The Impact of Generalization Techniques on the Interplay Among Privacy, Utility, and Fairness in Image Classification

Ahmad Hassanpour; Amir Zarei; Anderson Santana de Oliveira; Bian Yang; Khawla Mallat

REVIEW 4 major objections 6 minor 40 references

The Impact of Generalization Techniques on the Interplay Among Privacy, Utility, and Fairness in Image Classification

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that swapping DP-SGD for DP-SAT inside a set of generalization techniques pushes differentially private CIFAR-10 accuracy to 81.11% under $(8, 10^{-5})$-DP, and that the same techniques systematically amplify model bias…

desk verdict A solid empirical paper with a new DP-SAT accuracy record and useful fairness findings; the headline privacy guarantee needs implementation-level verification. read the letter →

arxiv 2412.11951 v1 pith:4R365VKL submitted 2024-12-16 cs.LG cs.AI

Ahmad Hassanpour , Amir Zarei , Khawla Mallat , Anderson Santana de Oliveira , Bian Yang This is my paper · ORCID

classification cs.LGcs.AI

keywords differentialprivacyDP-SATsharpness-awaretraininggeneralizationtechniquesmodelbiasmembershipinferenceattackharmonicscoreCIFAR-10

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Private image classification usually pays a large accuracy tax: strong differential privacy, the guarantee that removing any one person's image barely changes the model, typically costs many accuracy points. The paper investigates a known remedy, a fixed sequence of generalization techniques (group normalization, optimal batch size, weight standardization, augmentation multiplicity, parameter averaging), and asks what happens when the final optimizer is swapped from DP-SGD to DP-SAT, a sharpness-aware private optimizer. Its central empirical result is that this swap raises CIFAR-10 accuracy under $(8, 10^{-5})$-DP to 81.11%, above the 79.5% previously reported, without extra data. The paper also argues that these accuracy gains are not free: the same techniques amplify model bias on biased data, memorization of individual training samples can begin before overfitting, biased training data makes membership inference easier, and removing the most vulnerable samples lowers accuracy and deepens bias. It introduces a harmonic score that combines accuracy, membership-inference privacy, and fairness into a single number for judging the three-way trade-off.

What carries the argument

The empirical engine is DP-SAT, differentially private sharpness-aware training, which seeks flat minima by reusing the previous step's perturbed gradient rather than perturbing the current batch twice; according to [25] this costs no additional privacy budget. It is appended to the generalization pipeline from [8]: group normalization, optimal batch size, weight standardization, augmentation multiplicity, and parameter averaging, each defined in the paper as a modification that improves private training without extra privacy cost. Differential privacy itself is the $(\epsilon,\delta)$ guarantee that adding or removing one example changes output probabilities by at most $\exp(\epsilon)$ plus $\delta$, with cumulative loss tracked by a privacy accountant. The measurement side uses membership inference attacks summarized by MIA AUC, the bias metrics of [36] on CIFAR-10S, CIFAR-100S, and CelebA, and the proposed harmonic score, which turns accuracy, MIA AUC, and bias into a single value in (0,1].

What would settle it

Trace a single DP-SAT update and check whether the reused perturbed gradient is a function of previous steps only; if it depends on any sample in the current batch, the claimed $(8, 10^{-5})$ guarantee does not hold. A simpler check is to reproduce the exact CIFAR-10 recipe and see whether a strong membership inference attack keeps MIA AUC near 0.5 despite the stated DP budget.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central claim is that DP-SAT, placed as the final step of the generalization pipeline from [8], is a drop-in replacement for DP-SGD that improves the privacy-utility frontier at the same DP guarantee. The headline number is 81.11% test accuracy on CIFAR-10 under $(8, 10^{-5})$-DP with a 16-layer Wide-ResNet and no extra data, above the 79.5% previously reported, with similar gains across privacy budgets on CIFAR-10 and CIFAR-100. The paper further claims that the same recipe that lifts accuracy sharply also amplifies bias on synthetic-bias benchmarks by factors between 2.6 and 9, and that more biased training data lowers accuracy and raises membership-inference vulnerability even under DP. It reports that vulnerable samples can be memorized before the early-stopping or overfitting point, so generalization techniques do not guarantee privacy, and that repeatedly deleting the highest-risk outlier samples lowers accuracy and increases bias instead of removing privacy risk. Finally, it introduces the harmonic score, the harmonic mean of accuracy, one minus scaled MIA AUC, and one minus scaled bias, as a single number for judging the three-way balance.

Load-bearing premise

The privacy-utility point rests entirely on the theorem from [25] that DP-SAT's reuse of the previous step's perturbed gradient costs no additional privacy budget; the paper adopts that theorem without independently verifying the implementation, and if the reused gradient carries information from the current batch, the effective privacy loss would exceed the stated bound.

Editorial extensions

If this is right

If correct, DP-SAT can replace DP-SGD inside the standard generalization pipeline and improve accuracy at every tested privacy budget on CIFAR-10 and CIFAR-100, making it the better default private optimizer for these image benchmarks.
The accuracy gains from group normalization, large batches, weight standardization, augmentation multiplicity, parameter averaging, and SAT come with measurable bias amplification in both private and non-private models, so private-model deployments should monitor fairness jointly with accuracy.
Biased training data makes membership inference easier and private training less protective, implying that data-cleaning or debiasing is itself a privacy measure.
Because memorization can begin before overfitting, early stopping and generalization techniques do not by themselves prevent privacy leakage; MIA-based auditing is still needed.
Outlier removal cannot be used as a simple privacy defense: it lowers accuracy, amplifies bias, and exposes new vulnerable samples, consistent with the Onion Effect the paper extends.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial extension: the paper does not claim bias amplification is unavoidable; a direct test would combine the same pipeline with bias-mitigation reweighting and see whether the accuracy gains persist while bias growth shrinks.
The harmonic score is a concrete scalarization, so a natural next step the paper leaves implicit is hyperparameter selection (noise multiplier, batch size, SAT radius) that directly optimizes HS instead of accuracy, which would change the chosen operating point.
The Onion Effect result suggests outlier removal alone cannot secure a model; pairing outlier removal with differential privacy, a combination the paper measures but does not optimize, is the more promising direction its own data hints at.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's what I'd tell you if we were grabbing coffee. The headline is a new empirical data point: 81.11% test accuracy under (8, 1e-5)-DP on CIFAR-10, using DP-SAT on top of De et al.'s generalization stack. That beats De et al.'s 79.5% by a non-trivial margin and is the kind of number people in the private-image-classification crowd will want to know. The paper also documents that the generalization techniques, applied one by one and cumulatively, amplify bias on the skewed CIFAR variants, and that DP doesn't undo that. These are useful observations.

What's good: the ablation is systematic, five seeds with medians and standard deviations, benchmarked against external results, and validated on CelebA. The authors are honest about limitations, including the fixed additive sequence and the simplicity of the Harmonic Score. That score is a plain harmonic mean of accuracy, inverse MIA AUC, and inverse bias—nothing deep, but they don't oversell it.

Where I'd push back: the load-bearing assumption is that the DP-SAT implementation reuses the previous step's perturbed gradient exactly as in Park et al., so no extra privacy budget is consumed. The paper gives a one-sentence description of that idea and never shows the update equations or verifies that the code matches the theorem's assumptions. The stress-test note worries that even one extra per-batch gradient computation would double sensitivity and invalidate the (8, 1e-5) guarantee. That isn't a claim that the number is wrong; it's a demand for evidence. The authors need to show their DP-SAT update or point to code that can be checked. This is the one thing that could sink the headline, so it needs real treatment.

Secondary issues, in increasing order of annoyance: the memorization-before-overfitting claim comes from tracking a single training sample, which is anecdote, not evidence; the Onion Effect analysis removes the top-risk samples but has no random-removal control, so the observed accuracy drop and MIA persistence can't be attributed to the Onion Effect; and they pick the MIA attack per dataset after seeing the results (MLP everywhere except RF on DP-CIFAR-100S), which is post-hoc selection and makes the cross-dataset comparisons hard to interpret. Some trend figures lack error bars, though the tables have them.

Bottom line: the central accuracy result is plausible and worth checking, but the paper needs a revision that nails down the DP-SAT implementation and adds the missing controls. I'd send it to peer review and ask for those changes.

Referee Report

4 major / 6 minor

Summary. This paper empirically studies how a set of generalization techniques (group normalization, optimal batch size, weight standardization, augmentation multiplicity, parameter averaging, and sharpness-aware training) affects the interplay between privacy, utility, and fairness in image classification. The authors report a headline accuracy of 81.11% under (8, 10^-5)-DP on CIFAR-10 using DP-SAT combined with the De et al. (2022) generalization techniques, surpassing the previously reported 79.5%. They also introduce a Harmonic Score (HS) metric to balance accuracy, privacy (measured by MIA AUC), and fairness (measured by bias), analyze memorization before overfitting, study the effect of training-data bias on privacy and fairness in synthetic (CIFAR-10S/100S) and real-world (CelebA) settings, and extend the Onion Effect analysis to multiple datasets and private/non-private models. The paper is primarily empirical, with five-seed runs and median reporting, and it provides an anonymous code link.

Significance. If the 81.11% result is valid, it is a useful benchmark point: it demonstrates that DP-SAT can replace DP-SGD inside the De et al. pipeline and achieve a nontrivial accuracy gain under the same nominal DP guarantee. The paper also contributes a broad set of empirical observations about how generalization techniques affect fairness and privacy leakage, and it proposes a simple aggregate metric (HS). The reproducibility efforts (seed-averaged results, public code) are commendable. However, the breadth of claims comes at the cost of depth: several supporting results rest on single-sample evidence, missing control conditions, or inconsistent metric choices, and the central privacy claim depends on an unverified implementation assumption about DP-SAT.

major comments (4)

[Section 2.2 and Table 4] The (8, 10^-5)-DP guarantee for the headline 81.11% accuracy is not verified. The paper relies on Park et al.'s theorem that reusing the previous step's perturbed gradient in DP-SAT does not consume additional privacy budget, but it does not provide the exact DP-SAT update equations used, nor does it show that the implementation satisfies the theorem's assumptions, especially when combined with augmentation multiplicity and parameter averaging. If the implementation ever computes an ascent gradient from the current batch, the per-step sensitivity would increase and the Rényi accountant would undercount epsilon. Because the central contribution is an accuracy number under a stated DP guarantee, the authors should either provide a precise algorithm description and a privacy proof for their composed pipeline, or explicitly identify the exact DP-SAT implementation used and how the privacy accountant is composed with it.
[Section 4.4 and Figures 5, 6, 9] The Onion Effect claim is not supported by a random-removal baseline. The authors repeatedly remove the 5,000 samples with the highest MIA risk and observe that MIA AUC stays roughly constant or decreases slightly. Without a control condition that removes the same number of samples at random, the persistence of MIA AUC cannot be attributed to a 'peeling' phenomenon; it could be a general property of the reduced dataset size or of the retraining procedure. The authors should add a random-removal baseline (or another appropriate null model) before claiming that removing outliers exposes new vulnerable layers.
[Section 2.3, Table 3, and Table 6] The Harmonic Score is not computed under a consistent privacy metric across datasets. The paper reports MIA AUC of the MLP attack for all experiments except for the DP-trained model on CIFAR-100S, where it reports the RF attack (Section 2.3), while Table 3's caption states that the highest MIA AUC among the four attacks is reported. HS comparisons across datasets (e.g., Table 6, Figure 1e) therefore mix attack models, and a difference in HS could be an artifact of attack choice rather than a genuine difference in the privacy-utility-fairness trade-off. The authors should either report HS under a single attack consistently or justify why the exception does not affect comparability.
[Section 4.1.1 and Figure 2] The claim that memorization can begin before the overfitting point is based on tracking a single training sample. The abstract and conclusions state this as a general finding ('memorization of training samples can begin before the overfitting point'), but with n=1 the result is anecdotal. The authors should aggregate membership-probability trajectories over multiple samples (e.g., report the distribution of the epoch at which high membership probability first appears) or otherwise show that the phenomenon is not specific to the single plotted sample.

minor comments (6)

[Equation (3)] The HS formula is undefined when 1 - AUCscaled = 0 (i.e., AUC = 1) or 1 - Biasscaled = 0 (i.e., scaled bias = 1); the domain of the inputs should be stated explicitly.
[Table 3 caption] The caption says 'the highest MIA AUC among the four attacks is reported,' but Section 2.3 says the MLP attack is reported everywhere except for DP-CIFAR-100S, where RF is used; please clarify which attack corresponds to each column.
[Section 4.4] The percentages for outlier removal (10%, 11.1%, 12.5%) are relative to the remaining dataset size; state the absolute number of samples removed in each round to avoid ambiguity.
[Figure 2] The subplots are dense and the labels (ES, OF, MP, AUC) are small; consider larger fonts and separate curves for readability.
[Table 5] There is a typo in the column header 'Wihtout DP' that should read 'Without DP.'
[Section 5] The weighted mAP formula is described in words but not defined precisely; please provide the explicit equation used for the weighted average precision.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the empirical benchmark claims are compared against external baselines, and the paper's own metric is presented as a definition rather than as a derived prediction.

full rationale

The paper's central claim, the 81.11% accuracy under (8, 10^-5)-DP on CIFAR-10, is an empirical result measured on the official test set and compared with De et al.'s published 79.5% external baseline. The DP-SAT privacy guarantee is adopted from Park et al. (ICML 2023), an external source with no author overlap with this paper; whether the implementation matches the theorem is a verifiability or correctness risk, not a circular derivation. The newly introduced Harmonic Score (Eq. 3) is explicitly defined as the harmonic mean of accuracy, (1 - normalized MIA AUC), and (1 - normalized bias), and it is used descriptively to rank models; it is not used to derive a prediction from its own definition, so no self-definitional circularity is present. The Onion Effect analysis selects outliers using the MLP attack's privacy risk scores and then measures MIA AUC of the same attack family after removal; the reported stability or slight decline in AUC after removing high-risk samples is an empirical observation that is not forced by construction, because the AUC could plausibly have dropped substantially. The only self-citation, reference [10] by co-author de Oliveira, appears in a background list of studies on differential privacy's disparate impact and is not load-bearing for any central result. Overall, no step in the paper's claimed derivation chain reduces by construction to its own inputs, so the circularity score is 0.

Assumptions & free parameters 4 free parameters · 5 assumptions · 1 invented entities

The headline accuracy depends on the correctness of the RDP accountant and on Park et al.'s DP-SAT privacy theorem, both taken from prior work without formal verification. The fairness and privacy narrative additionally depends on the bias metric of Eq. 1 and on MIA AUC as a proxy for membership leakage. HS is a new composite score with no external validation.

free parameters (4)

SAT perturbation radius = 0.05 for CIFAR-10/10S; 0.03 for CIFAR-100/100S and CelebA
Chosen by experimental exploration in Section 3.3. The accuracy gain attributed to SAT and DP-SAT depends on this radius.
Batch size (OBS) = 4096 private CIFAR-10/10S and CelebA; 16348 private CIFAR-100/100S; 32 or 64 non-private
Optimal batch size is one of the core generalization techniques from De et al.; values are set per dataset and per setting in Table 1.
Learning rate = 4, 2, or 1 for private CIFAR settings; 0.01 for non-private CIFAR; 10^-4 for CelebA without DP
Taken from prior work or experimental exploration in Section 3.3, the learning rate affects all reported accuracy values.
Group normalization groups and augmentation multiplicity = GN=16 for CIFAR/CelebA private, 1 for non-private CIFAR; AM=16 for CIFAR, absent for CelebA without DP
GN group count and augmentation multiplicity are tuned over values 1, 2, 4, 8, 16 and form part of the generalization stack.

assumptions (5)

standard math RDP accountant (Mironov et al. 2019) gives valid privacy loss bounds for the DP-SGD noise schedules.
The 81.11% under (8, 10^-5)-DP relies on this accounting, as stated in Section 2.1. The paper does not audit the accountant.
domain assumption DP-SAT's reuse of the previous perturbed gradient does not consume additional privacy budget.
Section 2.2 adopts Park et al.'s claim that reusing the perturbed gradient causes no additional privacy or computational burden. The headline privacy guarantee depends on this theorem.
domain assumption Equation (1) bias metric isolates spurious color/gray bias from model accuracy on balanced test sets.
Section 3.2 states that the balanced test set ensures average accuracy directly reflects learned bias. This is the backbone of the fairness claims.
domain assumption MIA AUC from TensorFlow Privacy is a valid proxy for membership privacy risk in these private and non-private models.
All privacy conclusions in Sections 4.1 and 4.3 are drawn from MIA AUC as implemented in the TensorFlow Privacy library.
domain assumption Feldman's definition of memorization is captured by per-sample membership probability from an MIA.
The memorization-before-overfitting claim in Section 4.1.1 equates a high membership probability for one tracked sample with memorization.

invented entities (1)

Harmonic Score (HS)
purpose: Aggregate accuracy, MIA-based privacy, and bias into a single 0-1 score via harmonic mean.
Introduced in Section 3.2 as a new composite metric. There is no external validation that it captures the true trade-off, and its normalization choices (AUC in [0.5,1], bias in [0,0.5]) are ad hoc.

how reviews work

0 comments

Cite this review

Pith. "Pith review of The Impact of Generalization Techniques on the Interplay Among Privacy, Utility, and Fairness in Image Classification." pith.science (2026). https://pith.science/paper/4R365VKL

@misc{pith2026241211951,
  author       = {Pith},
  title        = {Pith review of: The Impact of Generalization Techniques on the Interplay Among Privacy, Utility, and Fairness in Image Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4R365VKL}},
  note         = {Machine review of arXiv:2412.11951}
}

abstract

This study investigates the trade-offs between fairness, privacy, and utility in image classification using machine learning (ML). Recent research suggests that generalization techniques can improve the balance between privacy and utility. One focus of this work is sharpness-aware training (SAT) and its integration with differential privacy (DP-SAT) to further improve this balance. Additionally, we examine fairness in both private and non-private learning models trained on datasets with synthetic and real-world biases. We also measure the privacy risks involved in these scenarios by performing membership inference attacks (MIAs) and explore the consequences of eliminating high-privacy risk samples, termed outliers. Moreover, we introduce a new metric, named \emph{harmonic score}, which combines accuracy, privacy, and fairness into a single measure. Through empirical analysis using generalization techniques, we achieve an accuracy of 81.11\% under $(8, 10^{-5})$-DP on CIFAR-10, surpassing the 79.5\% reported by De et al. (2022). Moreover, our experiments show that memorization of training samples can begin before the overfitting point, and generalization techniques do not guarantee the prevention of this memorization. Our analysis of synthetic biases shows that generalization techniques can amplify model bias in both private and non-private models. Additionally, our results indicate that increased bias in training data leads to reduced accuracy, greater vulnerability to privacy attacks, and higher model bias. We validate these findings with the CelebA dataset, demonstrating that similar trends persist with real-world attribute imbalances. Finally, our experiments show that removing outlier data decreases accuracy and further amplifies model bias.

Figures

Figures reproduced from arXiv: 2412.11951 by the authors.

**Figure 2.** The training and test accuracy for four training [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗

**Figure 3.** Examined the impact of different privacy budgets ( [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Figures from the paper (6 more)

**Figure 4.** Figure 4: Examined the impact of different privacy budgets [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]

**Figure 5.** Figure 5: The impact of removing outliers on model performance (a) accuracy, (b) MIA AUC, and (c) bias trained with and [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]

**Figure 6.** Figure 6: HS evaluation on CIFAR-10S and DP-CIFAR-10S [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]

**Figure 7.** Figure 7: Per-attribute average precision (AP) deterioration [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]

**Figure 8.** Figure 8: Examined the impact of different privacy budgets ( [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]

**Figure 9.** Figure 9: The impact of removing outliers on model performance (accuracy, MIA AUC, bias, and HS) trained with and without [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 15 canonical work pages

[1]

TensorFlow-Privacy

2024. TensorFlow-Privacy. https://github.com/tensorflow/privacy/tree/master/ tensorflow_privacy/privacy/privacy_tests/membership_inference_attack Ac- cessed: 2024-03-25

work page 2024
[2]

Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 308–318

2016
[3]

Rohan Anil, Badih Ghazi, Vineet Gupta, Ravi Kumar, and Pasin Manurangsi. 2021. Large-scale differentially private BERT. arXiv preprint arXiv:2108.01624 (2021)

arXiv 2021
[4]

Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. 2019. Differential privacy has disparate impact on model accuracy. Advances in neural information processing systems 32 (2019)

2019
[5]

Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nicolas Papernot, Andreas Terzis, and Florian Tramer. 2022. The privacy onion effect: Memorization is relative. Advances in Neural Information Processing Systems 35 (2022), 13263– 13276

work page 2022
[6]

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21) . 2633–2650

2021
[7]

Hongyan Chang and Reza Shokri. 2021. On the privacy risks of algorithmic fairness. In 2021 IEEE European Symposium on Security and Privacy (EuroS&P) . IEEE, 292–303

work page 2021
[8]

Soham De, Leonard Berrada, Jamie Hayes, Samuel L Smith, and Borja Balle. 2022. Unlocking high-accuracy differentially private image classification through scale. arXiv preprint arXiv:2204.13650 (2022)

arXiv 2022

Show all 40 references

[9]

Soham De and Sam Smith. 2020. Batch normalization biases residual blocks towards the identity function in deep networks. Advances in Neural Information Processing Systems 33 (2020), 19964–19975

2020
[10]

Anderson Santana de Oliveira, Caelin Kaplan, Khawla Mallat, and Tanmay Chakraborty. 2023. An empirical analysis of fairness notions under differen- tial privacy. arXiv preprint arXiv:2302.02910 (2023)

2023 arXiv
[11]

Friedrich Dörmann, Osvald Frisk, Lars Nørvang Andersen, and Christian Fischer Pedersen. 2021. Not all noise is accounted equally: How differentially private learning benefits from large sampling rates. In 2021 IEEE 31st International Work- shop on Machine Learning for Signal P...

2021
[12]

Jiawei Du, Hanshu Yan, Jiashi Feng, Joey Tianyi Zhou, Liangli Zhen, Rick Siow Mong Goh, and Vincent YF Tan. 2021. Efficient sharpness-aware minimiza- tion for improved training of neural networks. arXiv preprint arXiv:2110.03141 (2021)

2021 arXiv
[13]

Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006. Cali- brating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3 . Springer, 265–284

2006
[14]

Cynthia Dwork, Aaron Roth, et al. 2014. The algorithmic foundations of differ- ential privacy. Foundations and Trends® in Theoretical Computer Science 9, 3–4 (2014), 211–407

2014
[15]

Vitaly Feldman. 2020. Does learning require memorization? a short tale about a long tail. In Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing. 954–959

2020
[16]

Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. 2021. Sharpness-aware Minimization for Efficiently Improving Generalization. In Inter- national Conference on Learning Representations . https://openreview.net/forum? id=6Tm1mposlrM

2021
[17]

Georgi Ganev, Bristena Oprisanu, and Emiliano De Cristofaro. 2022. Robin hood and matthew effects: Differential privacy has disparate impact on synthetic data. In International Conference on Machine Learning . PMLR, 6944–6959

2022
[18]

Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Joan Puigcerver, Jessica Yung, Sylvain Gelly, and Neil Houlsby. 2020. Big transfer (bit): General visual repre- sentation learning. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceed...

2020
[19]

Alexey Kurakin, Shuang Song, Steve Chien, Roxana Geambasu, Andreas Terzis, and Abhradeep Thakurta. 2022. Toward training at imagenet scale with differen- tial privacy. arXiv preprint arXiv:2201.12328 (2022)

2022 arXiv
[20]

Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. 2015. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision. 3730–3738

2015
[21]

Yunhui Long, Vincent Bindschaedler, Lei Wang, Diyue Bu, Xiaofeng Wang, Haixu Tang, Carl A Gunter, and Kai Chen. 2018. Understanding membership inferences on well-generalized learning models. arXiv preprint arXiv:1802.04889 (2018)

2018 arXiv
[22]

Zelun Luo, Daniel J Wu, Ehsan Adeli, and Li Fei-Fei. 2021. Scalable differential privacy with sparse network finetuning. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 5059–5068

2021
[23]

Ninareh Mehrabi, Fred Morstatter, Nripsuta Saxena, Kristina Lerman, and Aram Galstyan. 2021. A Survey on Bias and Fairness in Machine Learning.ACM Comput. Surv. 54, 6, Article 115 (July 2021), 35 pages. https://doi.org/10.1145/3457607

2021 doi
[24]

Ilya Mironov, Kunal Talwar, and Li Zhang. 2019. R\’enyi differential privacy of the sampled gaussian mechanism. arXiv preprint arXiv:1908.10530 (2019)

2019 arXiv
[25]

Jinseong Park, Hoki Kim, Yujin Choi, and Jaewook Lee. 2023. Differentially private sharpness-aware training. InInternational Conference on Machine Learning. PMLR, 27204–27224

2023
[26]

Boris T Polyak and Anatoli B Juditsky. 1992. Acceleration of stochastic approx- imation by averaging. SIAM journal on control and optimization 30, 4 (1992), 838–855

1992
[27]

S Qiao, H Wang, C Liu, W Shen, and A Yuille. 2019. Micro-batch training with batch-channel normalization and weight standardization. arXiv 2019. arXiv preprint arXiv:1903.10520 (2019)

2019 arXiv
[28]

Pierre H Richemond, Jean-Bastien Grill, Florent Altché, Corentin Tallec, Florian Strub, Andrew Brock, Samuel Smith, Soham De, Razvan Pascanu, Bilal Piot, et al
[29]

Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al
[30]

Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2018. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246 (2018)

2018 arXiv
[31]

Shokri, M

R. Shokri, M. Stronati, C. Song, and V. Shmatikov. 2017. Membership Inference Attacks Against Machine Learning Models. In 2017 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, Los Alamitos, CA, USA, 3–18. https: //doi.ieeecomputersociety.org/10.1109/SP.2017.41

2017 doi
[32]

Liwei Song and Prateek Mittal. 2021. Systematic evaluation of privacy risks of machine learning models. In 30th USENIX Security Symposium (USENIX Security 21). 2615–2632

2021
[33]

Jasper Tan, Daniel LeJeune, Blake Mason, Hamid Javadi, and Richard G Baraniuk
[34]

Mingxing Tan and Quoc Le. 2019. Efficientnet: Rethinking model scaling for convolutional neural networks. In International conference on machine learning . PMLR, 6105–6114

2019
[35]

Archit Uniyal, Rakshit Naidu, Sasikanth Kotti, Sahib Singh, Patrik Joslin Kenfack, Fatemehsadat Mireshghallah, and Andrew Trask. 2021. Dp-sgd vs pate: Which has less disparate impact on model accuracy? arXiv preprint arXiv:2106.12576 (2021)

2021 arXiv
[36]

Zeyu Wang, Klint Qinami, Ioannis Christos Karakozis, Kyle Genova, Prem Nair, Kenji Hata, and Olga Russakovsky. 2020. Towards fairness in visual recognition: Effective strategies for bias mitigation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recog...

2020
[37]

Lauren Watson, Chuan Guo, Graham Cormode, and Alex Sablayrolles. 2021. On the importance of difficulty calibration in membership inference attacks. arXiv preprint arXiv:2111.08440 (2021). 14 The Interplay Among Privacy, Utility, and Fairness in Image Classification Proceedings...

2021 arXiv
[2015]

International journal of computer vision 115 (2015), 211–252

Imagenet large scale visual recognition challenge. International journal of computer vision 115 (2015), 211–252

2015
[2020]

arXiv preprint arXiv:2010.10241 (2020)

Byol works even without batch statistics. arXiv preprint arXiv:2010.10241 (2020)

2020 arXiv
[2023]

In International Conference on Artificial Intelligence and Statistics

A blessing of dimensionality in membership inference through regular- ization. In International Conference on Artificial Intelligence and Statistics . PMLR, 10968–10993. 13 Proceedings on Privacy Enhancing Technologies 2025(X) Hassanpour et al

2025

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

TensorFlow-Privacy

2024. TensorFlow-Privacy. https://github.com/tensorflow/privacy/tree/master/ tensorflow_privacy/privacy/privacy_tests/membership_inference_attack Ac- cessed: 2024-03-25

work page 2024

[2] [2]

Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 308–318

2016

[3] [3]

Rohan Anil, Badih Ghazi, Vineet Gupta, Ravi Kumar, and Pasin Manurangsi. 2021. Large-scale differentially private BERT. arXiv preprint arXiv:2108.01624 (2021)

arXiv 2021

[4] [4]

Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. 2019. Differential privacy has disparate impact on model accuracy. Advances in neural information processing systems 32 (2019)

2019

[5] [5]

Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nicolas Papernot, Andreas Terzis, and Florian Tramer. 2022. The privacy onion effect: Memorization is relative. Advances in Neural Information Processing Systems 35 (2022), 13263– 13276

work page 2022

[6] [6]

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21) . 2633–2650

2021

[7] [7]

Hongyan Chang and Reza Shokri. 2021. On the privacy risks of algorithmic fairness. In 2021 IEEE European Symposium on Security and Privacy (EuroS&P) . IEEE, 292–303

work page 2021

[8] [8]

Soham De, Leonard Berrada, Jamie Hayes, Samuel L Smith, and Borja Balle. 2022. Unlocking high-accuracy differentially private image classification through scale. arXiv preprint arXiv:2204.13650 (2022)

arXiv 2022