* Carlini et al. (2022) Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. 2022\.  Membership inference attacks from first principles. In _2022 IEEE Symposium on Security and Privacy (SP)_. IEEE, 1897–1914.
  * Carlini et al. (2019) Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019.  The secret sharer: Evaluating and testing unintended memorization in neural networks. In _28th USENIX Security Symposium (USENIX Security 19)_. 267–284.
  * Carlini et al. (2021) Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021\.  Extracting training data from large language models. In _30th USENIX Security Symposium (USENIX Security 21)_. 2633–2650.
  * Carlini and Wagner (2017) Nicholas Carlini and David Wagner. 2017.  Towards evaluating the robustness of neural networks. In _2017 ieee symposium on security and privacy (sp)_. IEEE, 39–57.
  * Chaabane et al. (2012) Abdelberi Chaabane, Gergely Acs, Mohamed Ali Kaafar, et al. 2012\.  You are what you like! information leakage through users’ interests. In _Proceedings of the 19th annual network & distributed system security symposium (NDSS)_. Citeseer.
  * Chandrasekaran et al. (2020) Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan. 2020\.  Exploring connections between active learning and model extraction. In _29th USENIX Security Symposium (USENIX Security 20)_. 1309–1326.
  * Chen et al. (2020b) Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. 2020b.  Gan-leaks: A taxonomy of membership inference attacks against generative models. In _Proceedings of the 2020 ACM SIGSAC conference on computer and communications security_. 343–362.
  * Chen et al. (2021) Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. 2021\.  When machine unlearning jeopardizes privacy. In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_. 896–911.
  * Chen et al. (2020a) Si Chen, Ruoxi Jia, and Guo-Jun Qi. 2020a.  Improved techniques for model inversion attacks.  (2020).
  * Choi et al. (2017) Edward Choi, Siddharth Biswal, Bradley Malin, Jon Duke, Walter F Stewart, and Jimeng Sun. 2017\.  Generating multi-label discrete patient records using generative adversarial networks. In _Machine learning for healthcare conference_. PMLR, 286–305.
  * Choquette-Choo et al. (2021) Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. 2021.  Label-only membership inference attacks. In _International Conference on Machine Learning_. PMLR, 1964–1974.
  * Conti et al. (2022) Mauro Conti, Jiaxin Li, Stjepan Picek, and Jing Xu. 2022\.  Label-Only Membership Inference Attack against Node-Level Graph Neural Networks. In _Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security_. 1–12.
  * Creţu et al. (2021) Ana-Maria Creţu, Florent Guépin, and Yves-Alexandre de Montjoye. 2021.  Dataset correlation inference attacks against machine learning models.  _arXiv preprint arXiv:2112.08806_ (2021).
  * Cretu et al. (2022) Ana-Maria Cretu, Florimond Houssiau, Antoine Cully, and Yves-Alexandre de Montjoye. 2022\.  QuerySnout: Automating the Discovery of Attribute Inference Attacks against Query-Based Systems. In _Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security_. 623–637.
  * Del Grosso et al. (2022) Ganesh Del Grosso, Hamid Jalalzai, Georg Pichler, Catuscia Palamidessi, and Pablo Piantanida. 2022\.  Leveraging Adversarial Examples to Quantify Membership Information Leakage. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 10399–10409.
  * Devakumar et al. (2020) Delan Devakumar, Geordan Shannon, Sunil S Bhopal, and Ibrahim Abubakar. 2020.  Racism and discrimination in COVID-19 responses.  _The Lancet_ 395, 10231 (2020), 1194.
  * Ducas and Micciancio (2015) Léo Ducas and Daniele Micciancio. 2015.  FHEW: bootstrapping homomorphic encryption in less than a second. In _Annual international conference on the theory and applications of cryptographic techniques_. Springer, 617–640.
  * Duddu et al. (2020) Vasisht Duddu, Antoine Boutet, and Virat Shejwalkar. 2020\.  Quantifying privacy leakage in graph embedding. In _Mobiquitous 2020-17th EAI International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services_. 76–85.
  * Duddu et al. (2018) Vasisht Duddu, Debasis Samanta, D Vijay Rao, and Valentina E Balas. 2018.  Stealing neural networks via timing side channels.  _arXiv preprint arXiv:1812.11720_ (2018).
  * Dwork et al. (2014) Cynthia Dwork, Aaron Roth, et al. 2014\.  The algorithmic foundations of differential privacy.  _Foundations and Trends® in Theoretical Computer Science_ 9, 3–4 (2014), 211–407.
  * Feng et al. (2021) Tiantian Feng, Hanieh Hashemi, Rajat Hebbar, Murali Annavaram, and Shrikanth S Narayanan. 2021\.  Attribute inference attack of speech emotion recognition in federated learning settings.  _arXiv preprint arXiv:2112.13416_ (2021).
  * Fredrikson et al. (2015) Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. 2015\.  Model inversion attacks that exploit confidence information and basic countermeasures. In _Proceedings of the 22nd ACM SIGSAC conference on computer and communications security_. 1322–1333.
  * Fredrikson et al. (2014) Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. 2014\.  Privacy in Pharmacogenetics: An $\\{$End-to-End$\\}$ Case Study of Personalized Warfarin Dosing. In _23rd USENIX Security Symposium (USENIX Security 14)_. 17–32.
  * Galbally et al. (2014) Javier Galbally, Sébastien Marcel, and Julian Fierrez. 2014.  Biometric antispoofing methods: A survey in face recognition.  _IEEE Access_ 2 (2014), 1530–1552.
  * Ganju et al. (2018) Karan Ganju, Qi Wang, Wei Yang, Carl A Gunter, and Nikita Borisov. 2018.  Property inference attacks on fully connected neural networks using permutation invariant representations. In _Proceedings of the 2018 ACM SIGSAC conference on computer and communications security_. 619–633.
  * Geiping et al. (2020) Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. 2020.  Inverting gradients-how easy is it to break privacy in federated learning?  _Advances in Neural Information Processing Systems_ 33 (2020), 16937–16947.
  * Gilmer et al. (2019) Justin Gilmer, Nicolas Ford, Nicholas Carlini, and Ekin Cubuk. 2019.  Adversarial examples are a natural consequence of test error in noise. In _International Conference on Machine Learning_. PMLR, 2280–2289.
  * Gong and Liu (2016) Neil Zhenqiang Gong and Bin Liu. 2016.  You are who you know and how you behave: Attribute inference attacks via users’ social friends and behaviors. In _25th USENIX Security Symposium (USENIX Security 16)_. 979–995.
  * Gong and Liu (2018) Neil Zhenqiang Gong and Bin Liu. 2018.  Attribute inference attacks in online social networks.  _ACM Transactions on Privacy and Security (TOPS)_ 21, 1 (2018), 1–30.
  * Goodfellow et al. (2014a) Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014a.  Generative Adversarial Networks.  https://doi.org/10.48550/ARXIV.1406.2661
  * Goodfellow et al. (2014b) Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014b.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ (2014).
  * Gopinath et al. (2019) Divya Gopinath, Hayes Converse, Corina Pasareanu, and Ankur Taly. 2019.  Property inference for deep neural networks. In _2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)_. IEEE, 797–809.
  * Guo et al. (2019) Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. 2019.  Certified data removal from machine learning models.  _arXiv preprint arXiv:1911.03030_ (2019).
  * Gupta et al. (2021) Umang Gupta, Dimitris Stripelis, Pradeep K Lam, Paul Thompson, José Luis Ambite, and Greg Ver Steeg. 2021.  Membership inference attacks on deep regression models for neuroimaging. In _Medical Imaging with Deep Learning_. PMLR, 228–251.
  * Halevi and Shoup (2020) Shai Halevi and Victor Shoup. 2020.  Design and implementation of HElib: a homomorphic encryption library.  _Cryptology ePrint Archive_ (2020).
  * Hamilton et al. (2017) Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017\.  Inductive representation learning on large graphs.  _Advances in neural information processing systems_ 30 (2017).
  * Hamm et al. (2016) Jihun Hamm, Yingjun Cao, and Mikhail Belkin. 2016.  Learning privately from multiparty data. In _International Conference on Machine Learning_. PMLR, 555–563.
  * Hatamizadeh et al. (2022) Ali Hatamizadeh, Hongxu Yin, Holger R Roth, Wenqi Li, Jan Kautz, Daguang Xu, and Pavlo Molchanov. 2022.  Gradvit: Gradient inversion of vision transformers. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 10021–10030.
  * Hayes et al. (2017) Jamie Hayes, Luca Melis, George Danezis, and ED Cristofaro. 2017\.  Logan: Evaluating information leakage of generative models using generative adversarial networks.  _arXiv preprint arXiv:1705.07663_ (2017).
  * Hayes et al. (2019) Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. 2019.  Logan: Membership inference attacks against generative models. In _Proceedings on Privacy Enhancing Technologies (PoPETs)_ , Vol. 2019. De Gruyter, 133–152.
  * He et al. (2006) Jianming He, Wesley W Chu, and Zhenyu Victor Liu. 2006\.  Inferring privacy information from social networks. In _International Conference on Intelligence and Security Informatics_. Springer, 154–165.
  * He et al. (2021) Xinlei He, Jinyuan Jia, Michael Backes, Neil Zhenqiang Gong, and Yang Zhang. 2021.  Stealing links from graph neural networks. In _30th USENIX Security Symposium (USENIX Security 21)_. 2669–2686.
  * He et al. (2022) Xinlei He, Hongbin Liu, Neil Zhenqiang Gong, and Yang Zhang. 2022\.  Semi-Leak: Membership Inference Attacks Against Semi-supervised Learning. In _European Conference on Computer Vision_. Springer, 365–381.
  * He et al. (2019) Zecheng He, Tianwei Zhang, and Ruby B Lee. 2019.  Model inversion attacks against collaborative inference. In _Proceedings of the 35th Annual Computer Security Applications Conference_. 148–162.
  * He et al. (2020) Zecheng He, Tianwei Zhang, and Ruby B Lee. 2020.  Attacking and protecting data privacy in edge–cloud collaborative inference systems.  _IEEE Internet of Things Journal_ 8, 12 (2020), 9706–9716.
  * Hernández-Cano et al. (2021) Alejandro Hernández-Cano, Rosario Cammarota, and Mohsen Imani. 2021\.  Prid: Model inversion privacy attacks in hyperdimensional learning systems. In _2021 58th ACM/IEEE Design Automation Conference (DAC)_. IEEE, 553–558.
  * Hesamifard et al. (2018) Ehsan Hesamifard, Hassan Takabi, Mehdi Ghasemi, and Rebecca N Wright. 2018.  Privacy-preserving machine learning as a service.  _Proc. Priv. Enhancing Technol._ 2018, 3 (2018), 123–142.
  * Hidano et al. (2017) Seira Hidano, Takao Murakami, Shuichi Katsumata, Shinsaku Kiyomoto, and Goichiro Hanaoka. 2017\.  Model inversion attacks for prediction systems: Without knowledge of non-sensitive attributes. In _2017 15th Annual Conference on Privacy, Security and Trust (PST)_. IEEE, 115–11509.
  * Hidano et al. (2021) Seira Hidano, Takao Murakami, and Yusuke Kawamoto. 2021\.  TransMIA: membership inference attacks using transfer shadow training. In _2021 International Joint Conference on Neural Networks (IJCNN)_. IEEE, 1–10.
  * Hilprecht et al. (2019) Benjamin Hilprecht, Martin Härterich, and Daniel Bernau. 2019\.  Monte Carlo and Reconstruction Membership Inference Attacks against Generative Models.  _Proc. Priv. Enhancing Technol._ 2019, 4 (2019), 232–249.
  * Hitaj et al. (2017) Briland Hitaj, Giuseppe Ateniese, and Fernando Perez-Cruz. 2017\.  Deep models under the GAN: information leakage from collaborative deep learning. In _Proceedings of the 2017 ACM SIGSAC conference on computer and communications security_. 603–618.
  * Homer et al. (2008) Nils Homer, Szabolcs Szelinger, Margot Redman, David Duggan, Waibhav Tembe, Jill Muehling, John V Pearson, Dietrich A Stephan, Stanley F Nelson, and David W Craig. 2008\.  Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays.  _PLoS genetics_ 4, 8 (2008), e1000167.
  * Hu et al. (2021b) Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. 2021b.  Membership inference attacks on machine learning: A survey.  _ACM Computing Surveys (CSUR)_ (2021).
  * Hu et al. (2021a) Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, and Xuyun Zhang. 2021a.  Source inference attacks in federated learning. In _2021 IEEE International Conference on Data Mining (ICDM)_. IEEE, 1102–1107.
  * Hui et al. (2021) Bo Hui, Yuchen Yang, Haolin Yuan, Philippe Burlina, Neil Zhenqiang Gong, and Yinzhi Cao. 2021\.  Practical Blind Membership Inference Attack via Differential Comparisons. In _ISOC Network and Distributed System Security Symposium (NDSS)_.
  * Hunt et al. (2018) Tyler Hunt, Congzheng Song, Reza Shokri, Vitaly Shmatikov, and Emmett Witchel. 2018.  Chiron: Privacy-preserving machine learning as a service.  _arXiv preprint arXiv:1803.05961_ (2018).
  * Isaak and Hanna (2018) Jim Isaak and Mina J Hanna. 2018.  User data privacy: Facebook, Cambridge Analytica, and privacy protection.  _Computer_ 51, 8 (2018), 56–59.
  * Jayaraman and Evans (2019) Bargav Jayaraman and David Evans. 2019.  Evaluating differentially private machine learning in practice. In _28th USENIX Security Symposium (USENIX Security 19)_. 1895–1912.
  * Jayaraman et al. (2020) Bargav Jayaraman, Lingxiao Wang, Katherine Knipmeyer, Quanquan Gu, and David Evans. 2020.  Revisiting membership inference under realistic assumptions.  _arXiv preprint arXiv:2005.10881_ (2020).
  * Jia et al. (2021b) Bin Jia, Xiaosong Zhang, Jiewen Liu, Yang Zhang, Ke Huang, and Yongquan Liang. 2021b.  Blockchain-enabled federated learning data protection aggregation scheme with differential privacy and homomorphic encryption in IIoT.  _IEEE Transactions on Industrial Informatics_ (2021).
  * Jia et al. (2021a) Hengrui Jia, Christopher A Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. 2021a.  Entangled watermarks as a defense against model extraction. In _30th USENIX Security Symposium (USENIX Security 21)_. 1937–1954.
  * Jia and Gong (2018) Jinyuan Jia and Neil Zhenqiang Gong. 2018.  $\\{$AttriGuard$\\}$: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learning. In _27th USENIX Security Symposium (USENIX Security 18)_. 513–529.
  * Jia et al. (2019) Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong. 2019.  Memguard: Defending against black-box membership inference attacks via adversarial examples. In _Proceedings of the 2019 ACM SIGSAC conference on computer and communications security_. 259–274.
  * Jordan and Mitchell (2015) Michael I Jordan and Tom M Mitchell. 2015.  Machine learning: Trends, perspectives, and prospects.  _Science_ 349, 6245 (2015), 255–260.
  * Juuti et al. (2019) Mika Juuti, Sebastian Szyller, Samuel Marchal, and N Asokan. 2019.  PRADA: protecting against DNN model stealing attacks. In _2019 IEEE European Symposium on Security and Privacy (EuroS &P)_. IEEE, 512–527.
  * Kahla et al. (2022) Mostafa Kahla, Si Chen, Hoang Anh Just, and Ruoxi Jia. 2022\.  Label-Only Model Inversion Attacks via Boundary Repulsion. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 15045–15053.
  * Kairouz et al. (2021) Peter Kairouz, Ziyu Liu, and Thomas Steinke. 2021.  The distributed discrete gaussian mechanism for federated learning with secure aggregation. In _International Conference on Machine Learning_. PMLR, 5201–5212.
  * Kariyappa et al. (2021) Sanjay Kariyappa, Atul Prakash, and Moinuddin K Qureshi. 2021\.  Maze: Data-free model stealing attack using zeroth-order gradient estimation. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 13814–13823.
  * Kasichainula et al. (2020) Keshav Kasichainula, Hadi Mansourifar, and Weidong Shi. 2020\.  Privacy Preserving Proxy for Machine Learning as a Service. In _2020 IEEE International Conference on Big Data (Big Data)_. IEEE, 4006–4015.
  * Katz et al. (2017) Guy Katz, Clark Barrett, David L Dill, Kyle Julian, and Mykel J Kochenderfer. 2017.  Reluplex: An efficient SMT solver for verifying deep neural networks. In _International conference on computer aided verification_. Springer, 97–117.
  * Kehui et al. (2019) Song Kehui, Zhang Ying, Zhang Jiangwei, and Yuan Xiaojie. 2019\.  A Generative Model for Synthesizing Structured Datasets Based on GAN.  _Journal of Computer Research and Development_ 56, 9 (2019), 1832.
  * Kesarwani et al. (2018) Manish Kesarwani, Bhaskar Mukhoty, Vijay Arya, and Sameep Mehta. 2018.  Model extraction warning in mlaas paradigm. In _Proceedings of the 34th Annual Computer Security Applications Conference_. 371–380.
  * Khosravy et al. (2021) Mahdi Khosravy, Kazuaki Nakamura, Yuki Hirose, Naoko Nitta, and Noboru Babaguchi. 2021.  Model inversion attack: Analysis under gray-box scenario on deep learning based face recognition system.  _KSII Transactions on Internet and Information Systems (TIIS)_ 15, 3 (2021), 1100–1118.
  * Khosravy et al. (2022) Mahdi Khosravy, Kazuaki Nakamura, Yuki Hirose, Naoko Nitta, and Noboru Babaguchi. 2022.  Model Inversion Attack by Integration of Deep Generative Models: Privacy-Sensitive Face Generation from a Face Recognition System.  _IEEE Transactions on Information Forensics and Security_ 17 (2022), 357–372.
  * Kim et al. (2018) Hanjoo Kim, Minkyu Kim, Dongjoo Seo, Jinwoong Kim, Heungseok Park, Soeun Park, Hyunwoo Jo, KyungHyun Kim, Youngil Yang, Youngkwan Kim, et al. 2018\.  Nsml: Meet the mlaas platform with a real-world case study.  _arXiv preprint arXiv:1810.09957_ (2018).
  * Kong et al. (2021) Qinglei Kong, Feng Yin, Rongxing Lu, Beibei Li, Xiaohong Wang, Shuguang Cui, and Ping Zhang. 2021.  Privacy-preserving aggregation for federated learning-based navigation in vehicular fog.  _IEEE Transactions on Industrial Informatics_ 17, 12 (2021), 8453–8463.
  * Kosinski et al. (2013) Michal Kosinski, David Stillwell, and Thore Graepel. 2013\.  Private traits and attributes are predictable from digital records of human behavior.  _Proceedings of the national academy of sciences_ 110, 15 (2013), 5802–5805.
  * Krishna et al. (2019) Kalpesh Krishna, Gaurav Singh Tomar, Ankur P Parikh, Nicolas Papernot, and Mohit Iyyer. 2019\.  Thieves on sesame street! model extraction of bert-based apis.  _arXiv preprint arXiv:1910.12366_ (2019).
  * Kumar and Rathore (2016) Ashish Kumar and NC Rathore. 2016.  Improving attribute inference attack using link prediction in online social networks.  In _Recent Advances in Mathematics, Statistics and Computer Science_. World Scientific, 494–503.
  * Larsen et al. (2016) Anders Boesen Lindbo Larsen, Søren Kaae Sønderby, Hugo Larochelle, and Ole Winther. 2016\.  Autoencoding beyond pixels using a learned similarity metric. In _International conference on machine learning_. PMLR, 1558–1566.
  * Lee et al. (2022) Joon-Woo Lee, HyungChul Kang, Yongwoo Lee, Woosuk Choi, Jieun Eom, Maxim Deryabin, Eunsang Lee, Junghyun Lee, Donghoon Yoo, Young-Sik Kim, et al. 2022\.  Privacy-preserving machine learning with fully homomorphic encryption for deep neural network.  _IEEE Access_ 10 (2022), 30039–30054.
  * Lee et al. (2019) Taesung Lee, Benjamin Edwards, Ian Molloy, and Dong Su. 2019\.  Defending against neural network model stealing attacks using deceptive perturbations. In _2019 IEEE Security and Privacy Workshops (SPW)_. IEEE, 43–49.
  * Leino and Fredrikson (2020) Klas Leino and Matt Fredrikson. 2020.  Stolen Memories: Leveraging Model Memorization for Calibrated $\\{$White-Box$\\}$ Membership Inference. In _29th USENIX security symposium (USENIX Security 20)_. 1605–1622.
  * Li et al. (2021) Ban Li, Senlin Luo, Xiaonan Qin, and Limin Pan. 2021\.  Improving GAN with inverse cumulative distribution function for tabular data synthesis.  _Neurocomputing_ 456 (2021), 373–383.
  * Li et al. (2018) Gesu Li, Zhipeng Cai, Guisheng Yin, Zaobo He, and Madhuri Siddula. 2018.  Differentially Private Recommendation System Based on Community Detection in Social Network Applications.  _Security & Communication Networks_ (2018).
  * Li et al. (2022) Guoyao Li, Shahbaz Rezaei, and Xin Liu. 2022.  User-Level Membership Inference Attack against Metric Embedding Learning. In _ICLR 2022 Workshop on PAIR_.
  * Li et al. (2017) Li Erran Li, Eric Chen, Jeremy Hermann, Pusheng Zhang, and Luming Wang. 2017.  Scaling machine learning as a service. In _International Conference on Predictive Applications and APIs_. PMLR, 14–29.
  * Li and Zhang (2020) Zheng Li and Yang Zhang. 2020.  Label-leaks: Membership inference attack with label.  _arXiv preprint arXiv:2007.15528_ (2020).
  * Li and Zhang (2021) Zheng Li and Yang Zhang. 2021.  Membership leakage in label-only exposures. In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_. 880–895.
  * Lindamood et al. (2009) Jack Lindamood, Raymond Heatherly, Murat Kantarcioglu, and Bhavani Thuraisingham. 2009.  Inferring private information using social network data. In _Proceedings of the 18th international conference on World wide web_. 1145–1146.
  * Liu et al. (2022) Lan Liu, Yi Wang, Gaoyang Liu, Kai Peng, and Chen Wang. 2022.  Membership Inference Attacks Against Machine Learning Models via Prediction Sensitivity.  _IEEE Transactions on Dependable and Secure Computing_ (2022).
  * Liu and Yang (2012) Xiangyu Liu and Xiaochun Yang. 2012.  Protecting sensitive relationships against inference attacks in social networks. In _International Conference on Database Systems for Advanced Applications_. Springer, 335–350.
  * Long et al. (2018) Yunhui Long, Vincent Bindschaedler, Lei Wang, Diyue Bu, Xiaofeng Wang, Haixu Tang, Carl A Gunter, and Kai Chen. 2018\.  Understanding membership inferences on well-generalized learning models.  _arXiv preprint arXiv:1802.04889_ (2018).
  * Long et al. (2020) Yunhui Long, Lei Wang, Diyue Bu, Vincent Bindschaedler, Xiaofeng Wang, Haixu Tang, Carl A Gunter, and Kai Chen. 2020\.  A pragmatic approach to membership inferences on machine learning models. In _2020 IEEE European Symposium on Security and Privacy (EuroS &P)_. IEEE, 521–534.
  * Luo et al. (2014) Dixin Luo, Hongteng Xu, Hongyuan Zha, Jun Du, Rong Xie, Xiaokang Yang, and Wenjun Zhang. 2014.  You are what you watch and when you watch: Inferring household structures from IPTV viewing data.  _IEEE Transactions on Broadcasting_ 60, 1 (2014), 61–72.
  * Luo et al. (2021) Xinjian Luo, Yuncheng Wu, Xiaokui Xiao, and Beng Chin Ooi. 2021\.  Feature inference attack on model predictions in vertical federated learning. In _2021 IEEE 37th International Conference on Data Engineering (ICDE)_. IEEE, 181–192.
  * Lyu et al. (2020) Lingjuan Lyu, Han Yu, and Qiang Yang. 2020.  Threats to federated learning: A survey.  _arXiv preprint arXiv:2003.02133_ (2020).
  * Ma et al. (2021) Xindi Ma, Baopu Li, Qi Jiang, Yimin Chen, Sheng Gao, and Jianfeng Ma. 2021\.  NOSnoop: an Effective Collaborative Meta-Learning Scheme against Property Inference Attack.  _IEEE Internet of Things Journal_ (2021).
  * Machado et al. (2021) Gabriel Resende Machado, Eugênio Silva, and Ronaldo Ribeiro Goldschmidt. 2021.  Adversarial Machine Learning in Image Classification: A Survey Toward the Defender’s Perspective.  _ACM Computing Surveys (CSUR)_ 55, 1 (2021), 1–38.
  * MacKinnon and Warren (2006) Ian MacKinnon and Robert H Warren. 2006.  Age and geographic inferences of the LiveJournal social network. In _ICML Workshop on Statistical Network Analysis_. Springer, 176–178.
  * Madry et al. (2017) Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017\.  Towards deep learning models resistant to adversarial attacks.  _arXiv preprint arXiv:1706.06083_ (2017).
  * Mahloujifar et al. (2022) Saeed Mahloujifar, Esha Ghosh, and Melissa Chase. 2022\.  Property Inference from Poisoning. In _2022 IEEE Symposium on Security and Privacy (SP)_. IEEE Computer Society, 1569–1569.
  * McMahan et al. (2017a) Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017a.  Communication-efficient learning of deep networks from decentralized data. In _Artificial intelligence and statistics_. PMLR, 1273–1282.
  * McMahan et al. (2017b) H Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. 2017b.  Learning differentially private recurrent language models.  _arXiv preprint arXiv:1710.06963_ (2017).
  * Mehnaz et al. (2022) Shagufta Mehnaz, Sayanton V Dibbo, Ehsanul Kabir, Ninghui Li, and Elisa Bertino. 2022\.  Are Your Sensitive Attributes Private? Novel Model Inversion Attribute Inference Attacks on Classification Models.  _arXiv preprint arXiv:2201.09370_ (2022).
  * Melis et al. (2019) Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. 2019.  Exploiting unintended feature leakage in collaborative learning. In _2019 IEEE Symposium on Security and Privacy (SP)_. IEEE, 691–706.
  * Milli et al. (2019) Smitha Milli, Ludwig Schmidt, Anca D Dragan, and Moritz Hardt. 2019.  Model reconstruction from model explanations. In _Proceedings of the Conference on Fairness, Accountability, and Transparency_. 1–9.
  * Mislove et al. (2010) Alan Mislove, Bimal Viswanath, Krishna P Gummadi, and Peter Druschel. 2010.  You are who you know: inferring user profiles in online social networks. In _Proceedings of the third ACM international conference on Web search and data mining_. 251–260.
  * Mo et al. (2020a) Fan Mo, Anastasia Borovykh, Mohammad Malekzadeh, Hamed Haddadi, and Soteris Demetriou. 2020a.  Layer-wise characterization of latent information leakage in federated learning.  _arXiv preprint arXiv:2010.08762_ (2020).
  * Mo et al. (2020b) Kanghua Mo, Teng Huang, and Xiaoyu Xiang. 2020b.  Querying little is enough: Model inversion attack via latent information. In _International Conference on Machine Learning for Cyber Security_. Springer, 583–591.
  * Murakonda and Shokri (2020) Sasi Kumar Murakonda and Reza Shokri. 2020.  Ml privacy meter: Aiding regulatory compliance by quantifying the privacy risks of machine learning.  _arXiv preprint arXiv:2007.09339_ (2020).
  * Nagai et al. (2018) Yuki Nagai, Yusuke Uchida, Shigeyuki Sakazawa, and Shin’ichi Satoh. 2018.  Digital watermarking for deep neural networks.  _International Journal of Multimedia Information Retrieval_ 7, 1 (2018), 3–16.
  * Nasr et al. (2018) Milad Nasr, Reza Shokri, and Amir Houmansadr. 2018.  Machine learning with membership privacy using adversarial regularization. In _Proceedings of the 2018 ACM SIGSAC conference on computer and communications security_. 634–646.
  * Nasr et al. (2019) Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019.  Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In _2019 IEEE symposium on security and privacy (SP)_. IEEE, 739–753.
  * Naveed et al. (2015) Muhammad Naveed, Seny Kamara, and Charles V Wright. 2015\.  Inference attacks on property-preserving encrypted databases. In _Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security_. 644–655.
  * Olatunji et al. (2021) Iyiola E Olatunji, Wolfgang Nejdl, and Megha Khosla. 2021\.  Membership inference attack on graph neural networks.  _arXiv preprint arXiv:2101.06570_ (2021).
  * Olatunji et al. (2022) Iyiola E Olatunji, Mandeep Rathee, Thorben Funke, and Megha Khosla. 2022.  Private graph extraction via feature explanations.  _arXiv preprint arXiv:2206.14724_ (2022).
  * Orekondy et al. (2019a) Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2019a.  Knockoff nets: Stealing functionality of black-box models. In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_. 4954–4963.
  * Orekondy et al. (2019b) Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2019b.  Prediction poisoning: Towards defenses against dnn model stealing attacks.  _arXiv preprint arXiv:1906.10908_ (2019).
  * Papernot et al. (2016a) Nicolas Papernot, Martín Abadi, Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar. 2016a.  Semi-supervised knowledge transfer for deep learning from private training data.  _arXiv preprint arXiv:1610.05755_ (2016).
  * Papernot et al. (2016b) Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016b.  The limitations of deep learning in adversarial settings. In _2016 IEEE European symposium on security and privacy (EuroS &P)_. IEEE, 372–387.
  * Pareek et al. ([n.d.]) Divyansh Pareek, Saket Dingliwal, and Jatin Arora. [n.d.].  Property Inference in ReLU nets using Linear Interpolants.  ([n. d.]).
  * Parisot et al. (2021) Mathias PM Parisot, Balazs Pejo, and Dayana Spagnuelo. 2021\.  Property Inference Attacks on Convolutional Neural Networks: Influence and Implications of Target Model’s Complexity.  _arXiv preprint arXiv:2104.13061_ (2021).
  * Pasquini et al. (2021) Dario Pasquini, Giuseppe Ateniese, and Massimo Bernaschi. 2021\.  Unleashing the tiger: Inference attacks on split learning. In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_. 2113–2129.
  * Pathak et al. (2010) Manas Pathak, Shantanu Rane, and Bhiksha Raj. 2010.  Multiparty differential privacy via aggregation of locally trained classifiers.  _Advances in neural information processing systems_ 23 (2010).
  * Philipp et al. (2020) Robert Philipp, Andreas Mladenow, Christine Strauss, and Alexander Völz. 2020.  Machine learning as a service: Challenges in research and applications. In _Proceedings of the 22nd International Conference on Information Integration and Web-based Applications & Services_. 396–406.
  * Pijani et al. (2020) Bizhan Alipour Pijani, Abdessamad Imine, and Michaël Rusinowitch. 2020.  You are what emojis say about your pictures: language-independent gender inference attack on facebook. In _Proceedings of the 35th Annual ACM Symposium on Applied Computing_. 1826–1834.
  * Poirot et al. (2019) Maarten G Poirot, Praneeth Vepakomma, Ken Chang, Jayashree Kalpathy-Cramer, Rajiv Gupta, and Ramesh Raskar. 2019.  Split learning for collaborative deep learning in healthcare.  _arXiv preprint arXiv:1912.12115_ (2019).
  * Radford et al. (2015) Alec Radford, Luke Metz, and Soumith Chintala. 2015.  Unsupervised representation learning with deep convolutional generative adversarial networks.  _arXiv preprint arXiv:1511.06434_ (2015).
  * Rathgeb and Uhl (2011) Christian Rathgeb and Andreas Uhl. 2011.  A survey on biometric cryptosystems and cancelable biometrics.  _EURASIP journal on information security_ 2011, 1 (2011), 1–25.
  * Ribeiro et al. (2015) Mauro Ribeiro, Katarina Grolinger, and Miriam AM Capretz. 2015\.  Mlaas: Machine learning as a service. In _2015 IEEE 14th International Conference on Machine Learning and Applications (ICMLA)_. IEEE, 896–902.
  * Sablayrolles et al. (2019) Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. 2019.  White-box vs black-box: Bayes optimal strategies for membership inference. In _International Conference on Machine Learning_. PMLR, 5558–5567.
  * Salem et al. (2020) Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang. 2020.  $\\{$Updates-Leak$\\}$: Data Set Inference and Reconstruction Attacks in Online Learning. In _29th USENIX security symposium (USENIX Security 20)_. 1291–1308.
  * Salem et al. (2019) Ahmed Salem, Yang Zhang, Mathias Humbert, Mario Fritz, and Michael Backes. 2019.  ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. In _Network and Distributed Systems Security Symposium 2019_. Internet Society.
  * Shafran et al. (2021) Avital Shafran, Shmuel Peleg, and Yedid Hoshen. 2021\.  Reconstruction-Based Membership Inference Attacks are Easier on Difficult Problems.  _arXiv preprint arXiv:2102.07762_ (2021).
  * Shah et al. (2021) Muhammad A Shah, Joseph Szurley, Markus Mueller, Athanasios Mouchtaris, and Jasha Droppo. 2021\.  Evaluating the Vulnerability of End-to-End Automatic Speech Recognition Models to Membership Inference Attacks.. In _Interspeech_. 891–895.
  * Shamsabadi et al. (2020) Ali Shahin Shamsabadi, Adrià Gascón, Hamed Haddadi, and Andrea Cavallaro. 2020.  Privedge: From local to distributed private training and prediction.  _IEEE Transactions on Information Forensics and Security_ 15 (2020), 3819–3831.
  * Shen et al. (2020) Meng Shen, Huan Wang, Bin Zhang, Liehuang Zhu, Ke Xu, Qi Li, and Xiaojiang Du. 2020.  Exploiting unintended property leakage in blockchain-assisted federated learning for intelligent edge computing.  _IEEE Internet of Things Journal_ 8, 4 (2020), 2265–2275.
  * Shi and Sagduyu (2022) Yi Shi and Yalin Sagduyu. 2022.  Membership inference attack and defense for wireless signal classifiers with deep learning.  _IEEE Transactions on Mobile Computing_ (2022).
  * Shi et al. (2017) Yi Shi, Yalin Sagduyu, and Alexander Grushin. 2017.  How to steal a machine learning classifier with deep learning. In _2017 IEEE International symposium on technologies for homeland security (HST)_. IEEE, 1–5.
  * Shokri et al. (2021) Reza Shokri, Martin Strobel, and Yair Zick. 2021\.  On the privacy risks of model explanations. In _Proceedings of the 2021 AAAI/ACM Conference on AI, Ethics, and Society_. 231–241.
  * Shokri et al. (2017) Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017.  Membership inference attacks against machine learning models. In _2017 IEEE symposium on security and privacy (SP)_. IEEE, 3–18.
  * Song and Raghunathan (2020) Congzheng Song and Ananth Raghunathan. 2020.  Information leakage in embedding models. In _Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security_. 377–390.
  * Song et al. (2017) Congzheng Song, Thomas Ristenpart, and Vitaly Shmatikov. 2017\.  Machine learning models that remember too much. In _Proceedings of the 2017 ACM SIGSAC Conference on computer and communications security_. 587–601.
  * Song and Mittal (2021) Liwei Song and Prateek Mittal. 2021.  Systematic evaluation of privacy risks of machine learning models. In _30th USENIX Security Symposium (USENIX Security 21)_. 2615–2632.
  * Song et al. (2019) Liwei Song, Reza Shokri, and Prateek Mittal. 2019.  Privacy risks of securing machine learning models against adversarial examples. In _Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security_. 241–257.
  * Sun et al. (2018) Xiaoqiang Sun, Peng Zhang, Joseph K Liu, Jianping Yu, and Weixin Xie. 2018.  Private machine learning classification based on fully homomorphic encryption.  _IEEE Transactions on Emerging Topics in Computing_ 8, 2 (2018), 352–364.
  * Suri et al. (2022) Anshuman Suri, Pallika Kanani, Virendra J Marathe, and Daniel W Peterson. 2022.  Subject Membership Inference Attacks in Federated Learning.  _arXiv preprint arXiv:2206.03317_ (2022).
  * Tanuwidjaja et al. (2020) Harry Chandra Tanuwidjaja, Rakyong Choi, Seunggeun Baek, and Kwangjo Kim. 2020.  Privacy-preserving deep learning on machine learning as a service—a comprehensive survey.  _IEEE Access_ 8 (2020), 167425–167447.
  * Thomas et al. (2010) Kurt Thomas, Chris Grier, and David M Nicol. 2010.  unfriendly: Multi-party privacy risks in social networks. In _International Symposium on Privacy Enhancing Technologies Symposium_. Springer, 236–252.
  * Tramèr et al. (2016) Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. 2016.  Stealing Machine Learning Models via Prediction $\\{$APIs$\\}$. In _25th USENIX security symposium (USENIX Security 16)_. 601–618.
  * Traud et al. (2012) Amanda L Traud, Peter J Mucha, and Mason A Porter. 2012\.  Social structure of facebook networks.  _Physica A: Statistical Mechanics and its Applications_ 391, 16 (2012), 4165–4180.
  * Truex et al. (2019) Stacey Truex, Ling Liu, Mehmet Emre Gursoy, Lei Yu, and Wenqi Wei. 2019.  Demystifying membership inference attacks in machine learning as a service.  _IEEE Transactions on Services Computing_ (2019).
  * Tseng and Wu (2020) Bo-Wei Tseng and Pei-Yuan Wu. 2020.  Compressive privacy generative adversarial network.  _IEEE Transactions on Information Forensics and Security_ 15 (2020), 2499–2513.
  * Usynin et al. (2022) Dmitrii Usynin, Daniel Rueckert, and Georgios Kaissis. 2022\.  Beyond gradients: Exploiting adversarial priors in model inversion attacks.  _arXiv preprint arXiv:2203.00481_ (2022).
  * Viand et al. (2021) Alexander Viand, Patrick Jattke, and Anwar Hithnawi. 2021\.  Sok: Fully homomorphic encryption compilers. In _2021 IEEE Symposium on Security and Privacy (SP)_. IEEE, 1092–1108.
  * Wang and Gong (2018) Binghui Wang and Neil Zhenqiang Gong. 2018.  Stealing hyperparameters in machine learning. In _2018 IEEE symposium on security and privacy (SP)_. IEEE, 36–52.
  * Wang et al. (2021) Kuan-Chieh Wang, Yan Fu, Ke Li, Ashish Khisti, Richard Zemel, and Alireza Makhzani. 2021\.  Variational Model Inversion Attacks.  _Advances in Neural Information Processing Systems_ 34 (2021).
  * Wang (2019) Tianhao Wang. 2019\.  Property Inference Attacks on Neural Networks using Dimension Reduction Representations.  (2019).
  * Wang and Sun (2021a) Wenyang Wang and Dongchu Sun. 2021a.  The improved AdaBoost algorithms for imbalanced data classification.  _Information Sciences_ 563 (2021), 358–374.
  * Wang et al. (2019) Xingbin Wang, Rui Hou, Yifan Zhu, Jun Zhang, and Dan Meng. 2019.  NPUFort: A secure architecture of DNN accelerator against model inversion attack. In _Proceedings of the 16th ACM International Conference on Computing Frontiers_. 190–196.
  * Wang and Sun (2021b) Yu Wang and Lichao Sun. 2021b.  Membership inference attacks on knowledge graphs.  _arXiv preprint arXiv:2104.08273_ (2021).
  * Weinsberg et al. (2012) Udi Weinsberg, Smriti Bhagat, Stratis Ioannidis, and Nina Taft. 2012.  BlurMe: Inferring and obfuscating user gender based on ratings. In _Proceedings of the sixth ACM conference on Recommender systems_. 195–202.
  * Wood et al. (2020) Alexander Wood, Kayvan Najarian, and Delaram Kahrobaei. 2020\.  Homomorphic encryption for machine learning in medicine and bioinformatics.  _ACM Computing Surveys (CSUR)_ 53, 4 (2020), 1–35.
  * Wu et al. (2021) Feng Wu, Lei Cui, Jianan Feng, Liwen Wu, Saowen Yao, and Shui Yu. 2021\.  Data Privacy Protection based on Feature Dilution in Cloud Services. In _2021 IEEE Global Communications Conference (GLOBECOM)_. IEEE, 1–6.
  * Wu et al. (2022b) Fan Wu, Yunhui Long, Ce Zhang, and Bo Li. 2022b.  Linkteller: Recovering private edges from graph neural networks via influence analysis. In _2022 IEEE Symposium on Security and Privacy (SP)_. IEEE, 2005–2024.
  * Wu et al. (2020) Maoqiang Wu, Xinyue Zhang, Jiahao Ding, Hien Nguyen, Rong Yu, Miao Pan, and Stephen T Wong. 2020.  Evaluation of inference attack models for deep learning on medical data.  _arXiv preprint arXiv:2011.00177_ (2020).
  * Wu et al. (2022a) Qi Wu, Qiang Li, Dong Guo, and Xiangyu Meng. 2022a.  Exploring the vulnerability in the inference phase of advanced persistent threats.  _International Journal of Distributed Sensor Networks_ 18, 3 (2022), 15501329221080417\.
  * Wu et al. (2022c) Yixin Wu, Ning Yu, Zheng Li, Michael Backes, and Yang Zhang. 2022c.  Membership Inference Attacks Against Text-to-image Generation Models.  _arXiv preprint arXiv:2210.00968_ (2022).
  * Xu et al. (2020) Lei Xu et al. 2020\.  _Synthesizing tabular data using conditional GAN_.  Ph.D. Dissertation. Massachusetts Institute of Technology.
  * Xu et al. (2019) Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. 2019.  Modeling tabular data using conditional gan.  _Advances in Neural Information Processing Systems_ 32 (2019).
  * Xu and Veeramachaneni (2018) Lei Xu and Kalyan Veeramachaneni. 2018.  Synthesizing tabular data using generative adversarial networks.  _arXiv preprint arXiv:1811.11264_ (2018).
  * Xu and Li (2020) Mingxue Xu and Xiangyang Li. 2020.  Subject property inference attack in collaborative learning. In _2020 12th International Conference on Intelligent Human-Machine Systems and Cybernetics (IHMSC)_ , Vol. 1. IEEE, 227–231.
  * Yang et al. (2020) Qiang Yang, Lixin Fan, and Han Yu. 2020.  _Federated Learning: Privacy and Incentive_. Vol. 12500.  Springer Nature.
  * Yang et al. (2019) Ziqi Yang, Jiyi Zhang, Ee-Chien Chang, and Zhenkai Liang. 2019\.  Neural network inversion in adversarial setting via background knowledge alignment. In _Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security_. 225–240.
  * Ye et al. (2022a) Dayong Ye, Huiqiang Chen, Shuai Zhou, Tianqing Zhu, Wanlei Zhou, and Shouling Ji. 2022a.  Model Inversion Attack against Transfer Learning: Inverting a Model without Accessing It.  _arXiv preprint arXiv:2203.06570_ (2022).
  * Ye et al. (2022b) Dayong Ye, Tianqing Zhu, Shuai Zhou, Bo Liu, and Wanlei Zhou. 2022b.  Label-only Model Inversion Attack: The Attack that Requires the Least Information.  _arXiv preprint arXiv:2203.06555_ (2022).
  * Yeom et al. (2018) Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. 2018.  Privacy risk in machine learning: Analyzing the connection to overfitting. In _2018 IEEE 31st computer security foundations symposium (CSF)_. IEEE, 268–282.
  * Yin et al. (2021) Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. 2021\.  See through gradients: Image batch recovery via gradinversion. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 16337–16346.
  * Yuan and Zhang (2022) Xiaoyong Yuan and Lan Zhang. 2022.  Membership Inference Attacks and Defenses in Neural Network Pruning.  _arXiv preprint arXiv:2202.03335_ (2022).
  * Zaheer et al. (2017) Manzil Zaheer, Satwik Kottur, Siamak Ravanbakhsh, Barnabas Poczos, Russ R Salakhutdinov, and Alexander J Smola. 2017.  Deep sets.  _Advances in neural information processing systems_ 30 (2017).
  * Zanella-Beguelin et al. (2021) Santiago Zanella-Beguelin, Shruti Tople, Andrew Paverd, and Boris Köpf. 2021.  Grey-box extraction of natural language models. In _International Conference on Machine Learning_. PMLR, 12278–12286.
  * Zhang et al. (2021a) Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. 2021a.  Understanding deep learning (still) requires rethinking generalization.  _Commun. ACM_ 64, 3 (2021), 107–115.
  * Zhang et al. (2021c) Minxing Zhang, Zhaochun Ren, Zihan Wang, Pengjie Ren, Zhunmin Chen, Pengfei Hu, and Yang Zhang. 2021c.  Membership inference attacks against recommender systems. In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_. 864–879.
  * Zhang et al. (2020b) Xuezhou Zhang, Xiaojin Zhu, and Laurent Lessard. 2020b.  Online data poisoning attacks. In _Learning for Dynamics and Control_. PMLR, 201–210.
  * Zhang et al. (2020a) Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. 2020a.  The secret revealer: Generative model-inversion attacks against deep neural networks. In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_. 253–261.
  * Zhang et al. (2021d) Yifei Zhang, Jiong Wang, Junsha Chen, Neng Gao, Min Li, and Jiameng Bai. 2021d.  TEA-RNN: Topic-Enhanced Attentive RNN for Attribute Inference Attacks via User Behaviors. In _2021 IEEE 24th International Conference on Computer Supported Cooperative Work in Design (CSCWD)_. IEEE, 174–179.
  * Zhang et al. (2022) Zhikun Zhang, Min Chen, Michael Backes, Yun Shen, and Yang Zhang. 2022.  Inference attacks against graph neural networks. In _Proceedings of the 31th USENIX Security Symposium_. 1–18.
  * Zhang et al. (2021b) Zaixi Zhang, Qi Liu, Zhenya Huang, Hao Wang, Chengqiang Lu, Chuanren Liu, and Enhong Chen. 2021b.  Graphmi: Extracting private graph data from graph neural networks.  _arXiv preprint arXiv:2106.02820_ (2021).
  * Zhao et al. (2020) Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. 2020\.  idlg: Improved deep leakage from gradients.  _arXiv preprint arXiv:2001.02610_ (2020).
  * Zhao et al. (2021a) Benjamin Zi Hao Zhao, Aviral Agrawal, Catisha Coburn, Hassan Jameel Asghar, Raghav Bhaskar, Mohamed Ali Kaafar, Darren Webb, and Peter Dickinson. 2021a.  On the (in) feasibility of attribute inference attacks on machine learning models. In _2021 IEEE European Symposium on Security and Privacy (EuroS &P)_. IEEE, 232–251.
  * Zhao et al. (2021b) Xuejun Zhao, Wencan Zhang, Xiaokui Xiao, and Brian Lim. 2021b.  Exploiting explanations for model inversion attacks. In _Proceedings of the IEEE/CVF International Conference on Computer Vision_. 682–692.
  * Zheleva and Getoor (2009) Elena Zheleva and Lise Getoor. 2009.  To join or not to join: the illusion of privacy in social networks with mixed public and private user profiles. In _Proceedings of the 18th international conference on World wide web_. 531–540.
  * Zheng et al. (2019) Huadi Zheng, Qingqing Ye, Haibo Hu, Chengfang Fang, and Jie Shi. 2019.  Bdpl: A boundary differentially private layer against machine learning model extraction attacks. In _European Symposium on Research in Computer Security_. Springer, 66–83.
  * Zhou et al. (2021) Junhao Zhou, Yufei Chen, Chao Shen, and Yang Zhang. 2021\.  Property Inference Attacks Against GANs.  _arXiv preprint arXiv:2111.07608_ (2021).
  * Zhu et al. (2019) Ligeng Zhu, Zhijian Liu, and Song Han. 2019.  Deep leakage from gradients.  _Advances in neural information processing systems_ 32 (2019).