Ac.S). The attack trains a three-class classifier on features extracted from the real student model, a from-scratch shadow student model, and random noisy images, and it also defines an adaptive thresholding procedure. Experiments are reported on CIFAR-100, Flowers102, and Cats vs Dogs, with a ResNet50 teacher pretrained on ImageNet and with additional results for VGG19, Inception v3, and DenseNet169. The headline numbers are accuracies of 0.581, 0.632, and 0.728 for At.T & Ac.S on the three datasets, with AUC values near or above 0.7, which the paper interprets as evidence that the teacher's training data remain susceptible to MIAs even when the attacker only sees the student model.

Significance. The research question is timely and important: transfer learning is widely deployed, and understanding whether a fine-tuned student model leaks information about the teacher's private training data has clear privacy implications. The paper is also useful in that it considers three attack cases (At.T & Ac.S, At.T & Ac.T, At.S & Ac.S), evaluates multiple architectures and datasets, and compares against two existing transfer-learning MIA baselines. If the central claim were established, the attack would be a meaningful contribution to the MIA literature. However, as written, the evidence does not support the claim: the attack model in Algorithm 1 is trained without ground-truth teacher membership labels, the threshold-based decision uses random noise as the non-member class, and the evaluation target in Section VI.A/VI.B is ambiguous. These issues are load-bearing rather than cosmetic, so the current manuscript does not substantiate its main conclusion.

major comments (5)
  1. [§IV.A, Algorithm 1 Step 3] The class-1 ('teacher-member') training set is compiled as the L2 difference between the real student model and the shadow student model evaluated on the shadow student's own member data, i.e., (|Ms(x) − M′s(x)|, 1) for x ∈ mD_shadow_s. No ground-truth teacher membership label enters this construction, so the attack model is trained to separate shadow-student-member features (class 2), L2 differences on those same points (class 1), and random noise (class 0), rather than to implement the teacher-membership decision defined in Eq. (2). The paper never validates that this proxy correlates with true teacher membership; the reported accuracies in Section VI.B are therefore not, by themselves, evidence that teacher membership is inferable.
  2. [§IV.B and Algorithm 2] The threshold-based decision procedure uses random noisy images D_n as the non-member class and calibrates σ2 and σ3 on distances from noise features to shadow and real student features. In consequence, any natural image—whether a teacher member or a non-member—will likely be far from the noise class in representation space, so the 'non-member' outcome is confounded with a real-versus-noise separation rather than with membership. A control experiment that replaces D_n with real teacher non-member images during attack training is needed to rule out this confound.
  3. [§VI.A and §VI.B] The setup states that the teacher model is trained on ImageNet and transferred to student models on CIFAR-100, Flowers102, and Cats vs Dogs, yet Figure 6 and Table III present At.T & Ac.S results 'on three student datasets.' If the evaluated member/non-member points for teacher membership are drawn from the student datasets, then none of those points is a teacher member by construction, and the reported accuracies cannot measure the claimed attack. The paper must specify which dataset provides the true teacher member and non-member test points and must reconcile the statement that the teacher is pretrained on ImageNet with the later statement in Section VI.A that '70% [of the initial dataset is] for training the teacher model and 30% for the student model.'
  4. [§VI.D and Table V] The comparison with Zou et al. and TransMIA is not like-for-like: the proposed method uses white-box access to intermediate hidden-layer features, while the baselines are described as black-box attacks, and Table V even labels the scenario as 'black-box' for all rows. The observed gains (e.g., 0.728 vs. 0.624 vs. 0.539 for Cats vs Dogs) may reflect the stronger access assumption rather than the proposed methodology, so the 'outperforms SOTA' claim is not established as stated.
  5. [§VI.A] The paper never states which hidden layer is used for feature extraction in the experiments. Because the entire method relies on hidden-layer representations, the reported numbers depend on an unstated layer choice; the authors should identify the layer and report a sensitivity analysis over layers.
minor comments (6)
  1. [Algorithm 2] Algorithm 2 contains confusing sign flips (e.g., distance1 ← −dis(M′s(x), Ms(x)) and then σ1 ← −median(distance1)) and a typo in line 6 ('dis(d(Ms(x1), Ms(x2)))'). Please simplify the expressions and correct the typo.
  2. [§IV.B] In decision rule (ii), the phrase 'the feature representation of the target data record is not the number of student number' is ungrammatical and should be rewritten to 'is not a member of the student model's training set.'
  3. [§VII.B vs. §I] Section VII.B states that TransMIA improves attack effectiveness 'using a white-box approach,' while the Introduction claims the proposed work is the first white-box attack against transfer learning. Please reconcile these statements or temper the novelty claim.
  4. [Table V] Table V lists the 'Scenario' for all approaches, including the proposed one, as 'black-box,' which contradicts the white-box framing used throughout the rest of the paper. This needs to be corrected.
  5. [Figures 6-9] In the submitted version, Figures 6–9 contain garbled text, making the plots unreadable. The captions, axis labels, and legends need to be regenerated so the reported numbers can be visually verified.
  6. [§VIII.B] The limitations section states that Manhattan and Cosine distances showed lower MIA accuracy, but no such results are reported anywhere. Either include the supporting numbers or remove the claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack proxy is validated against independent teacher-membership labels.

full rationale

No equation in the paper reduces to its own input. Algorithm 1 constructs class-1 'teacher-member' training examples as L2 differences between real and shadow student features on shadow-student member data, and the Section IV.B decision rule compares the target's student features against those stored differences by L2 distance. This means the attack's operational teacher-membership score is a proxy, not a direct copy of the evaluation labels. The reported accuracies in Section VI.B (0.581, 0.632, and 0.728) are measured against independently defined ground-truth teacher membership splits, as described in Section VI.A: 'we evenly divided the teacher/student datasets into member and non-member groups, ensuring no overlap and a balanced 1:1 ratio.' That external evaluation breaks any circular reduction: the proxy is learned and thresholded without using true teacher labels and is then tested on true member and non-member data. The thresholds in Algorithm 2 are calibrated on shadow data and random noise, not on the ground-truth teacher labels used in evaluation. The paper's self-citations (e.g., [33], [51], [74]) appear in general background and application discussions, and none is load-bearing for the attack derivation. The central claim is therefore an empirical hypothesis evaluated against external benchmarks rather than a result forced by definition. The main weakness is construct validity, not circularity: Section IV.A asserts the L2 difference 'represents the privacy of teacher dataset' without proof, but the subsequent ground-truth evaluation is exactly the kind of independent check that prevents the assertion from being circular.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The attack introduces three free thresholds and relies on several unproven domain assumptions about transferability of shadow-model differences. The main load-bearing assumption is that teacher membership is encoded in the difference between the real student and a from-scratch shadow student, which is stated rather than derived. No new physical or conceptual entities are introduced beyond a synthetic teacher-member label set.

free parameters (4)
  • sigma_1 = median of L2 distances between student and shadow student features on shadow student member data
    Used as the threshold separating student-member from teacher-member and non-member classes; chosen from shadow data, not derived from theory.
  • sigma_2 = median of L2 distances between noisy-image features and shadow student member features
    Upper threshold for the middle band in the ternary decision; calibrated on random noisy images.
  • sigma_3 = median of L2 distances between noisy-image features and the constructed teacher-member difference features
    Threshold for distinguishing teacher-member from non-member within the middle band; depends on the synthetic teacher-member representation.
  • hidden layer selection = unspecified
    The paper queries 'the intermediate hidden layer' without naming the layer; attack results likely depend on this unstated choice.
assumptions (4)
  • domain assumption Shadow student dataset distribution approximates the student's training distribution and, through transfer, the teacher's relevant distribution.
    The attack trains the shadow model on D_shadow_s and assumes the learned decision transfers to targets from the teacher's data distribution (Sections III.A and VI.A).
  • ad hoc to paper The L2 difference between real student and from-scratch shadow student representations on shadow member data is a faithful proxy for teacher training membership.
    Algorithm 1 step 3 labels these differences as teacher-member without ground-truth teacher labels; the entire attack depends on this equivalence.
  • domain assumption Transfer learning preserves teacher-membership information in the student's frozen transferred layers after fine-tuning.
    The paper motivates At.T & Ac.S by claiming the student retains information from the teacher through transfer (Section III.A), but provides no formal argument.
  • ad hoc to paper Random noisy images form a valid non-member distribution for calibrating thresholds.
    Noise images are used to define class 0 and thresholds sigma_2 and sigma_3 (Algorithm 2); if noisy images are not representative of real non-member data, thresholds are miscalibrated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Rethinking Membership Inference Attacks Against Transfer Learning." pith.science (2026). https://pith.science/paper/5SOL32JG

@misc{pith2026250111577,
  author       = {Pith},
  title        = {Pith review of: Rethinking Membership Inference Attacks Against Transfer Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5SOL32JG}},
  note         = {Machine review of arXiv:2501.11577}
}
read the original abstract

Transfer learning, successful in knowledge translation across related tasks, faces a substantial privacy threat from membership inference attacks (MIAs). These attacks, despite posing significant risk to ML model's training data, remain limited-explored in transfer learning. The interaction between teacher and student models in transfer learning has not been thoroughly explored in MIAs, potentially resulting in an under-examined aspect of privacy vulnerabilities within transfer learning. In this paper, we propose a new MIA vector against transfer learning, to determine whether a specific data point was used to train the teacher model while only accessing the student model in a white-box setting. Our method delves into the intricate relationship between teacher and student models, analyzing the discrepancies in hidden layer representations between the student model and its shadow counterpart. These identified differences are then adeptly utilized to refine the shadow model's training process and to inform membership inference decisions effectively. Our method, evaluated across four datasets in diverse transfer learning tasks, reveals that even when an attacker only has access to the student model, the teacher model's training data remains susceptible to MIAs. We believe our work unveils the unexplored risk of membership inference in transfer learning.

Figures

Figures reproduced from arXiv: 2501.11577 by the authors.

Figure 1
Figure 1. Illustration of transfer learning models with optimized resource utilization for task-specific applications. As illustrated in [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Attack workflow of At.T & Ac.S. training dataset. 0 represents that the data point is a non￾member of Mt’s training dataset and Ms’s training dataset. The intuition behind this attack stems from the premise that feature representations differ between a model trained on specific data and an analogous model trained independently. In transfer learning, these disparities in feature representations between the student an… view at source ↗
Figure 3
Figure 3. Attack workflow of At.T & Ac.T (a) and At.S & Ac.S (b) [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: A example of the raw image (a), the feature represen [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: The structure of ResNet50, we divided the model into [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Performance of At.T & Ac.S under different datasets Part 1-2 Part 1-3 Part 1-4 Freezing parts 0.5 0.6 0.7 0.8 0.9 1.0 Performance Accuracy Precision Recall AUC [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 9
Figure 9. Figure 9: Attack performance of At.S & Ac.S under CIFAR-100, [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

85 extracted references · 57 canonical work pages

  1. [1]

    With great training comes great vulnerability: Practical attacks against transfer learning,

    B. Wang, Y . Yao, B. Viswanath, H. Zheng, and B. Y . Zhao, “With great training comes great vulnerability: Practical attacks against transfer learning,” in USENIX Security, 2018

    2018

  2. [2]

    Transfer learning in deep reinforcement learning: A survey,

    Z. Zhu, K. Lin, A. K. Jain, and J. Zhou, “Transfer learning in deep reinforcement learning: A survey,” IEEE TPAMI, 2023

    2023

  3. [3]

    Ic3m: In- car multimodal multi-object monitoring for abnormal status of both driver and passengers,

    Z. Fang, Z. Lin, S. Hu, H. Cao, Y . Deng, X. Chen, and Y . Fang, “Ic3m: In- car multimodal multi-object monitoring for abnormal status of both driver and passengers,” arXiv preprint arXiv:2410.02592 , 2024

    arXiv 2024

  4. [4]

    Efficient parallel split learning over resource-constrained wireless edge networks,

    Z. Lin, G. Zhu, Y . Deng, X. Chen, Y . Gao, K. Huang, and Y . Fang, “Efficient parallel split learning over resource-constrained wireless edge networks,” IEEE Transactions on Mobile Computing , 2024

    2024

  5. [5]

    Towards Effective Detection of Ponzi schemes on Ethereum with Contract Runtime Behavior Graph

    R. Liang, J. Chen, C. Wu, K. He, Y . Wu, W. Sun, R. Du, Q. Zhao, and Y . Liu, “Towards effective detection of ponzi schemes on ethereum with contract runtime behavior graph,” arXiv preprint arXiv:2406.00921 , 2024

    work page Pith review arXiv 2024

  6. [6]

    Constructing 4d radio map in leo satellite networks with limited samples,

    H. Yuan, Z. Chen, Z. Lin, J. Peng, Y . Zhong, X. Hu, S. Xue, W. Li, and Y . Gao, “Constructing 4d radio map in leo satellite networks with limited samples,” arXiv preprint arXiv:2501.02775, 2025

    arXiv 2025

  7. [7]

    Graph learning for multi-satellite based spectrum sensing,

    H. Yuan, Z. Chen, Z. Lin, J. Peng, Z. Fang, Y . Zhong, Z. Song, X. Wang, and Y . Gao, “Graph learning for multi-satellite based spectrum sensing,” inProc. ICCT, 2023, pp. 1112–1116

    2023

  8. [8]

    Channel power gain estimation for terahertz vehicle-to-infrastructure networks,

    Z. Lin, L. Wang, J. Ding, B. Tan, and S. Jin, “Channel power gain estimation for terahertz vehicle-to-infrastructure networks,” IEEE Communications Letters , vol. 27, no. 1, pp. 155–159, 2022

    2022

Show all 85 references
  1. [9]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in IEEE SP , 2017

    2017

  2. [10]

    Fedsn: A federated learning framework over heterogeneous leo satellite networks,

    Z. Lin, Z. Chen, Z. Fang, X. Chen, X. Wang, and Y . Gao, “Fedsn: A federated learning framework over heterogeneous leo satellite networks,” IEEE Transactions on Mobile Computing , 2024

    2024

  3. [11]

    Generated distributions are all you need for membership inference attacks against generative models,

    M. Zhang, N. Yu, R. Wen, M. Backes, and Y . Zhang, “Generated distributions are all you need for membership inference attacks against generative models,” in CVPR, 2024

    2024

  4. [12]

    Hierarchical split federated learning: Convergence analysis and system optimization,

    Z. Lin, W. Wei, Z. Chen, C.-T. Lam, X. Chen, Y . Gao, and J. Luo, “Hierarchical split federated learning: Convergence analysis and system optimization,” arXiv preprint arXiv:2412.07197, 2024

    2024 arXiv

  5. [13]

    Label-leaks: Membership inference attack with label,

    Z. Li and Y . Zhang, “Label-leaks: Membership inference attack with label,” arXiv e-prints, 2020

    2020

  6. [14]

    Machine learning with membership privacy using adversarial regularization,

    M. Nasr, R. Shokri, and A. Houmansadr, “Machine learning with membership privacy using adversarial regularization,” in ACM CCS, 2018

    2018

  7. [15]

    Satfed: A resource-efficient leo satellite-assisted heterogeneous federated learning framework,

    Y . Zhang, Z. Lin, Z. Chen, Z. Fang, W. Zhu, X. Chen, J. Zhao, and Y . Gao, “Satfed: A resource-efficient leo satellite-assisted heterogeneous federated learning framework,” arXiv preprint arXiv:2409.13503 , 2024

    2024 arXiv

  8. [16]

    Source inference attacks: Beyond membership inference attacks in federated learning,

    H. Hu, X. Zhang, Z. Salcic, L. Sun, K.-K. R. Choo, and G. Dobbie, “Source inference attacks: Beyond membership inference attacks in federated learning,” IEEE TIFS , 2023. 12

    2023

  9. [17]

    Face mask detection using transfer learning of inceptionv3,

    G. Jignesh Chowdary, N. S. Punn, S. K. Sonbhadra, and S. Agarwal, “Face mask detection using transfer learning of inceptionv3,” in International Conference on Big Data Analytics , 2020

    2020

  10. [18]

    Ml- leaks: Model and data independent membership inference attacks and defenses on machine learning models,

    A. Salem, Y . Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “Ml- leaks: Model and data independent membership inference attacks and defenses on machine learning models,” in NDSS, 2018

    2018

  11. [19]

    General data protection regulation (gdpr),

    “General data protection regulation (gdpr),” https://gdpr-info.eu/

  12. [20]

    California consumer privacy act (ccpa),

    “California consumer privacy act (ccpa),” https://oag.ca.gov/privacy/ccpa

  13. [21]

    It’s all in the touch: Authenticating users with host gestures on multi-touch screen devices,

    C. Wu, H. Cao, G. Xu, C. Zhou, J. Sun, R. Yan, Y . Liu, and H. Jiang, “It’s all in the touch: Authenticating users with host gestures on multi-touch screen devices,” in IEEE Transactions on Mobile Computing , 2024

    2024

  14. [22]

    A survey of privacy attacks in machine learning,

    M. Rigaki and S. Garc ´ıa, “A survey of privacy attacks in machine learning,” ACM Computing Surveys, 2024

    2024

  15. [23]

    Differentially private hypothesis transfer learning,

    Y . Wang, Q. Gu, and D. Brown, “Differentially private hypothesis transfer learning,” in Joint European Conference on Machine Learning and Knowledge Discovery in Databases, 2019

    2019

  16. [24]

    Privacy-preserving heterogeneous federated transfer learning,

    D. Gao, Y . Liu, A. Huang, C. Ju, H. Yu, and Q. Yang, “Privacy-preserving heterogeneous federated transfer learning,” in IEEE International Conference on Big Data , 2019

    2019

  17. [25]

    Privacy analysis of deep learning in the wild: Membership inference attacks against transfer learning,

    Y . Zou, Z. Zhang, M. Backes, and Y . Zhang, “Privacy analysis of deep learning in the wild: Membership inference attacks against transfer learning,” arXiv:2009.04872, 2020

    2009 arXiv

  18. [26]

    Transmia: membership inference attacks using transfer shadow training,

    S. Hidano, T. Murakami, and Y . Kawamoto, “Transmia: membership inference attacks using transfer shadow training,” in IEEE IJCNN , 2021

    2021

  19. [27]

    Towards measuring membership privacy,

    Y . Long, V . Bindschaedler, and C. A. Gunter, “Towards measuring membership privacy,” arXiv:1712.09136, 2017

    2017 arXiv

  20. [28]

    Privacy risks of securing machine learning models against adversarial examples,

    L. Song, R. Shokri, and P. Mittal, “Privacy risks of securing machine learning models against adversarial examples,” in ACM CCS, 2019

    2019

  21. [29]

    Privacy-preserving in defending against member- ship inference attacks,

    Z. Ying, Y . Zhang, and X. Liu, “Privacy-preserving in defending against member- ship inference attacks,” in Workshop on Privacy-Preserving Machine Learning in Practice, 2020

    2020

  22. [30]

    Faceleaks: Inference attacks against transfer learning models via black-box queries,

    S. P. Liew and T. Takahashi, “Faceleaks: Inference attacks against transfer learning models via black-box queries,” arXiv:2010.14023, 2020

    2010 arXiv

  23. [31]

    Memguard: Defending against black-box membership inference attacks via adversarial examples,

    J. Jia, A. Salem, M. Backes, Y . Zhang, and N. Z. Gong, “Memguard: Defending against black-box membership inference attacks via adversarial examples,” in ACM CCS, 2019

    2019

  24. [32]

    Reinforcement learning based physical cross-layer security and privacy in 6g,

    X. Lu, L. Xiao, P. Li, X. Ji, C. Xu, S. Yu, and W. Zhuang, “Reinforcement learning based physical cross-layer security and privacy in 6g,” IEEE Communications Surveys & Tutorials , 2022

    2022

  25. [33]

    Echohand: High accuracy and presentation attack resistant hand authentication on commodity mobile devices,

    C. Wu, J. Chen, K. He, Z. Zhao, R. Du, and C. Zhang, “Echohand: High accuracy and presentation attack resistant hand authentication on commodity mobile devices,” in ACM CCS, 2022

    2022

  26. [34]

    Membership inference attacks from first principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership inference attacks from first principles,” in IEEE SP , 2022

    2022

  27. [35]

    Credit card analytics: A review of fraud detection and risk assessment techniques,

    K. Patel, “Credit card analytics: A review of fraud detection and risk assessment techniques,” International Journal of Computer Trends and Technology , 2023

    2023

  28. [36]

    Performance of dif- ferent machine learning algorithms in detecting financial fraud,

    A. A. S. Alsuwailem, E. Salem, and A. K. J. Saudagar, “Performance of dif- ferent machine learning algorithms in detecting financial fraud,” Computational Economics, 2023

    2023

  29. [37]

    Fedlppa: Learning personalized prompt and aggregation for federated weakly-supervised medical image segmentation,

    L. Lin, Y . Liu, J. Wu, P. Cheng, Z. Cai, K. K. Wong, and X. Tang, “Fedlppa: Learning personalized prompt and aggregation for federated weakly-supervised medical image segmentation,” arXiv:2402.17502, 2024

    2024 arXiv

  30. [38]

    Efficient sparse least absolute deviation regression with differential privacy,

    W. Liu, X. Mao, X. Zhang, and X. Zhang, “Efficient sparse least absolute deviation regression with differential privacy,” IEEE TIFS , 2024

    2024

  31. [39]

    Hmog: New behavioral biometric features for continuous authentication of smart- phone users,

    Z. Sitov ´a, J. ˇSedˇenka, Q. Yang, G. Peng, G. Zhou, P. Gasti, and K. S. Balagani, “Hmog: New behavioral biometric features for continuous authentication of smart- phone users,” IEEE TIFS , 2015

    2015

  32. [40]

    Smart- cope: Smartphone change of possession evaluation for continuous authentication,

    N. Cariello, S. Levine, G. Zhou, B. Hoplight, P. Gasti, and K. S. Balagani, “Smart- cope: Smartphone change of possession evaluation for continuous authentication,” Pervasive and Mobile Computing , 2024

    2024

  33. [41]

    Your pin sounds good! augmentation of pin guessing strategies via audio leakage,

    M. Cardaioli, M. Conti, K. Balagani, and P. Gasti, “Your pin sounds good! augmentation of pin guessing strategies via audio leakage,” in ESORICS, 2020

    2020

  34. [42]

    Defenses to membership inference attacks: A survey,

    L. Hu, A. Yan, H. Yan, J. Li, T. Huang, Y . Zhang, C. Dong, and C. Yang, “Defenses to membership inference attacks: A survey,” ACM Computing Surveys , 2023

    2023

  35. [43]

    Imagenet: A large- scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large- scale hierarchical image database,” in CVPR, 2009

    2009

  36. [44]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009

    2009

  37. [45]

    102 category flower dataset,

    “102 category flower dataset,” https://www.robots.ox.ac.uk/ ∼vgg/data/flowers/102/

  38. [46]

    Dogs vs. cats,

    “Dogs vs. cats,” https://www.kaggle.com/c/dogs-vs-cats

  39. [47]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in CVPR, 2016

    2016

  40. [48]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in ICLR, 2015

    2015

  41. [49]

    Rethinking the inception architecture for computer vision,

    C. Szegedy, V . Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna, “Rethinking the inception architecture for computer vision,” in CVPR, 2016

    2016

  42. [50]

    Densely connected convolutional networks,

    G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” in CVPR, 2017

    2017

  43. [51]

    Caiauth: context-aware implicit authentication when the screen is awake,

    C. Wu, K. He, J. Chen, R. Du, and Y . Xiang, “Caiauth: context-aware implicit authentication when the screen is awake,” IEEE Internet of Things Journal , 2020

    2020

  44. [52]

    Enhanced mixup training: a defense method against membership inference attack,

    Z. Chen, H. Li, M. Hao, and G. Xu, “Enhanced mixup training: a defense method against membership inference attack,” in International Conference on Information Security Practice and Experience , 2021

    2021

  45. [53]

    Practical membership inference attack against collaborative inference in industrial iot,

    H. Chen, H. Li, G. Dong, M. Hao, G. Xu, X. Huang, and Z. Liu, “Practical membership inference attack against collaborative inference in industrial iot,” IEEE TII, 2020

    2020

  46. [54]

    Privacy risk in machine learning: Analyzing the connection to overfitting,

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in IEEE Computer Security F oundations Symposium, 2018

    2018

  47. [55]

    Systematic evaluation of privacy risks of machine learning models,

    L. Song and P. Mittal, “Systematic evaluation of privacy risks of machine learning models,” in USENIX Security , 2021

    2021

  48. [56]

    A pragmatic approach to membership inferences on machine learning models,

    Y . Long, L. Wang, D. Bu, V . Bindschaedler, X. Wang, H. Tang, C. A. Gunter, and K. Chen, “A pragmatic approach to membership inferences on machine learning models,” in IEEE EuroSP, 2020

    2020

  49. [57]

    Practical blind membership inference attack via differential comparisons,

    B. Hui, Y . Yang, H. Yuan, P. Burlina, N. Z. Gong, and Y . Cao, “Practical blind membership inference attack via differential comparisons,” in NDSS, 2021

    2021

  50. [58]

    Membership leakage in label-only exposures,

    Z. Li and Y . Zhang, “Membership leakage in label-only exposures,” in ACM CCS, 2021

    2021

  51. [59]

    Membership inference attacks by exploiting loss trajectory,

    Y . Liu, Z. Zhao, M. Backes, and Y . Zhang, “Membership inference attacks by exploiting loss trajectory,” in ACM CCS, 2022

    2022

  52. [60]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in IEEE EuroSP, 2019

    2019

  53. [61]

    Revisiting mem- bership inference under realistic assumptions,

    B. Jayaraman, L. Wang, K. Knipmeyer, Q. Gu, and D. Evans, “Revisiting mem- bership inference under realistic assumptions,” Privacy Enhancing Technologies Symposium, 2021

    2021

  54. [62]

    Membership inference vulnera- bilities in peer-to-peer federated learning,

    A. Luqman, A. Chattopadhyay, and K.-Y . Lam, “Membership inference vulnera- bilities in peer-to-peer federated learning,” in Proceedings of the 2023 Secure and Trustworthy Deep Learning Systems Workshop , 2023

    2023

  55. [63]

    Humpty dumpty: Controlling word meanings via corpus poisoning,

    R. Schuster, T. Schuster, Y . Meri, and V . Shmatikov, “Humpty dumpty: Controlling word meanings via corpus poisoning,” in IEEE SP , 2020

    2020

  56. [64]

    Latent backdoor attacks on deep neural networks,

    Y . Yao, H. Li, H. Zheng, and B. Y . Zhao, “Latent backdoor attacks on deep neural networks,” in ACM CCS, 2019

    2019

  57. [65]

    Membership privacy in microrna-based studies,

    M. Backes, P. Berrang, M. Humbert, and P. Manoharan, “Membership privacy in microrna-based studies,” in ACM CCS, 2016

    2016

  58. [66]

    A survey on transfer learning,

    S. J. Pan and Q. Yang, “A survey on transfer learning,” IEEE TKDE , 2010

    2010

  59. [67]

    Double-bootstrapping source data selection for instance-based transfer learning,

    D. Lin, X. An, and J. Zhang, “Double-bootstrapping source data selection for instance-based transfer learning,” Pattern Recognition Letters , 2013

    2013

  60. [68]

    Low-dimensional subject representation-based transfer learning in eeg decoding,

    P.-Y . Jeng, C.-S. Wei, T.-P. Jung, and L.-C. Wang, “Low-dimensional subject representation-based transfer learning in eeg decoding,” IEEE Journal of Biomed- ical and Health Informatics , 2020

    2020

  61. [69]

    Relational knowledge transfer for zero-shot learning,

    D. Wang, Y . Li, Y . Lin, and Y . Zhuang, “Relational knowledge transfer for zero-shot learning,” in AAAI, 2016

    2016

  62. [70]

    Manipulating transfer learning for property inference,

    Y . Tian, F. Suya, A. Suri, F. Xu, and D. Evans, “Manipulating transfer learning for property inference,” in CVPR, 2023

    2023

  63. [71]

    Toward robust detection of puppet attacks via characterizing fingertip-touch behaviors,

    C. Wu, K. He, J. Chen, Z. Zhao, and R. Du, “Toward robust detection of puppet attacks via characterizing fingertip-touch behaviors,” IEEE TDSC

  64. [72]

    Rethinking adversarial attacks in reinforcement learning from policy distribution perspective,

    T. Duan, Z. Zhang, Z. Lin, Y . Gao, L. Xiong, Y . Cui, H. Liang, X. Chen, H. Cui, and D. Huang, “Rethinking adversarial attacks in reinforcement learning from policy distribution perspective,” arXiv preprint arXiv:2501.03562 , 2025

    2025 arXiv

  65. [73]

    Vuls- eye: Detect smart contract vulnerabilities via stateful directed graybox fuzzing,

    R. Liang, J. Chen, C. Wu, K. He, Y . Wu, R. Cao, R. Du, Y . Liu, and Z. Zhao, “Vuls- eye: Detect smart contract vulnerabilities via stateful directed graybox fuzzing,” arXiv preprint arXiv:2408.10116 , 2024

    2024 arXiv

  66. [74]

    Wafbooster: automatic boosting of waf security against mutated malicious payloads,

    C. Wu, J. Chen, S. Zhu, W. Feng, K. He, R. Du, and Y . Xiang, “Wafbooster: automatic boosting of waf security against mutated malicious payloads,” IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  67. [75]

    Ponziguard: Detecting ponzi schemes on ethereum with contract runtime behavior graph (crbg),

    R. Liang, J. Chen, K. He, Y . Wu, G. Deng, R. Du, and C. Wu, “Ponziguard: Detecting ponzi schemes on ethereum with contract runtime behavior graph (crbg),” in Proceedings of the 46th IEEE/ACM International Conference on Software Engineering, 2024

    2024

  68. [76]

    Pushing large language models to the 6g edge: Vision, challenges, and opportunities,

    Z. Lin, G. Qu, Q. Chen, X. Chen, Z. Chen, and K. Huang, “Pushing large language models to the 6g edge: Vision, challenges, and opportunities,” arXiv preprint arXiv:2309.16739, 2023

    2023 arXiv

  69. [77]

    Semantic sleuth: Identifying ponzi contracts via large language models,

    C. Wu, J. Chen, Z. Wang, R. Liang, and R. Du, “Semantic sleuth: Identifying ponzi contracts via large language models,” in Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering , 2024, pp. 582–593

    2024

  70. [78]

    Splitlora: A split parameter-efficient fine-tuning framework for large language models,

    Z. Lin, X. Hu, Y . Zhang, Z. Chen, Z. Fang, X. Chen, A. Li, P. Vepakomma, and Y . Gao, “Splitlora: A split parameter-efficient fine-tuning framework for large language models,” arXiv preprint arXiv:2407.00952 , 2024

    2024 arXiv

  71. [79]

    Automated federated pipeline for parameter-efficient fine-tuning of large language models,

    Z. Fang, Z. Lin, Z. Chen, X. Chen, Y . Gao, and Y . Fang, “Automated federated pipeline for parameter-efficient fine-tuning of large language models,” arXiv preprint arXiv:2404.06448, 2024

    2024 arXiv

  72. [80]

    On the effectiveness of distillation in mitigating backdoors in pre-trained encoder,

    T. Han, S. Huang, Z. Ding, W. Sun, Y . Feng, C. Fang, J. Li, H. Qian, C. Wu, Q. Zhang et al. , “On the effectiveness of distillation in mitigating backdoors in pre-trained encoder,” arXiv preprint arXiv:2403.03846 , 2024

    2024

  73. [81]

    Adaptsfl: Adaptive split federated learning in resource-constrained edge networks,

    Z. Lin, G. Qu, W. Wei, X. Chen, and K. K. Leung, “Adaptsfl: Adaptive split federated learning in resource-constrained edge networks,” arXiv preprint arXiv:2403.13101, 2024

    2024 arXiv

  74. [82]

    Optimal resource allocation for u-shaped parallel split learning,

    S. Lyu, Z. Lin, G. Qu, X. Chen, X. Huang, and P. Li, “Optimal resource allocation for u-shaped parallel split learning,” in 2023 IEEE Globecom Workshops (GC Wkshps), 2023, pp. 197–202

    2023

  75. [83]

    Leo- split: A semi-supervised split learning framework over leo satellite networks,

    Z. Lin, Y . Zhang, Z. Chen, Z. Fang, C. Wu, X. Chen, Y . Gao, and J. Luo, “Leo- split: A semi-supervised split learning framework over leo satellite networks,”arXiv preprint arXiv:2501.01293, 2025

    2025 arXiv

  76. [84]

    An efficient privacy-aware split learning framework for satellite communications,

    J. Sun, C. Wu, S. Mumtaz, J. Tao, M. Cao, M. Wang, and V . Frascolla, “An efficient privacy-aware split learning framework for satellite communications,”IEEE Journal on Selected Areas in Communications , 2024

    2024

  77. [85]

    Split learning in 6g edge networks,

    Z. Lin, G. Qu, X. Chen, and K. Huang, “Split learning in 6g edge networks,” IEEE Wireless Communications, 2024

    2024

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.