* Hahne et al. (2008) Florian Hahne, Wolfgang Huber, Robert Gentleman, Seth Falcon, R Gentleman, and VJ Carey. 2008\.  Unsupervised machine learning.  _Bioconductor case studies_ (2008), 137–157.
  * Han et al. (2018) Changhee Han, Hideaki Hayashi, Leonardo Rundo, Ryosuke Araki, Wataru Shimoda, Shinichi Muramatsu, Yujiro Furukawa, Giancarlo Mauri, and Hideki Nakayama. 2018.  GAN-based synthetic brain MR image generation. In _2018 IEEE 15th international symposium on biomedical imaging (ISBI 2018)_. IEEE, 734–738.
  * Hassanzadeh and Tillman (2022) Parisa Hassanzadeh and Robert E Tillman. 2022.  Generative Models with Information-Theoretic Protection Against Membership Inference Attacks.  _arXiv preprint arXiv:2206.00071_ (2022).
  * Hayes et al. (2017) Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. 2017.  Logan: Membership inference attacks against generative models.  _arXiv preprint arXiv:1705.07663_ (2017).
  * Hilprecht et al. (2019) Benjamin Hilprecht, Martin Härterich, and Daniel Bernau. 2019\.  Monte Carlo and Reconstruction Membership Inference Attacks against Generative Models.  _Proc. Priv. Enhancing Technol._ 2019, 4 (2019), 232–249.
  * Hosseini et al. (2017) Hossein Hosseini, Yize Chen, Sreeram Kannan, Baosen Zhang, and Radha Poovendran. 2017.  Blocking transferability of adversarial examples in black-box learning systems.  _arXiv preprint arXiv:1703.04318_ (2017).
  * Hu et al. (2021) Aoting Hu, Renjie Xie, Zhigang Lu, Aiqun Hu, and Minhui Xue. 2021.  TableGAN-MCA: Evaluating Membership Collisions of GAN-Synthesized Tabular Data Releasing. In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_. 2096–2112.
  * Hu and Pang (2021) Hailong Hu and Jun Pang. 2021.  Model Extraction and Defenses on Generative Adversarial Networks.  _arXiv preprint arXiv:2101.02069_ (2021).
  * Ivarsson and Gorschek (2011) Martin Ivarsson and Tony Gorschek. 2011.  A method for evaluating rigor and industrial relevance of technology evaluations.  _Empirical Software Engineering_ 16, 3 (2011), 365–395.
  * Jia and Gong (2018) Jinyuan Jia and Neil Zhenqiang Gong. 2018.  Attriguard: A practical defense against attribute inference attacks via adversarial machine learning. In _27th $\\{$USENIX$\\}$ security symposium ($\\{$USENIX$\\}$ security 18)_. 513–529.
  * Jia et al. (2019) Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong. 2019.  Memguard: Defending against black-box membership inference attacks via adversarial examples. In _Proceedings of the 2019 ACM SIGSAC conference on computer and communications security_. 259–274.
  * Jin and Li (2022) Ruinan Jin and Xiaoxiao Li. 2022.  Backdoor Attack is a Devil in Federated GAN-Based Medical Image Synthesis. In _International Workshop on Simulation and Synthesis in Medical Imaging_. Springer, 154–165.
  * Jordon et al. (2018) James Jordon, Jinsung Yoon, and Mihaela Van Der Schaar. 2018\.  PATE-GAN: Generating synthetic data with differential privacy guarantees. In _International conference on learning representations_.
  * Juuti et al. (2019) Mika Juuti, Sebastian Szyller, Samuel Marchal, and N Asokan. 2019.  PRADA: protecting against DNN model stealing attacks. In _2019 IEEE European Symposium on Security and Privacy (EuroS &P)_. IEEE, 512–527.
  * Keele et al. (2007) Staffs Keele et al. 2007\.  _Guidelines for performing systematic literature reviews in software engineering_.  Technical Report. Technical report, ver. 2.3 ebse technical report. ebse.
  * Kim et al. (2020) Byeong Cheon Kim, Jung Uk Kim, Hakmin Lee, and Yong Man Ro. 2020\.  Revisiting role of autoencoders in adversarial settings. In _2020 IEEE International Conference on Image Processing (ICIP)_. IEEE, 1856–1860.
  * Kingma et al. (2019) Diederik P Kingma, Max Welling, et al. 2019\.  An introduction to variational autoencoders.  _Foundations and Trends® in Machine Learning_ 12, 4 (2019), 307–392.
  * Kitchenham et al. (2015) Barbara Ann Kitchenham, David Budgen, and Pearl Brereton. 2015\.  _Evidence-based software engineering and systematic reviews_. Vol. 4.  CRC press.
  * Kos et al. (2018) Jernej Kos, Ian Fischer, and Dawn Song. 2018.  Adversarial examples for generative models. In _2018 ieee security and privacy workshops (spw)_. IEEE, 36–42.
  * Kossen et al. (2022) Tabea Kossen, Manuel A Hirzel, Vince I Madai, Franziska Boenisch, Anja Hennemuth, Kristian Hildebrand, Sebastian Pokutta, Kartikey Sharma, Adam Hilbert, Jan Sobesky, et al. 2022\.  Toward Sharing Brain Images: Differentially Private TOF-MRA Images With Segmentation Labels Using Generative Adversarial Networks.  _Frontiers in artificial intelligence_ 5 (2022).
  * Kunar et al. (2021) Aditya Kunar, Robert Birke, Zilong Zhao, and Lydia Chen. 2021\.  DTGAN: Differential Private Training for Tabular GANs.  _arXiv preprint arXiv:2107.02521_ (2021).
  * Kusner et al. (2015) Matt Kusner, Jacob Gardner, Roman Garnett, and Kilian Weinberger. 2015.  Differentially private Bayesian optimization. In _International conference on machine learning_. PMLR, 918–927.
  * Kuzina et al. (2021) Anna Kuzina, Max Welling, and Jakub M Tomczak. 2021.  Diagnosing vulnerability of variational auto-encoders to adversarial attacks.  _arXiv preprint arXiv:2103.06701_ (2021).
  * Kuzina et al. (2022) Anna Kuzina, Max Welling, and Jakub M Tomczak. 2022.  Defending Variational Autoencoders from Adversarial Attacks with MCMC.  _arXiv preprint arXiv:2203.09940_ (2022).
  * Lin et al. (2020) Zinan Lin, Alankar Jain, Chen Wang, Giulia Fanti, and Vyas Sekar. 2020.  Using GANs for sharing networked time series data: Challenges, initial promise, and open questions. In _Proceedings of the ACM Internet Measurement Conference_. 464–483.
  * Lin et al. (2021) Zinan Lin, Vyas Sekar, and Giulia Fanti. 2021.  On the privacy properties of gan-generated samples. In _International Conference on Artificial Intelligence and Statistics_. PMLR, 1522–1530.
  * Liu et al. (2017b) Chang Liu, Bo Li, Yevgeniy Vorobeychik, and Alina Oprea. 2017b.  Robust linear regression against training data poisoning. In _Proceedings of the 10th ACM workshop on artificial intelligence and security_. 91–102.
  * Liu et al. (2017a) Jian Liu, Mika Juuti, Yao Lu, and Nadarajah Asokan. 2017a.  Oblivious neural network predictions via minionn transformations. In _Proceedings of the 2017 ACM SIGSAC conference on computer and communications security_. 619–631.
  * Liu et al. (2018) Qiang Liu, Pan Li, Wentao Zhao, Wei Cai, Shui Yu, and Victor CM Leung. 2018\.  A survey on security threats and defensive techniques of machine learning: A data driven view.  _IEEE access_ 6 (2018), 12103–12117.
  * Liu and Hsieh (2019) Xuanqing Liu and Cho-Jui Hsieh. 2019.  Rob-gan: Generator, discriminator, and adversarial attacker. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 11234–11243.
  * Liu et al. (2019b) Xuanqing Liu, Si Si, Xiaojin Zhu, Yang Li, and Cho-Jui Hsieh. 2019b.  A unified framework for data poisoning attack to graph-based semi-supervised learning.  _arXiv preprint arXiv:1910.14147_ (2019).
  * Liu et al. (2019c) Xing Liu, Hansong Xu, Weixian Liao, and Wei Yu. 2019c.  Reinforcement learning for cyber-physical systems. In _2019 IEEE International Conference on Industrial Internet (ICII)_. IEEE, 318–327.
  * Liu et al. (2019a) Yi Liu, Jialiang Peng, JQ James, and Yi Wu. 2019a.  PPGAN: Privacy-preserving generative adversarial network. In _2019 IEEE 25Th international conference on parallel and distributed systems (ICPADS)_. IEEE, 985–989.
  * Long et al. (2021) Yunhui Long, Boxin Wang, Zhuolin Yang, Bhavya Kailkhura, Aston Zhang, Carl Gunter, and Bo Li. 2021.  G-PATE: Scalable Differentially Private Data Generator via Private Aggregation of Teacher Discriminators.  _Advances in Neural Information Processing Systems_ 34 (2021), 2965–2977.
  * Martins et al. (2020) Nuno Martins, José Magalhães Cruz, Tiago Cruz, and Pedro Henriques Abreu. 2020\.  Adversarial machine learning applied to intrusion and malware scenarios: a systematic review.  _IEEE Access_ 8 (2020), 35403–35419.
  * McMahan et al. (2017) Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017\.  Communication-efficient learning of deep networks from decentralized data. In _Artificial intelligence and statistics_. PMLR, 1273–1282.
  * Meng and Chen (2017) Dongyu Meng and Hao Chen. 2017.  Magnet: a two-pronged defense against adversarial examples. In _Proceedings of the 2017 ACM SIGSAC conference on computer and communications security_. 135–147.
  * Mukherjee et al. (2021) Sumit Mukherjee, Yixi Xu, Anusua Trivedi, Nabajyoti Patowary, and Juan Lavista Ferres. 2021.  privGAN: Protecting GANs from membership inference attacks at low cost to utility.  _Proc. Priv. Enhancing Technol._ 2021, 3 (2021), 142–163.
  * Nasr et al. (2018) Milad Nasr, Reza Shokri, and Amir Houmansadr. 2018.  Machine learning with membership privacy using adversarial regularization. In _Proceedings of the 2018 ACM SIGSAC conference on computer and communications security_. 634–646.
  * Nelson et al. (2009) Blaine Nelson, Marco Barreno, Fuching Jack Chi, Anthony D Joseph, Benjamin IP Rubinstein, Udam Saini, Charles Sutton, JD Tygar, and Kai Xia. 2009.  Misleading learners: Co-opting your spam filter.  _Machine learning in cyber trust: Security, privacy, and reliability_ (2009), 17–51.
  * Nkashama et al. (2022) D Nkashama, Arian Soltani, Jean-Charles Verdier, Marc Frappier, Pierre-Marting Tardif, and Froduald Kabanza. 2022.  Robustness Evaluation of Deep Unsupervised Learning Algorithms for Intrusion Detection Systems.  _arXiv preprint arXiv:2207.03576_ (2022).
  * Oleszkiewicz et al. (2018) Witold Oleszkiewicz, Peter Kairouz, Karol Piczak, Ram Rajagopal, and Tomasz Trzciński. 2018\.  Siamese generative adversarial privatizer for biometric data. In _Asian Conference on Computer Vision_. Springer, 482–497.
  * Orekondy et al. (2020) Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2020\.  Prediction poisoning: Utility-constrained defenses against model stealing attacks. In _International Conference on Representation Learning (ICLR) 2020_.
  * Osia et al. (2020) Seyed Ali Osia, Ali Shahin Shamsabadi, Sina Sajadmanesh, Ali Taheri, Kleomenis Katevas, Hamid R Rabiee, Nicholas D Lane, and Hamed Haddadi. 2020.  A hybrid deep learning architecture for privacy-preserving mobile analytics.  _IEEE Internet of Things Journal_ 7, 5 (2020), 4505–4518.
  * Papernot et al. (2016a) Nicolas Papernot, Martín Abadi, Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar. 2016a.  Semi-supervised knowledge transfer for deep learning from private training data.  _arXiv preprint arXiv:1610.05755_ (2016).
  * Papernot et al. (2017) Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. 2017\.  Practical black-box attacks against machine learning. In _Proceedings of the 2017 ACM on Asia conference on computer and communications security_. 506–519.
  * Papernot et al. (2016b) Nicolas Papernot, Patrick McDaniel, Arunesh Sinha, and Michael Wellman. 2016b.  Towards the science of security and privacy in machine learning.  _arXiv preprint arXiv:1611.03814_ (2016).
  * Papernot et al. (2016c) Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. 2016c.  Distillation as a defense to adversarial perturbations against deep neural networks. In _2016 IEEE symposium on security and privacy (SP)_. IEEE, 582–597.
  * Peña et al. (2014) José M Peña, Pedro A Gutiérrez, César Hervás-Martínez, Johan Six, Richard E Plant, and Francisca López-Granados. 2014.  Object-based image classification of summer crops with machine learning methods.  _Remote sensing_ 6, 6 (2014), 5019–5041.
  * Petticrew and Roberts (2008) Mark Petticrew and Helen Roberts. 2008.  _Systematic reviews in the social sciences: A practical guide_.  John Wiley & Sons.
  * Phan et al. (2016) NhatHai Phan, Yue Wang, Xintao Wu, and Dejing Dou. 2016\.  Differential privacy preservation for deep auto-encoders: an application of human behavior prediction. In _Thirtieth AAAI Conference on Artificial Intelligence_.
  * Phan et al. (2017) NhatHai Phan, Xintao Wu, Han Hu, and Dejing Dou. 2017\.  Adaptive laplace mechanism: Differential privacy preservation in deep learning. In _2017 IEEE international conference on data mining (ICDM)_. IEEE, 385–394.
  * Pinaya et al. (2020) Walter Hugo Lopez Pinaya, Sandra Vieira, Rafael Garcia-Dias, and Andrea Mechelli. 2020.  Autoencoders.  In _Machine learning_. Elsevier, 193–208.
  * Rajotte and Ng (2020) Jean-Francois Rajotte and Raymond T Ng. 2020.  Private data sharing between decentralized users through the privGAN architecture. In _2020 IEEE 24th International Enterprise Distributed Object Computing Workshop (EDOCW)_. IEEE, 37–42.
  * Rani et al. (2023) Geeta Rani, Upasana Pandey, Aniket Anil Wagde, and Vijaypal Singh Dhaka. 2023.  A deep reinforcement learning technique for bug detection in video games.  _International Journal of Information Technology_ 15, 1 (2023), 355–367.
  * Rawat et al. (2021) Ambrish Rawat, Killian Levacher, and Mathieu Sinn. 2021\.  The Devil is in the GAN: Defending Deep Generative Models Against Backdoor Attacks.  _arXiv preprint arXiv:2108.01644_ (2021).
  * Rivest et al. (1978) Ronald L Rivest, Len Adleman, Michael L Dertouzos, et al. 1978\.  On data banks and privacy homomorphisms.  _Foundations of secure computation_ 4, 11 (1978), 169–180.
  * Rocco (2021) Fabrizio Rocco. 2021\.  Deepfake generation: evaluating state of the art generative networks.  (2021).
  * Rösner and Schmidt (2018) Clemens Rösner and Melanie Schmidt. 2018.  Privacy preserving clustering with constraints.  _arXiv preprint arXiv:1802.02497_ (2018).
  * Sabottke et al. (2019) Carl Sabottke, Daniel Chen, Lucas Layman, and Tudor Dumitraş. 2019.  How to trick the Borg: threat models against manual and automated techniques for detecting network attacks.  _Computers & Security_ 81 (2019), 25–40.
  * Sadeghi and Larsson (2019) Meysam Sadeghi and Erik G Larsson. 2019.  Physical adversarial attacks against end-to-end autoencoder communication systems.  _IEEE Communications Letters_ 23, 5 (2019), 847–850.
  * Sajeeda and Hossain (2022) Afia Sajeeda and BM Mainul Hossain. 2022.  Exploring Generative Adversarial Networks and Adversarial Training.  _International Journal of Cognitive Computing in Engineering_ (2022).
  * Salem et al. (2020) Ahmed Salem, Yannick Sautter, Michael Backes, Mathias Humbert, and Yang Zhang. 2020\.  Baaan: Backdoor attacks against autoencoder and gan-based machine learning models.  _arXiv preprint arXiv:2010.03007_ (2020).
  * Salem et al. (2018) Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2018\.  Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models.  _arXiv preprint arXiv:1806.01246_ (2018).
  * Sankaranarayanan et al. (2018) Swami Sankaranarayanan, Arpit Jain, Rama Chellappa, and Ser Nam Lim. 2018.  Regularizing deep networks using efficient layerwise adversarial training. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 32.
  * Sengupta et al. (2018) Sailik Sengupta, Tathagata Chakraborti, and Subbarao Kambhampati. 2018\.  Mtdeep: boosting the security of deep neural nets against adversarial attacks with moving target defense. In _Workshops at the thirty-second AAAI conference on artificial intelligence_.
  * Shi et al. (2020) Yi Shi, Yalin E Sagduyu, and Tugba Erpek. 2020.  Reinforcement learning for dynamic resource optimization in 5G radio access network slicing. In _2020 IEEE 25th international workshop on computer aided modeling and design of communication links and networks (CAMAD)_. IEEE, 1–6.
  * Shokri and Shmatikov (2015) Reza Shokri and Vitaly Shmatikov. 2015.  Privacy-preserving deep learning. In _Proceedings of the 22nd ACM SIGSAC conference on computer and communications security_. 1310–1321.
  * Srivastava et al. (2015) Nitish Srivastava, Elman Mansimov, and Ruslan Salakhudinov. 2015\.  Unsupervised learning of video representations using lstms. In _International conference on machine learning_. PMLR, 843–852.
  * Sum Liu et al. (2018) Kin Sum Liu, Chaowei Xiao, Bo Li, and Jie Gao. 2018\.  Performing Co-Membership Attacks Against Deep Generative Models.  _arXiv e-prints_ (2018), arXiv–1805.
  * Sumedha and Weigt (2008) M Leone Sumedha and Martin Weigt. 2008.  Unsupervised and semi-supervised clustering by message passing: soft-constraint affinity propagation.  _The European Physical Journal B_ 66 (2008), 125–135.
  * Sun et al. (2020) Chengjin Sun, Sizhe Chen, and Xiaolin Huang. 2020.  Double backpropagation for training autoencoders against adversarial attack.  _arXiv preprint arXiv:2003.01895_ (2020).
  * Sun et al. (2021) Hui Sun, Tianqing Zhu, Zhiqiu Zhang, Dawei Jin Xiong, Wanlei Zhou, et al. 2021\.  Adversarial Attacks Against Deep Generative Models on Data: A Survey.  _arXiv preprint arXiv:2112.00247_ (2021).
  * Tabacof et al. (2016) Pedro Tabacof, Julia Tavares, and Eduardo Valle. 2016\.  Adversarial images for variational autoencoders.  _arXiv preprint arXiv:1612.00155_ (2016).
  * Tantipongpipat et al. (2021) Uthaipon Tao Tantipongpipat, Chris Waites, Digvijay Boob, Amaresh Ankit Siva, and Rachel Cummings. 2021.  Differentially private synthetic mixed-type data generation for unsupervised learning. In _2021 12th International Conference on Information, Intelligence, Systems & Applications (IISA)_. IEEE, 1–9.
  * Tinsley et al. (2021) Patrick Tinsley, Adam Czajka, and Patrick Flynn. 2021\.  This face does not exist… but it might be yours! identity leakage in generative models. In _Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision_. 1320–1328.
  * Torfi et al. (2022) Amirsina Torfi, Edward A Fox, and Chandan K Reddy. 2022\.  Differentially private synthetic medical data generation using convolutional gans.  _Information Sciences_ 586 (2022), 485–500.
  * Tramèr et al. (2017) Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. 2017.  Ensemble adversarial training: Attacks and defenses.  _arXiv preprint arXiv:1705.07204_ (2017).
  * Walker and Myrick (2006) Diane Walker and Florence Myrick. 2006.  Grounded theory: An exploration of process and procedure.  _Qualitative health research_ 16, 4 (2006), 547–559.
  * Wang et al. (2017) Kunfeng Wang, Chao Gou, Yanjie Duan, Yilun Lin, Xinhu Zheng, and Fei-Yue Wang. 2017\.  Generative adversarial networks: introduction and outlook.  _IEEE/CAA Journal of Automatica Sinica_ 4, 4 (2017), 588–598.
  * Warrens (2015) Matthijs J Warrens. 2015\.  Five ways to look at Cohen’s kappa.  _Journal of Psychology & Psychotherapy_ 5, 4 (2015), 1\.
  * Willetts et al. (2019) Matthew Willetts, Alexander Camuto, Tom Rainforth, Stephen Roberts, and Chris Holmes. 2019\.  Improving VAEs’ Robustness to Adversarial Attack.  _arXiv preprint arXiv:1906.00230_ (2019).
  * Wu and He (2021) Jun Wu and Jingrui He. 2021\.  Indirect Invisible Poisoning Attacks on Domain Adaptation. In _Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining_. 1852–1862.
  * Xie et al. (2018) Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. 2018.  Differentially private generative adversarial network.  _arXiv preprint arXiv:1802.06739_ (2018).
  * Xu et al. (2019) Chugui Xu, Ju Ren, Deyu Zhang, Yaoxue Zhang, Zhan Qin, and Kui Ren. 2019\.  GANobfuscator: Mitigating information leakage under GAN via differential privacy.  _IEEE Transactions on Information Forensics and Security_ 14, 9 (2019), 2358–2371.
  * Xu et al. (2017) Weilin Xu, David Evans, and Yanjun Qi. 2017.  Feature squeezing: Detecting adversarial examples in deep neural networks.  _arXiv preprint arXiv:1704.01155_ (2017).
  * Yang et al. (2020) Xu Yang, Cheng Deng, Kun Wei, Junchi Yan, and Wei Liu. 2020.  Adversarial learning for robust deep clustering.  _Advances in Neural Information Processing Systems_ 33 (2020), 9098–9108.
  * Yao et al. (2017) YC Yao, L Song, and E Chi. 2017.  Investigation on distributed K-means clustering algorithm of homomorphic encryption.  _Comput. Technol. Develop._ 2 (2017), 81–85.
  * Yue et al. (2021) Jiutao Yue, Haofeng Li, Pengxu Wei, Guanbin Li, and Liang Lin. 2021.  Robust real-world image super-resolution against adversarial attacks. In _Proceedings of the 29th ACM International Conference on Multimedia_. 5148–5157.
  * Zhang et al. (2019) Jiale Zhang, Junjun Chen, Di Wu, Bing Chen, and Shui Yu. 2019.  Poisoning attack in federated learning using generative adversarial nets. In _2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)_. IEEE, 374–380.
  * Zhang et al. (2020) Jiliang Zhang, Chen Li, Jing Ye, and Gang Qu. 2020\.  Privacy threats and protection in machine learning. In _Proceedings of the 2020 on Great Lakes Symposium on VLSI_. 531–536.
  * Zhang et al. (2021) Longling Zhang, Bochen Shen, Ahmed Barnawi, Shan Xi, Neeraj Kumar, and Yi Wu. 2021\.  FedDPGAN: federated differentially private generative adversarial networks framework for the detection of COVID-19 pneumonia.  _Information Systems Frontiers_ 23, 6 (2021), 1403–1415.
  * Zhang et al. (2015) Qingchen Zhang, Laurence T Yang, and Zhikui Chen. 2015.  Privacy preserving deep computation model on cloud for big data feature learning.  _IEEE Trans. Comput._ 65, 5 (2015), 1351–1362.
  * Zhang et al. (2018) Xinyang Zhang, Shouling Ji, and Ting Wang. 2018.  Differentially private releasing via deep generative model (technical report).  _arXiv preprint arXiv:1801.01594_ (2018).
  * Zhou et al. (2021) Junhao Zhou, Yufei Chen, Chao Shen, and Yang Zhang. 2021\.  Property Inference Attacks Against GANs.  _arXiv preprint arXiv:2111.07608_ (2021).

##  Appendix A SLR details

The questions for the QA:

  * •

Are the objectives, research questions, and hypotheses (if applicable), clear
and relevant?

  * •

Are the case and its units of analysis well defined?

  * •

Is the suitability of the case to address the research questions clearly
motivated?

  * •

Are the data collection procedures sufficient for the purpose of the case
study (data sources, collection, validation)?

  * •

Is sufficient raw data presented to provide understanding of the case and the
analysis?

  * •

Are the analysis procedures sufficient for the purpose of the case study
(repeatable, transparent)?

  * •

Is a clear chain of evidence established from observations to conclusions?

  * •

Are threats to validity analyses conducted in a systematic way, and are
countermeasures taken to reduce threats?

  * •

Is triangulation applied (multiple collection and analysis methods, multiple
authors, multiple theories)?

  * •

Are ethical issues properly addressed (personal intentions, integrity,
confidentiality, consent, review board approval)?

  * •

Are conclusions, implications for practice, and future research, suitably
reported for its audience?

The full name for the abbreviated journals and conferences.

  * •

ACM workshop on Artificial intelligence and security (AISec)

  * •

Circulation

  * •

IEEE Communications Letters (IEEE COMML)

  * •

IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

  * •

International Conference on Artificial Intelligence and Statistics (AISTATS)

  * •

IEEE International Conference on Image Processing (IEEE ICIP)

  * •

IEEE International Conference On Trust, Security And Privacy In Computing and
Communications (TrustCom)

  * •

AAAI Workshop on Privacy-Preserving Artificial Intelligence (PPAI)

  * •

ACM Transactions on Internet Technology (TOIT)

  * •

Computers & Security

  * •

Frontiers in Artificial Intelligence, (Front. Artif. Intell.)

  * •

EAI SecureComm

  * •

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY (TIFS)

  * •

Privacy Enhancing Technologies (PoPETs)

  * •

IEEE International Conference on Informatics, IoT, and Enabling Technologies
(ICIoT)

  * •

IEEE International Conference on Information Reuse and Integration for Data
Science (IEEE IRI)

  * •

IEEE Conference on Network Function Virtualization and Software Defined
Networks (IEEE NFV-SDN)

  * •

IEEE international conference on fuzzy systems (FUZZ-IEEE)

  * •

ACM Internet Measurement Conference (ACM IMC)

  * •

ACM SIGKDD Conference on Knowledge Discovery and Data Mining (ACM SIGKDD)

  * •

International Conference on learning representations (ICLR)

  * •

International Journal of Computer Vision (IJCV)

  * •

Pattern Recognition (Pattern Recognit)

  * •

IEEE Symposium on Security and Privacy Workshops (IEEE SPW)

  * •

Structural, Syntactic, and Statistical Pattern Recognition (S+SSPR)

  * •

ACM SIGSAC conference on computer and communications security (CCS)

  * •

Conference on Neural Information Processing Systems (NeurIPS)

  * •

ACM international conference on Multimedia (ACM MM)

  * •

Electronics

  * •

Information Systems Frontiers (Inf Syst Front)

  * •

International Journal of Cognitive Computing in Engineering (JCCE)

##  Appendix B Code descriptions

###  B.1. Target types

  * •

GAN: ML consisting of two models, a generator, and a discriminator, training
by competing against each other

  * •

AutoEncoder: Neural network which is trained on the input and output being the
same value

  * •

Clustering: Methods using distance functions to determine the size of clusters
of the same groups

  * •

Classification: Here, classification methods are models which have the output
from a UL system as its input

  * •

Super Resolution: ML method for increasing the dimensionality of a sample

###  B.2. Attack types

  * •

Adversarial Examples: Specific perturbation in input to cause disruption

  * •

Poisoning: Modification or addition of specifically crafted training samples

  * •

Membership Inference: Extraction of knowledge about training by using the
output of a model

  * •

Evasion: Attacks crafted to avoid detection techniques

  * •

Obfuscation: Modification of input to be hidden in existing groups or clusters

  * •

Bridging: Addition of crafted samples to bridge between groups or clusters,
causing disruption

  * •

Saturation: Flooding the system with an excess of data

  * •

Model Extraction: Extraction of the model functions and parameters

  * •

Backdoor: Inclusion of a specific trigger in a model causing disruption

  * •

Attribute Inference: Extraction of attributes of training data

  * •

Reconstruction: Extraction of statistical features of the training set for a
model

  * •

Accuracy Extraction: Extraction of a model through comparison to generated
samples

  * •

Fidelity Extraction: Extraction of a model through comparison to training
samples

###  B.3. Metrics

  * •

Accuracy/ F1-Score: Measurement of how many samples were correctly identified

  * •

L2: Measurement of perturbation, by taking the root of all squares of
perturbations in the data

  * •

AUCROC: Measurement of how well a model distinguishes samples, by measuring
true and false positive rates for all thresholds

  * •

L-Infinity: Measurement of perturbation, by taking the largest values among
all perturbations

  * •

False Positive: The number of values measured as positive, while being
negative

  * •

BLER: The rate of erroneous blocks out of all blocks

  * •

True Positive: The number of values measured as positive, while being positive

  * •

Misclassification Score: Measurement of how many classifications are not
correct

  * •

L1: Measurement of perturbation, by taking the sum of all perturbations

  * •

Precision: A measurement of the rate of true positives, out of all measured
positives

  * •

SSIM: A quantification of the perceived quality of an image

  * •

AUCPRC: Measurement of how well a model performs, by measuring precision and
recall over all thresholds

  * •

Recall: A measurement of the rate of true positives, out of all measured true
values

  * •

True Negative: The number of values measured as negative, while being negative

  * •

False Negative: The number of values measured as negative, while being
positive

  * •

Average Precision: Average value of the precision score for all thresholds

  * •

RMSE: The Root Mean Square Error is a measurement of average error in
measurement

  * •

PSNR: Peak Signal to Noise Ratio measures the amount of noise relative to real
data is in a sample

  * •

MSSSIM: Multi Scale Structural Similarity Index Measure uses SSIM on different
scales

  * •

LPIPS: Learned Perceptual Image Patch Similarity measures similarities in
features between generated and original samples

  * •

Jensen-Shannon Divergence: A measurement for determining the similarities
between probability distributions

  * •

SRMSE: Standardised RMSE

  * •

Reconstruction Distance: A measurement for the distance between the original
and generated sample

  * •

Total Variation Distance: Measurement of the distance between variations of
different distributions

  * •

Attack Loss: Measurement of the distance between the latent space distribution
of samples with small distortions

###  B.4. Defenses

  * •

Differential Privacy:  Using mathematical proofs in training to force the
constraint that a single sample cannot be known to be used for training

  * •

Adversarial Training:  The method of using an adversarial method for
constructing samples the model otherwise would be vulnerable to, and
subsequently training using these samples

  * •

Gradient Masking:  A method of obfuscating the gradients of the output of a
model, to prevent useful information from being obtained

  * •

Game Theory:  The employment of defensive methods according to a strategy
using a multitude of parameters

  * •

Differentially Private Stochastic Gradient Descent (DPSGD):  The application
of DP to the training of GANs

  * •

Weight Normalization:  Reparametrization of the weight vectors in an already
existing NN

  * •

Bootstrapping:  The use of existing robust models as the base of training a
model

  * •

Fine Pruning:  The removal of neurons in a NN which does not improve the
performance

  * •

Dropout:  Random removal of neurons during training