Effectiveness of L2 Regularization in Privacy-Preserving Machine Learning

(2) Wire Communications; Aristotelis Spiliotis (1); Centre for Research; Computer Engineering; Dept. of Electrical; Greece; Greece); Hellenic Institute of Transport; Iliana Loi (2); Information Technology Laboratory

REVIEW 5 major objections 5 minor 29 references

Effectiveness of L2 Regularization in Privacy-Preserving Machine Learning

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that adding L2 regularization to ordinary neural-network training can reduce the attacker's advantage in membership inference attacks while maintaining or improving accuracy compared with differentially private models.

desk verdict Empirically plausible but overclaimed: the attack is unspecified and the reported L2 privacy benefit tracks the train-validation gap, making the headline result a restatement of the known overfitting-membership connection. read the letter →

arxiv 2412.01541 v1 pith:Z45BJ43Z submitted 2024-12-02 cs.LG cs.AIcs.CR

Nikolaos Chandrinos (1) , Iliana Loi (2) , Panagiotis Zachos (2) , Ioannis Symeonidis (1) , Aristotelis Spiliotis (1) , Maria Panou (1) , Konstantinos Moustakas (2) ((1) Human Factors , Vehicle Technology

show 12 more authors

Hellenic Institute of Transport Centre for Research Technology Hellas Thermi Greece (2) Wire Communications Information Technology Laboratory Dept. of Electrical Computer Engineering University of Patras Patras Greece)

This is my paper · ORCID

classification cs.LGcs.AIcs.CR

keywords privacy-preservingmachinelearningmembershipinferenceattacksL2regularizationdifferentialprivacyattackeradvantageoverfittingweightdecaydeep

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that L2 regularization, the long-standing trick of penalizing large neural-network weights, is also a privacy defense: it can reduce the attacker's advantage in membership inference attacks while maintaining or even improving accuracy relative to models trained with differential privacy. Its argument is that membership inference feeds on overfitting, and L2's weight shrinkage closes the training-versus-validation accuracy gap that attackers exploit. Across MNIST, CIFAR-10, and a text-classification dataset, the paper reports that plain models trained with an L2 penalty cut attacker advantage substantially, sometimes to near the levels of differentially private models, while keeping validation accuracy higher. If this holds, practitioners gain a simple, nearly free privacy lever that can be switched on without the noise, tuning, and accuracy cost of DP, at the price of having no formal privacy guarantee.

What carries the argument

The central mechanism is the L2 penalty appended to the loss, $Loss = Loss_{\mathrm{orig}} + \lambda \sum_{j,k} w_{jk}^2$, which shrinks weights toward zero and reduces overfitting; the regularization strength $\lambda$ acts as a privacy-utility dial. The paper's privacy measure is the membership advantage from reference [28], $\mathrm{Adv}_M = \Pr[A=0 \mid b=0] - \Pr[A=0 \mid b=1]$, the difference between an adversary's true-positive and false-positive rates in a membership experiment. The argument is that the training-versus-validation accuracy gap is the attack surface, and L2 regularization narrows that gap, lowering the advantage. The differentially private comparison uses a DP-Adam optimizer that clips gradients and adds Gaussian noise, as provided by the paper's cited implementation.

What would settle it

Run a publicly specified membership inference attack, such as a confidence-threshold attack or a shadow-model attack, on the same non-private L2-regularized and DP models used in the CIFAR-10 or toxic-tweets experiments, and report the attack's true-positive and false-positive rates. If the L2-regularized model's advantage under that concrete attack is not clearly below the unregularized baseline, or if the paper's advantage values cannot be reproduced because the attack is unspecified, the central claim would be falsified.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that L2 regularization is an effective, tunable privacy protection: adding the penalty $\lambda \sum w_{jk}^2$ to the loss reduces the attacker's membership-inference advantage and can do so without the accuracy drop that differential privacy imposes. The text-classification experiment shows the strongest effect: the non-private baseline's attacker advantage fell from 8.16 at $\lambda = 0$ to 0.73 at $\lambda = 5 \times 10^{-4}$, while validation accuracy stayed near 88--91 percent; the DP model's advantage stayed in the 0.09--0.25 range but its accuracy was roughly 69--79 percent. In the CIFAR-10 experiment, L2 regularization reduced the baseline advantage from 9.25 to 1.21 at $\lambda = 0.005$ while validation accuracy remained above the DP model's. The paper additionally reports a correlation of 0.93 between the training-validation accuracy gap and attacker advantage across configurations, which it interprets as evidence that overfitting is the mechanism connecting L2 regularization to privacy.

Load-bearing premise

The load-bearing premise is that the membership inference attack behind every reported attacker-advantage number is a sound one; the paper never specifies the attack algorithm, threshold, or model access, so if the attack is weak or its success is essentially the train-validation accuracy gap, the L2 privacy benefit is not an independent result.

Editorial extensions

If this is right

Practitioners can lower membership-inference risk in existing non-private pipelines by adding an L2 term and tuning $\lambda$, without switching to differential privacy.
The training-validation accuracy gap can serve as a cheap monitoring signal for privacy risk, since the paper reports a 0.93 correlation between that gap and attacker advantage.
Differential privacy still provides formal guarantees that L2 regularization cannot, so the paper's claims position L2 as a practical mitigation rather than a replacement in high-security settings.
Combining L2 with DP is not automatically beneficial: in the paper's tables, adding L2 to DP models mostly lowered accuracy while leaving attacker advantage roughly stable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the generalization gap is the true driver of the reported effect, other overfitting controls such as dropout, early stopping, and data augmentation should yield similar membership-inference protection; the paper names such techniques but does not test them.
Re-running the comparison with a fully specified attack, such as a confidence-threshold attack or a shadow-model attack, would test whether L2's benefit survives a stronger adversary than the unreported attack behind the paper's numbers.
Because all three datasets are benchmark or synthetic-bias tasks, a natural extension is to real medical or financial data with naturally imbalanced classes, where overfitting patterns differ and the L2 advantage may be smaller.
The pooled 0.93 correlation between accuracy gap and attacker advantage could be driven by dataset differences rather than by $\lambda$ within each dataset; an analysis with per-dataset correlations would settle that.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Read this if you want a quick empirical check on whether L2 regularization reduces membership inference risk. The trends on CIFAR-10 and the text task are real, but the paper overclaims by presenting a restatement of the overfitting-MIA connection as a new privacy result.

What is actually useful: the comparison across three datasets and two architectures is a reasonable start. The tables are clear, the text task includes the DP noise multiplier and clipping norm, and the conclusion honestly states that L2 gives no formal guarantees and that its effect is tied to overfitting. On CIFAR-10 and the toxic-tweets task, increasing lambda reduces attacker advantage substantially, and at some settings the non-DP regularized model shows better validation accuracy than the DP baseline. Practitioners may find that a cheap lever worth trying.

The soft spots are significant. The attack is never specified. Section 2.3 defines membership advantage but gives no attack algorithm, threshold, shadow models, or model access. The reported attacker-advantage numbers align almost linearly with the train-validation gap, and Section 3.3 reports a 0.93 correlation as an empirical discovery. That is essentially the Yeom et al. result restated. So the privacy benefit attributed to L2 is not an independent finding; it is the known overfitting connection with a new knob. The DP baseline is also under-specified for the image tasks: the noise multiplier and privacy budget are only given for text, so we cannot tell what DP strength is being compared. The MNIST results show no effect, which the authors acknowledge in the discussion, yet the conclusion states that L2 can outperform DP in both accuracy and privacy. That conclusion is not supported by the evidence in the paper.

My recommendation: send it to review, because the question is practical and the experiments are a legitimate start, but it needs major revision before acceptance. Specify the attack, report DP hyperparameters and epsilon, temper the conclusion, and reframe the contribution as a comparison rather than a new privacy mechanism. I would not cite it in its current form; it is a workshop-level contribution, not an established privacy result.

Referee Report

5 major / 5 minor

Summary. The paper reports an experimental comparison of L2 regularization versus differentially private training as mitigations for membership inference attacks. It defines attacker advantage via the standard membership experiment, then trains FCNN, CNN, and text-classification models on MNIST, CIFAR-10, and an augmented Toxic Tweets dataset, with and without DP, across a sweep of L2 strengths. It reports training and validation accuracy and attacker advantage in Tables 1–3, and a 0.93 correlation between the training–validation accuracy gap and attacker advantage. The conclusion claims that L2 regularization can reduce attacker advantage while maintaining or even improving accuracy compared with DP. The manuscript is readable and the experimental sweep is systematic, but the core privacy metric is not reproducible because the attack algorithm is never specified, the DP configuration is incomplete for two of the three tasks, and the correlation result substantially reduces to the known overfitting–membership-inference relationship.

Significance. If fully supported, the practical payoff would be real: a simple, well-understood regularizer that lowers membership-inference risk without the utility cost of DP would be valuable for ML-as-a-service deployments. The paper's systematic lambda sweeps, multiple architectures, and reporting of means and standard deviations are useful starting points, and the explicit presentation of the 0.93 correlation is transparent. However, as submitted, the central measurement (attacker advantage) cannot be interpreted or reproduced because the attack is unspecified, and the DP baselines are only partly characterized, so the claimed accuracy–privacy comparison is not yet well-defined. With an explicit attack implementation, complete DP hyperparameters, and a clearer separation of the regularization effect from the overfitting effect, the experiments could become a solid empirical contribution.

major comments (5)

[Section 2.3 and Tables 1–3] The membership inference attack that produces the reported Attacker Advantage is never specified. Section 2.3 gives only the formal membership experiment and the general definition of AdvM; it does not describe the attack algorithm, decision threshold, use of shadow models, number of attack queries, or model access (scores vs labels) that generated the numbers in Tables 1–3. Because every privacy comparison in the paper rests on these numbers, the central claim cannot be evaluated or reproduced. Please provide a concrete attack implementation, preferably with code or pseudocode, and report the attack's true/false positive rates.
[Sections 3.1–3.2, Tables 1–2] The DP baselines are under-specified. For MNIST and CIFAR-10, the paper reports only that DP-Adam from TensorFlow Privacy was used, with no noise multiplier, clipping norm, or privacy budget (epsilon, delta). Even for the text task, where the noise multiplier (1.1) and clipping norm (1.0) are given, no epsilon is reported. Without knowing the DP strength, the statement that L2 regularization can outperform DP in accuracy and privacy is not a well-defined comparison; the DP baseline could be arbitrarily weak or strong.
[Section 3.3 and Section 4] The reported 0.93 correlation between the training–validation accuracy gap and attacker advantage is essentially the known Yeom et al. [28] relationship between generalization gap and membership advantage. Since L2 regularization directly reduces the accuracy gap, the claimed privacy benefit is largely a restatement of its effect on overfitting. The paper should present the correlation as a mechanistic confirmation, not as an independent empirical discovery, and should provide evidence that the reported AA values are not algebraically determined by the gap—for example, by plotting the attack's ROC curve or by comparing AA against a threshold calibrated on the gap.
[Table 1, MNIST results] On MNIST, attacker advantage is flat across all lambda values for both Baseline and DP models (all values are between 1.48 and 1.90 with overlapping standard deviations). The paper acknowledges this in Section 3.1, but Section 4 concludes that L2 regularization reduces the attacker's advantage. This is an overstatement unless the MNIST null result is explicitly explained or the conclusion is restricted to the CIFAR-10 and text results.
[Table 3, text classification results] In the text task, the Baseline model's attacker advantage never drops below the DP model's attacker advantage at any lambda value (e.g., 0.73 vs 0.21 at lambda = 0.0005). The only configuration where a non-DP regularized model has lower attacker advantage than DP is CIFAR-10 at lambda = 0.005 (1.21 vs 1.58). The claim that L2 regularization 'sometimes outperforms' DP in both accuracy and privacy therefore rests on a single configuration, and the conclusion should state this limitation explicitly.

minor comments (5)

[Sections 2.1 and 2.3] There are several typos: 'non linera' should be 'non-linear', and 'This deference means' should be 'This difference means'. The displayed equivalence for AdvM also needs notation that ties the probabilities to the adversary's output, e.g., Pr[A(z, AS, n, D) = 0 | b = 0] - Pr[A(z, AS, n, D) = 0 | b = 1].
[References] Reference [2] is listed as 'Deep learning with differential privacy' by Abadi et al., identical to reference [1], but the text uses [2] for the TensorFlow Privacy library. The citation should point to the actual TensorFlow Privacy software release.
[Figure 4] Figure 4 appears to contain garbled text (the string '/uni00000013/uni00000011/...' instead of proper axis labels). This is likely a PDF encoding issue and must be fixed before publication.
[Table 1 and Figure captions] The lambda values are presented as a bottom row in Table 1 and in similar tables, which is confusing because the caption says the table reports averages and standard deviations. Please clarify that each column corresponds to a different lambda value, or restructure the table so that lambda is a column header.
[Introduction, related work] The Introduction states that the impact of regularization on Membership Inference Attacks 'has not been systematically explored', but the manuscript itself cites Kaya et al. [11], whose title is exactly 'On the effectiveness of regularization against membership inference attacks'. The paper should discuss that prior work and clearly state what the new experiments add beyond it.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the paper's L2 regularization result is an empirical measurement, not a definitional reduction, and the missing attack specification is a reproducibility issue rather than a circular step.

full rationale

The paper's central claim is that L2 regularization reduces membership-inference attacker advantage while preserving accuracy. The reported attacker advantage values are direct measurements from an attack whose implementation is never described, but the paper does not define attacker advantage in terms of the train/validation accuracy gap. Section 2.3 formally defines membership advantage via the membership experiment and true/false positive rates; Section 3.3 then reports an empirical correlation: 'we observed a correlation coefficient of 0.93, indicating a strong positive correlation between these two metrics.' That correlation is a measured relationship, not an equation setting the attacker advantage equal to the accuracy gap by construction. The conclusion that L2 regularization reduces attacker advantage follows from the tables showing lower AA at higher lambda, not from a fit or from a self-citation chain. The paper explicitly relies on the known overfitting-MIA connection, citing Yeom et al., but restating a cited mechanism is not circularity. The serious weaknesses are the underspecified membership inference attack, the missing DP noise multiplier and privacy budget for MNIST and CIFAR-10, and the lack of code or external benchmarks. These are validity and reproducibility threats, not circular reductions, so they do not raise the circularity score.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the validity of the attacker advantage metric, an unspecified attack implementation, an under-specified DP configuration, and the known overfitting-membership connection. No genuinely new entities are introduced. The L2 grid and DP text settings are hand-chosen hyperparameters, not fitted constants.

free parameters (2)

L2 regularization strength grid (lambda) = 0, 0.001, 0.002, 0.003, 0.004, 0.005 for images; 0, 0.0001, ..., 0.0005 for text
Chosen by hand as a sweep; not fitted to data, but the privacy conclusions depend on the selected range and the specific grid values.
DP noise multiplier and clipping norm for text task = noise multiplier 1.1, clipping norm 1.0
Reported only for text; the image DP runs do not report these values, so the DP comparison is under-specified.

assumptions (4)

domain assumption The Attacker Advantage metric from Yeom et al. is a valid measure of membership inference risk.
Section 2.3 adopts this metric without justifying that it captures the privacy threat relevant for comparing L2 and DP.
domain assumption The unstated membership inference attack is a representative strong adversary.
Section 3 reports attacker advantage values but never describes the attack algorithm, so the numbers rest on an implicit attack implementation.
domain assumption The DP models used for MNIST and CIFAR-10 are configured with standard, unspecified noise and clipping settings.
Section 3.1 states only that DP-Adam replaced Adam; without noise multiplier and clipping norm, the DP comparison is not well-defined.
domain assumption Train/validation accuracy gap is a sufficient proxy for overfitting and membership inference vulnerability.
Section 3.3 treats the correlation between accuracy gap and attacker advantage as a finding, though prior work [28] already established this connection.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Effectiveness of L2 Regularization in Privacy-Preserving Machine Learning." pith.science (2026). https://pith.science/paper/Z45BJ43Z

@misc{pith2026241201541,
  author       = {Pith},
  title        = {Pith review of: Effectiveness of L2 Regularization in Privacy-Preserving Machine Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Z45BJ43Z}},
  note         = {Machine review of arXiv:2412.01541}
}

read the original abstract

Artificial intelligence, machine learning, and deep learning as a service have become the status quo for many industries, leading to the widespread deployment of models that handle sensitive data. Well-performing models, the industry seeks, usually rely on a large volume of training data. However, the use of such data raises serious privacy concerns due to the potential risks of leaks of highly sensitive information. One prominent threat is the Membership Inference Attack, where adversaries attempt to deduce whether a specific data point was used in a model's training process. An adversary's ability to determine an individual's presence represents a significant privacy threat, especially when related to a group of users sharing sensitive information. Hence, well-designed privacy-preserving machine learning solutions are critically needed in the industry. In this work, we compare the effectiveness of L2 regularization and differential privacy in mitigating Membership Inference Attack risks. Even though regularization techniques like L2 regularization are commonly employed to reduce overfitting, a condition that enhances the effectiveness of Membership Inference Attacks, their impact on mitigating these attacks has not been systematically explored.

Figures

Figures reproduced from arXiv: 2412.01541 by the authors.

**Figure 2.** Effect of L2 regularization on the CNN model trained on the CIFAR10 dataset. The figure illustrates the relationship between validation accuracy and attacker advantage across different L2 regularization strengths (λ) for both Baseline (non-DP) and DP models. called ”vulnerability”, which indicates whether the author of the tweet belongs to a vulnerable group or not. The vulnerable group is defined as a group of peo… view at source ↗

**Figure 3.** Effect of L2 regularization on the text classification task. The top plot shows the validation accuracy across different L2 regularization strengths (λ) for both Baseline (non-DP) and DP models. The bottom plot illustrates the corresponding attacker advantage for each model [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Correlation between the accuracy difference (training accuracy minus validation accuracy) and attacker advantage. The plot demonstrates a strong positive correlation (correlation coefficient of 0.93). These findings indicate that the gap between training and evaluation…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 19 canonical work pages

[28]

In: 2018 IEEE 31st computer security foundations symposium (CSF)

Yeom, S., Giacomelli, I., Fredrikson, M., Jha, S.: Privacy risk in machine learning: Analyzing the connection to overfitting. In: 2018 IEEE 31st computer security foundations symposium (CSF). pp. 268–282. IEEE (2018)

2018
[2]

In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security

Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. pp. 308–318 (2016)

work page 2016
[3]

IEEE Internet of Things Journal 7(7), 5827–5842 (2019) Effectiveness of L2 Regularization in Privacy-Preserving Machine Learning 17

Arachchige, P.C.M., Bertok, P., Khalil, I., Liu, D., Camtepe, S., Atiquzzaman, M.: Local differential privacy for deep learning. IEEE Internet of Things Journal 7(7), 5827–5842 (2019) Effectiveness of L2 Regularization in Privacy-Preserving Machine Learning 17

work page 2019
[4]

Test15, 271–344 (2006)

Bickel, P.J., Li, B., Tsybakov, A.B., van de Geer, S.A., Yu, B., Vald´ es, T., Rivero, C., Fan, J., van der Vaart, A.: Regularization in statistics. Test15, 271–344 (2006)

work page 2006
[5]

Mathematics 10(8), 1283 (2022)

Chan, J.Y.L., Leow, S.M.H., Bea, K.T., Cheng, W.K., Phoong, S.W., Hong, Z.W., Chen, Y.L.: Mitigating the multicollinearity problem and its machine learning ap- proach: a review. Mathematics 10(8), 1283 (2022)

work page 2022
[6]

CRC Press (Oct 2018), http: //dx.doi.org/10.1201/9781315273570

Gurney, K.: An Introduction to Neural Networks. CRC Press (Oct 2018), http: //dx.doi.org/10.1201/9781315273570

doi:10.1201/9781315273570 2018
[7]

ithaca-project.eu/, [Accessed 2024-11-27]

Horizon, E.U.: Artificial intelligence to enhance civic participation, https://www. ithaca-project.eu/, [Accessed 2024-11-27]

work page 2024
[8]

In: 2021 Interna- tional Joint Conference on Neural Networks (IJCNN)

Hu, H., Salcic, Z., Dobbie, G., Chen, Y., Zhang, X.: Ear: an enhanced adversarial regularization approach against membership inference attacks. In: 2021 Interna- tional Joint Conference on Neural Networks (IJCNN). pp. 1–8. IEEE (2021)

work page 2021

Show all 29 references

[9]

https://www.kaggle.com/ datasets/ashwiniyer176/toxic-tweets-dataset/data (2020), [Accessed 2024- 04-22]

Iyer, A.: Toxic Tweets Dataset — kaggle.com. https://www.kaggle.com/ datasets/ashwiniyer176/toxic-tweets-dataset/data (2020), [Accessed 2024- 04-22]

2020
[10]

In: Chiappa, S., Calandra, R

Jiang, H., Nachum, O.: Identifying and correcting label bias in machine learn- ing. In: Chiappa, S., Calandra, R. (eds.) Proceedings of the Twenty Third In- ternational Conference on Artificial Intelligence and Statistics. Proceedings of Machine Learning Research, vol. 108, pp...

2020
[11]

arXiv preprint arXiv:2006.05336 (2020)

Kaya, Y., Hong, S., Dumitras, T.: On the effectiveness of regularization against membership inference attacks. arXiv preprint arXiv:2006.05336 (2020)

2020 arXiv
[12]

arXiv preprint arXiv:1412.6980 (2014)

Kingma, D.P.: Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)

2014 arXiv
[13]

Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)

2009
[14]

Proceedings of the IEEE 86(11), 2278–2324 (1998)

Lecun, Y., Bottou, L., Bengio, Y., Haffner, P.: Gradient-based learning applied to document recognition. Proceedings of the IEEE 86(11), 2278–2324 (1998). https://doi.org/10.1109/5.726791

1998 doi
[15]

ACM Computing Surveys (CSUR) 54(2), 1–36 (2021)

Liu, B., Ding, M., Shaham, S., Rahayu, W., Farokhi, F., Lin, Z.: When machine learning meets privacy: A survey and outlook. ACM Computing Surveys (CSUR) 54(2), 1–36 (2021)

2021
[16]

In: International Conference on Machine Learning

Phan, H., Thai, M.T., Hu, H., Jin, R., Sun, T., Dou, D.: Scalable differential privacy with certified robustness in adversarial learning. In: International Conference on Machine Learning. pp. 7683–7694. PMLR (2020)

2020
[17]

In: 2017 IEEE international conference on data mining (ICDM)

Phan, N., Wu, X., Hu, H., Dou, D.: Adaptive laplace mechanism: Differential privacy preservation in deep learning. In: 2017 IEEE international conference on data mining (ICDM). pp. 385–394. IEEE (2017)

2017
[18]

Neural Networks 61, 85–117 (Jan 2015)

Schmidhuber, J.: Deep learning in neural networks: An overview. Neural Networks 61, 85–117 (Jan 2015). https://doi.org/10.1016/j.neunet.2014.09.003

2015 doi
[19]

Cambridge University Press (2014)

Shalev-Shwartz, S., Ben-David, S.: Understanding Machine Learning: From Theory to Algorithms. Cambridge University Press (2014)

2014
[20]

Inter- national Journal of Engineering Applied Sciences and Technology 04(12), 310–316 (May 2020)

Sharma, S., Sharma, S., Athaiya, A.: Activation functions in neural networks. Inter- national Journal of Engineering Applied Sciences and Technology 04(12), 310–316 (May 2020). https://doi.org/10.33564/ijeast.2020.v04i12.054

2020 doi
[21]

In: 2017 IEEE symposium on security and privacy (SP)

Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks against machine learning models. In: 2017 IEEE symposium on security and privacy (SP). pp. 3–18. IEEE (2017)

2017
[22]

Harvard university press (2010) 18 N

Solove, D.J.: Understanding privacy. Harvard university press (2010) 18 N. Chandrinos et al

2010
[23]

In: 30th USENIX Security Symposium (USENIX Security 21)

Song, L., Mittal, P.: Systematic evaluation of privacy risks of machine learning models. In: 30th USENIX Security Symposium (USENIX Security 21). pp. 2615– 2632 (2021)

2021
[24]

IEEE Access8, 167425– 167447 (2020)

Tanuwidjaja, H.C., Choi, R., Baek, S., Kim, K.: Privacy-preserving deep learning on machine learning as a service—a comprehensive survey. IEEE Access8, 167425– 167447 (2020)

2020
[25]

arXiv preprint arXiv:1707.09725 (2017)

Thoma, M.: Analysis and optimization of convolutional neural network architec- tures. arXiv preprint arXiv:1707.09725 (2017)

2017 arXiv
[26]

Gaithersburg, MD (2024)

Vassilev, A., Oprea, A., Fordyce, A., Anderson, H.: Adversarial machine learning. Gaithersburg, MD (2024)

2024
[27]

arXiv preprint arXiv:2108.04417 (2021)

Xu, R., Baracaldo, N., Joshi, J.: Privacy-preserving machine learning: Methods, challenges and directions. arXiv preprint arXiv:2108.04417 (2021)

2021 arXiv
[29]

In: Proceedings of the 2020 Workshop on Privacy-Preserving Machine Learning in Practice

Ying, Z., Zhang, Y., Liu, X.: Privacy-preserving in defending against membership inference attacks. In: Proceedings of the 2020 Workshop on Privacy-Preserving Machine Learning in Practice. pp. 61–63 (2020)

2020
[30]

Procedia Computer Science 169, 393–399 (2020)

Zapechnikov, S.: Privacy-preserving machine learning as a tool for secure person- alized information services. Procedia Computer Science 169, 393–399 (2020)

2020

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [28]

In: 2018 IEEE 31st computer security foundations symposium (CSF)

Yeom, S., Giacomelli, I., Fredrikson, M., Jha, S.: Privacy risk in machine learning: Analyzing the connection to overfitting. In: 2018 IEEE 31st computer security foundations symposium (CSF). pp. 268–282. IEEE (2018)

2018

[2] [2]

In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security

Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. pp. 308–318 (2016)

work page 2016

[3] [3]

IEEE Internet of Things Journal 7(7), 5827–5842 (2019) Effectiveness of L2 Regularization in Privacy-Preserving Machine Learning 17

Arachchige, P.C.M., Bertok, P., Khalil, I., Liu, D., Camtepe, S., Atiquzzaman, M.: Local differential privacy for deep learning. IEEE Internet of Things Journal 7(7), 5827–5842 (2019) Effectiveness of L2 Regularization in Privacy-Preserving Machine Learning 17

work page 2019

[4] [4]

Test15, 271–344 (2006)

Bickel, P.J., Li, B., Tsybakov, A.B., van de Geer, S.A., Yu, B., Vald´ es, T., Rivero, C., Fan, J., van der Vaart, A.: Regularization in statistics. Test15, 271–344 (2006)

work page 2006

[5] [5]

Mathematics 10(8), 1283 (2022)

Chan, J.Y.L., Leow, S.M.H., Bea, K.T., Cheng, W.K., Phoong, S.W., Hong, Z.W., Chen, Y.L.: Mitigating the multicollinearity problem and its machine learning ap- proach: a review. Mathematics 10(8), 1283 (2022)

work page 2022

[6] [6]

CRC Press (Oct 2018), http: //dx.doi.org/10.1201/9781315273570

Gurney, K.: An Introduction to Neural Networks. CRC Press (Oct 2018), http: //dx.doi.org/10.1201/9781315273570

doi:10.1201/9781315273570 2018

[7] [7]

ithaca-project.eu/, [Accessed 2024-11-27]

Horizon, E.U.: Artificial intelligence to enhance civic participation, https://www. ithaca-project.eu/, [Accessed 2024-11-27]

work page 2024

[8] [8]

In: 2021 Interna- tional Joint Conference on Neural Networks (IJCNN)

Hu, H., Salcic, Z., Dobbie, G., Chen, Y., Zhang, X.: Ear: an enhanced adversarial regularization approach against membership inference attacks. In: 2021 Interna- tional Joint Conference on Neural Networks (IJCNN). pp. 1–8. IEEE (2021)

work page 2021