Pith. sign in

REVIEW 4 major objections 6 minor 55 references

When Better Features Mean Greater Risks: The Performance-Privacy Trade-Off in Contrastive Learning

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read As contrastive encoders become more powerful feature extractors, their training-data membership becomes easier to infer; the paper shows a single statistic — the p-norm of a feature vector — extracts that membership signal without…

desk verdict Useful lightweight MIA on encoder norms, but the headline trade-off is overclaimed and the evaluation has a few red flags. read the letter →

arxiv 2506.05743 v1 pith:KWGNNHB6 submitted 2025-06-06 cs.CR cs.AI

Ruining Sun , Hongsheng Hu , Wei Luo , Zhaoxi Zhang , Yanjun Zhang , Haizhuan Yuan , Leo Yu Zhang This is my paper
classification cs.CRcs.AI
keywords contrastivelearningmembershipinferenceattackprivacyleakagep-normlikelihoodestimationencodermodelsperformance-privacytrade-offself-supervised
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that in contrastive learning, the architectural improvements that make encoders better at extracting features also make them worse at protecting training-data privacy. Across the MoCo-v1-to-MoCo-v3 framework lineage and across ResNet and ViT backbones, higher downstream utility (k-NN accuracy) tracks higher membership-inference attack success, rising from near-random 50% to 75–98% accuracy. The paper then proposes LpLA, a lightweight membership attack that reads membership from a single number — the p-norm of the query image's feature vector — by comparing it against Gaussian estimates of member and non-member norm distributions. If the claim is right, an adversary with a few hundred black-box queries and no neural-network training can break the membership privacy of state-of-the-art contrastive encoders, a risk the paper itself notes remains untested against defenses and outside image data.

What carries the argument

The carrying object is the $p$-norm of the encoder's output feature vector, $L(x) = \|v_x\|_p$ for $p=2$ by default. The attack models the norms of members and non-members as two independent Gaussians, $L_m \sim \mathcal{N}(\mu_m, \sigma_m^2)$ and $L_{nm} \sim \mathcal{N}(\mu_{nm}, \sigma_{nm}^2)$, estimates the four parameters from a partial member set and from random-pixel 'non-member' queries, and classifies by the Bayes rule $P(m|x) > 0.5 \iff \mathcal{L}_m(x) > \mathcal{L}_{nm}(x)$ (Equation 14). This reduces membership inference to a univariate likelihood comparison: no attack classifier is trained, which is why the method survives limited sample counts and query budgets that starve the network-based baselines, and why the ablation shows likelihood estimation beating a naive norm-threshold rule by exploiting the variance estimates.

What would settle it

Measure the p-norm distributions of members, genuine held-out test images, and random-pixel images from a trained MoCo-v3 encoder, and apply a goodness-of-fit test (e.g., Shapiro-Wilk) to the member and non-member norm sets: if either norm distribution is strongly non-Gaussian, or if random-pixel norms fall well outside the range and variance of genuine held-out norms, then LpLA's decision rule (Equation 14) would misclassify members when evaluated against true in-domain non-members.

Watch

Extended reading notes

Core claim

The paper's claim has two parts. First, contrastive encoders exhibit a systematic performance-privacy trade-off: moving from MoCo-v1 to MoCo-v2 to MoCo-v3, or from ResNet-18 to ResNet-50 and ViT-Small to ViT-Base, improves feature-extraction utility while monotonically raising the accuracy of every membership-inference method tested, from chance-level ~50% to as high as 98% on CIFAR-100 and Tiny-ImageNet under MoCo-v3. Second, the magnitude of the feature vector is itself a membership signal: member and non-member p-norms separate into two approximately Gaussian clouds, so a Bayes likelihood-ratio test on the value $\|v_x\|_p$ (default $p=2$) decides membership as accurately as, and more robustly than, neural-network attacks that compare augmented-view similarities (EncoderMI), anchor-distance distributions (SD-MI), or raw features fed to a trained classifier (Fe-MI). Because LpLA only estimates two means and two variances, it stays accurate when the adversary holds as few as 100 member samples or 200 API queries — under which the network-based baselines decay — and it also succeeds against an official pre-trained ImageNet encoder.

Load-bearing premise

The attack assumes that the p-norm values of member and non-member feature vectors each form approximate bell curves and that an adversary can generate fake non-member images (e.g., random pixels) whose norm distribution matches the norms of genuine non-member images from the training domain, so the likelihood-ratio rule stays calibrated.

Editorial extensions

If this is right

  • Upgrading a contrastive encoder — a newer MoCo framework or a larger ResNet/ViT backbone — carries a measurable, systematic privacy cost, so model-selection decisions that ignore membership-inference risk are choosing higher leakage along with higher utility.
  • Because members' norm magnitudes separate from non-members' and the gap widens with training epochs, the leak lives in the geometry of the learned representation space, not in classifier confidence, so defenses aimed at overfitting or output calibration alone would miss it.
  • LpLA matches or beats the three neural-network baselines on CIFAR-10, CIFAR-100, and Tiny-ImageNet under MoCo-v3, and degrades the least when the adversary has 100–200 member samples or 200–500 queries — the regime the paper argues is the realistic black-box one.
  • The same univariate likelihood recipe that works for $p=2$ also works for $p=1,3,4,5$ (but not $p=0$), so the attack does not depend on one particular norm geometry.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's main attack-experiment protocol draws non-member samples from real test images (Section 3.4), yet the attack as designed tells the adversary to synthesize non-members from random pixel images (Section 4.2, Stage 1); the match between those two distributions is never directly measured, so LpLA's practical calibration under its own threat model remains an unverified extrapolation.
  • If the norm-gap mechanism is general, then contrastive and self-supervised families beyond MoCo — SimCLR, BYOL, masked-image encoders — should exhibit the same trade-off and the same one-statistic attack; that is a direct, testable transfer prediction the paper does not run.
  • The results point toward a cheap defensive lever the paper does not explore: if attack signal is carried by the magnitude of embeddings, then feature normalization (including the L2-normalization already common in contrastive pipelines) or norm-distribution regularization could shrink the separating gap, possibly at modest utility cost.
  • Read as an auditing tool, LpLA's near-perfect accuracy on MoCo-v3 (e.g., 0.982 on Tiny-ImageNet) gives regulators a warning that membership risk of modern self-supervised encoders can be probed with negligible computation, strengthening the case for differential-privacy treatments in encoder pretraining.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper studies membership inference attacks (MIA) against contrastive-learning encoders. It claims that more advanced encoders—both in terms of contrastive framework (MoCo-v1/v2/v3) and backbone (ResNet-18/50, ViT-Small/Base)—improve feature-extraction utility while simultaneously increasing membership-privacy leakage. It then proposes LpLA, an attack that models the p-norm of member and non-member feature vectors as two Gaussian distributions and performs inference via a likelihood ratio. Experiments on CIFAR-10, CIFAR-100, and Tiny-ImageNet compare LpLA against EncoderMI, SD-MI, and Fe-MI, including scenarios with limited member samples and limited API queries.

Significance. If the performance-privacy trade-off claim is correct, the paper identifies an important risk in a widely used model family, and LpLA is an elegant, lightweight attack that requires no neural-network attack model, uses few queries, and could serve as a useful baseline. The public code and clearly stated threat model are strengths. However, the current evidence for the causal trade-off is confounded, a key practical assumption about non-member construction is not tested, and at least one table reports impossible metric values; these issues prevent acceptance in the present form.

major comments (4)
  1. [Section 3.5, Table 2] The central trade-off claim is not cleanly supported because the MoCo-v1/v2/v3 progression changes many variables at once (batch size 256 vs 512, a 16,384-item queue vs in-batch negatives, the presence of projection/prediction heads, and the loss formulation), so utility and privacy differences cannot be attributed to 'architecture complexity' or to 'better features.' In the ResNet-18 row, MoCo-v2 and MoCo-v3 have nearly identical K-NN accuracy (0.523 vs 0.521) while Encoder-MI accuracy rises from 0.592 to 0.747, a direct counterexample to the monotonic 'better features, greater risks' narrative. The authors should either add within-framework controls (e.g., varying backbone capacity or training epochs while holding the framework fixed) or explicitly soften the claim to a correlational observation.
  2. [Section 4.1, Figure 5 and Section 4.2, Eq. (12)] The Gaussian assumption for p-norm distributions is supported only by a domain-shifted comparison: Figure 5 compares ImageNet members with CIFAR-100 non-members, so the observed separation may reflect dataset difference rather than membership. More importantly, the attack description in Section 4.2 states that the adversary can construct non-members from random-pixel images, but the experimental protocol in Section 3.4 uses real test-set images as non-members; the random-pixel variant is never evaluated. Consequently, LpLA's claimed robustness under limited attack knowledge is not actually tested. Please either evaluate LpLA with random-pixel non-members or restrict the claim to the setting where same-distribution non-members are available.
  3. [Table 3] The parenthetical TPR@0.1%FPR values (e.g., 3.181, 1.045, 5.858) exceed 1.0, which is impossible for a true positive rate, while Table 2 reports the same metric as fractions between 0 and 1. The paper must state the units, correct the numbers, or explain the discrepancy; as presented, the quantitative comparison in Table 3 is unreliable and undermines the claim that LpLA outperforms baselines.
  4. [Section 3.4] All target models are trained for 2,000 epochs on only 20k samples, and no repeated runs or confidence intervals are reported anywhere. This is an extreme memorization regime and a single-run evaluation, so the generality of both the performance-privacy trade-off and the attack rankings across typical contrastive pretraining (larger data, fewer epochs) is not established. At minimum, the paper should add variance across seeds and at least one experiment with a more standard training budget to show the phenomena are not artifacts of severe overtraining.
minor comments (6)
  1. [Section 2.2] The text describes [30] as the first and, at the time of writing, the only study on membership inference against contrastive learning encoders, but later cites [28] and [51] on the same topic; the sentence should be rephrased to avoid contradiction.
  2. [Section 4.2, Stage 1] The random-generation procedure for non-members is underspecified; please state the exact distribution used (e.g., uniform random pixels, Gaussian noise) and how it matches the target model's input format.
  3. [Figure 5] The axis label 'Data values' is vague; please indicate that it is the p-norm value of the encoder output, and clarify whether the histograms use the same feature dimensionality across the compared models.
  4. [Table 3 caption] The caption 'Attack accuracy (TPR@0.1%FPR)' is ambiguous; please state which number is accuracy and which is TPR, and specify the unit for TPR.
  5. [Eq. (14)] The notation Lm(x) and Lnm(x) conflicts with the loss L(x) in Eq. (6); consider using a different symbol, such as Lambda_m and Lambda_nm, for the likelihoods.
  6. [Conclusion] The conclusion says the work is based on 'theoretical analysis and experimental validation,' but no formal theoretical analysis is presented; either add a proof or derivation or change this wording.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: LpLA is fitted on a labeled attack set and evaluated on a disjoint test set, and the performance-privacy trade-off is an empirical measurement; only non-load-bearing self-citations are present.

full rationale

The paper's central attack, LpLA, estimates Gaussian parameters for member and non-member p-norm distributions from an attack dataset (Eq. 13) and then applies the resulting likelihood decision rule (Eqs. 14-15) to a disjoint inference test set composed of 8k member and 8k non-member samples (Section 3.4, Table 1). This is a fitted-then-tested evaluation, not a fitted parameter renamed as a prediction; the LpLA results in Tables 3 and 4 are held-out measurements. The Gaussian assumption in Eq. 12 is an explicit, testable modeling assumption supported by histogram evidence in Figure 5, and it is not derived from the attack's target result, so it is not circular. The trade-off claim is likewise an empirical correlation between K-NN accuracy and membership-inference accuracy across MoCo frameworks and backbones, with no equation-level reduction; confounds such as batch size, dictionary size, and head architecture, and the non-monotonic ResNet-18 row in Table 2, are correctness and interpretation concerns rather than circularity. The paper also states its own limitations (Section 4.5: no defense evaluation, image-only validation), which further shows the claims are empirical rather than derived. Citations that overlap with the authors, such as [22] (a survey by co-author Hongsheng Hu) and [32,47-49], appear in related-work and defense contexts and do not carry any load-bearing derivation. No self-citation chain forces the paper's conclusions, so the central contributions remain independent empirical findings.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The attack is a statistical classifier with a hand-picked norm order and fitted Gaussian parameters; the trade-off conclusion relies on metric proxies and on an untested assumption that framework complexity, not hyperparameter changes, drives leakage. No new physical or architectural entities are introduced.

free parameters (6)
  • p-norm order = 2 (default)
    Set by hand in Section 4.2; Figure 8 shows p=0 performs poorly and p>=2 saturates, so the default is selected after looking at attack accuracy.
  • Gaussian mean for member p-norm distribution = mu_member (dataset-specific)
    Estimated by Eq. 13 from the adversary's labeled member samples; the likelihood ratio in Eq. 14 depends directly on this fitted value.
  • Gaussian variance for member p-norm distribution = sigma_member^2 (dataset-specific)
    Estimated by Eq. 13 and used to weight deviations in the likelihood ratio; if the variance is wrong, the Bayes decision in Eq. 14 is miscalibrated.
  • Gaussian mean for non-member p-norm distribution = mu_non-member (dataset-specific)
    Estimated by Eq. 13; the paper claims the non-member set is random pixels, but the experiments appear to use test-set samples, so the fitted value may not match the claimed attack scenario.
  • Gaussian variance for non-member p-norm distribution = sigma_non-member^2 (dataset-specific)
    Estimated by Eq. 13 and used in the likelihood ratio; unit mismatch in reported TPR metrics makes quantitative calibration checks hard.
  • Prior membership probability = 0.5
    Assumed equal priors in Eq. 14; standard in the membership game but a free input to the posterior.
assumptions (5)
  • domain assumption The p-norms of feature vectors for member and non-member samples follow two independent Gaussian distributions.
    Stated in Section 4.2 (Eq. 12) and visually motivated by Figure 5; no goodness-of-fit test is provided. If the assumption fails, the likelihood ratio in Eq. 14 is miscalibrated.
  • domain assumption K-NN accuracy measures encoder utility and membership inference attack accuracy measures privacy risk.
    Sections 3.4 and 3.5 use these two proxies to define the trade-off; changing either metric could change the reported trend.
  • ad hoc to paper The adversary can build a non-member dataset from random pixel images matching the input format.
    Section 4.2 Stage 1 makes this claim, but Section 3.4 and Table 1 appear to use test-set samples as non-members in experiments, so the assumption is not actually evaluated.
  • standard math Membership and non-membership have equal prior probability.
    Assumed in Eq. 14 to reduce the Bayes decision to comparing two likelihoods; standard for the 50/50 membership game but an input to the attack.
  • domain assumption Differences in leakage across MoCo versions are attributable to framework complexity rather than to changed hyperparameters.
    MoCo-v1/v2 use a 16,384-entry dictionary and batch size 256 while MoCo-v3 uses in-batch negatives and batch size 512 (Section 3.4, Table 1); the paper attributes the trend to complexity without controlling these differences.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When Better Features Mean Greater Risks: The Performance-Privacy Trade-Off in Contrastive Learning." pith.science (2026). https://pith.science/paper/KWGNNHB6

@misc{pith2026250605743,
  author       = {Pith},
  title        = {Pith review of: When Better Features Mean Greater Risks: The Performance-Privacy Trade-Off in Contrastive Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KWGNNHB6}},
  note         = {Machine review of arXiv:2506.05743}
}
read the original abstract

With the rapid advancement of deep learning technology, pre-trained encoder models have demonstrated exceptional feature extraction capabilities, playing a pivotal role in the research and application of deep learning. However, their widespread use has raised significant concerns about the risk of training data privacy leakage. This paper systematically investigates the privacy threats posed by membership inference attacks (MIAs) targeting encoder models, focusing on contrastive learning frameworks. Through experimental analysis, we reveal the significant impact of model architecture complexity on membership privacy leakage: As more advanced encoder frameworks improve feature-extraction performance, they simultaneously exacerbate privacy-leakage risks. Furthermore, this paper proposes a novel membership inference attack method based on the p-norm of feature vectors, termed the Embedding Lp-Norm Likelihood Attack (LpLA). This method infers membership status, by leveraging the statistical distribution characteristics of the p-norm of feature vectors. Experimental results across multiple datasets and model architectures demonstrate that LpLA outperforms existing methods in attack performance and robustness, particularly under limited attack knowledge and query volumes. This study not only uncovers the potential risks of privacy leakage in contrastive learning frameworks, but also provides a practical basis for privacy protection research in encoder models. We hope that this work will draw greater attention to the privacy risks associated with self-supervised learning models and shed light on the importance of a balance between model utility and training data privacy. Our code is publicly available at: https://github.com/SeroneySun/LpLA_code.

Figures

Figures reproduced from arXiv: 2506.05743 by the authors.

Figure 1
Figure 1. An illustration of the evaluation framework. The [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. An illustration of the performance-privacy trade-off [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 4
Figure 4. An illustration of the mean L2-norm value of the [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figures from the paper (5 more)
Figure 3
Figure 3. Figure 3: An illustration of the three attacks on different [PITH_FULL_IMAGE:figures/full_fig_p008_3.png]
Figure 5
Figure 5. Figure 5: An illustration of the 𝑝-norm of feature vectors produced by official pre-trained ResNet-50 with MoCo-v2 framework. There is a significant difference in the feature vector magnitude distributions between the two classes, wherein the behavior aligns closely with the obs…
Figure 8
Figure 8. Figure 8: An illustration of the performance of LpLA against [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 7
Figure 7. Figure 7: An illustration of the attack performance with lim [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 9
Figure 9. Figure 9: An illustration of the comparison between using [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

55 extracted references · 38 canonical work pages

  1. [1]

    Hangbo Bao, Li Dong, Songhao Piao, and Furu Wei. 2021. BEiT: BERT Pre- Training of Image Transformers. arXiv preprint arXiv:2106.08254 (2021)

    arXiv 2021

  2. [2]

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. 2022. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 1897–1914

    work page 2022

  3. [3]

    Mathilde Caron, Ishan Misra, Mairal, et al. 2020. Unsupervised learning of visual features by contrasting cluster assignments. Advances in Neural Information Processing Systems 33 (2020), 9912–9924

    work page 2020

  4. [4]

    Harsh Chaudhari, John Abascal, Alina Oprea, Matthew Jagielski, Florian Tramer, and Jonathan Ullman. 2023. SNAP: Efficient extraction of private properties with poisoning. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 400–417

    work page 2023

  5. [5]

    Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. 2020. A simple framework for contrastive learning of visual representations. In Interna- tional Conference on Machine Learning . PMLR, 1597–1607

    work page 2020

  6. [6]

    Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. 2020. Improved baselines with momentum contrastive learning. arXiv preprint arXiv:2003.04297 (2020)

    arXiv 2020

  7. [7]

    Xinlei Chen and Kaiming He. 2021. Exploring simple siamese representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 15750–15758

    work page 2021

  8. [8]

    Xinlei Chen, Saining Xie, and Kaiming He. 2021. An empirical study of training self-supervised vision transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 9640–9649

    work page 2021

Show all 55 references
  1. [9]

    Emiliano De Cristofaro. 2020. An overview of privacy in machine learning. arXiv preprint arXiv:2005.08679 (2020)

    2020 arXiv

  2. [10]

    Alexey Dosovitskiy. 2020. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 (2020)

    2020 arXiv

  3. [11]

    Junyao Gao, Xinyang Jiang, Huishuai Zhang, et al. 2023. Similarity distribution based membership inference attack on person re-identification. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 37. 14820–14828

    2023

  4. [12]

    Spyros Gidaris, Praveer Singh, and Nikos Komodakis. 2018. Unsupervised repre- sentation learning by predicting image rotations. arXiv preprint arXiv:1803.07728 (2018)

    2018 arXiv

  5. [13]

    Priya Goyal, Dhruv Mahajan, Abhinav Gupta, and Ishan Misra. 2019. Scaling and benchmarking self-supervised visual representation learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 6391–6400

    2019

  6. [14]

    Jean-Bastien Grill, Florian Strub, Altché, et al. 2020. Bootstrap your own latent- a new approach to self-supervised learning. Advances in Neural Information Processing Systems 33 (2020), 21271–21284

    2020

  7. [15]

    Jie Gui, Tuo Chen, Jing Zhang, Qiong Cao, Zhenan Sun, Hao Luo, and Dacheng Tao. 2024. A Survey on Self-supervised Learning: Algorithms, Applications, and Future Trends. IEEE Transactions on Pattern Analysis and Machine Intelligence (2024)

    2024

  8. [16]

    Umang Gupta, Dimitris Stripelis, Pradeep K Lam, Paul Thompson, Jose Luis Ambite, and Greg Ver Steeg. 2021. Membership inference attacks on deep regres- sion models for neuroimaging. In Medical Imaging with Deep Learning . PMLR, 228–251

    2021

  9. [17]

    Raia Hadsell, Sumit Chopra, and Yann LeCun. 2006. Dimensionality reduction by learning an invariant mapping. In 2006 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR’06) , Vol. 2. IEEE, 1735–1742

    2006

  10. [18]

    Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. 2017. Logan: Membership inference attacks against generative models. arXiv preprint When Better Features Mean Greater Risks: The Performance-Privacy Trade-Off in Contrastive Learning ASIA CCS ’25, August 25–2...

    2017 arXiv

  11. [19]

    Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick

  12. [20]

    Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. 2020. Momen- tum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 9729–9738

    2020

  13. [21]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 770–778

    2016

  14. [22]

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. 2022. Membership inference attacks on machine learning: A survey.ACM Computing Surveys (CSUR) 54, 11s (2022), 1–37

    2022

  15. [23]

    Malhar S Jere, Tyler Farnan, and Farinaz Koushanfar. 2020. A taxonomy of attacks on federated learning. IEEE Security & Privacy 19, 2 (2020), 20–28

    2020

  16. [24]

    Alex Krizhevsky, Geoffrey Hinton, et al. 2009. Learning multiple layers of features from tiny images. (2009)

    2009

  17. [25]

    Gustav Larsson, Michael Maire, and Gregory Shakhnarovich. 2017. Colorization as a proxy task for visual understanding. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 6874–6883

    2017

  18. [26]

    Ya Le and Xuan S. Yang. 2015. Tiny ImageNet Visual Recognition Challenge. https://api.semanticscholar.org/CorpusID:16664790

    2015

  19. [27]

    Shuhao Li, Yajie Wang, Yuanzhang Li, and Yu-an Tan. 2022. l-Leaks: Membership inference attacks with logits. arXiv preprint arXiv:2205.06469 (2022)

    2022 arXiv

  20. [28]

    Zheng Li, Xinlei He, Ning Yu, and Yang Zhang. 2024. Membership Inference Attack Against Masked Image Modeling. arXiv preprint arXiv:2408.06825 (2024)

    2024 arXiv

  21. [29]

    Zheng Li and Yang Zhang. 2021. Membership leakage in label-only exposures. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 880–895

    2021

  22. [30]

    Hongbin Liu, Jinyuan Jia, Wenjie Qu, et al . 2021. EncoderMI: Membership inference against pre-trained encoders in contrastive learning. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 2081–2095

    2021

  23. [31]

    Yugeng Liu, Rui Wen, He Xinlei, et al. 2022. ML-Doctor: Holistic risk assessment of inference attacks against machine learning models. In 31st USENIX Security Symposium (USENIX Security 22) . 4525–4542

    2022

  24. [32]

    Mengyao Ma, Yanjun Zhang, Arachchige, et al . 2023. Loden: Making every client in federated learning a defender against the poisoning membership infer- ence attacks. In Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security. 122–135

    2023

  25. [33]

    Shagufta Mehnaz, Sayanton V Dibbo, Ehsanul Kabir, Ninghui Li, and Elisa Bertino

  26. [34]

    Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov

  27. [35]

    In 31st USENIX Security Symposium (USENIX Security 22)

    Are your sensitive attributes private? Novel model inversion attribute inference attacks on classification models. In 31st USENIX Security Symposium (USENIX Security 22). 4579–4596

  28. [36]

    Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 739–753

    2019

  29. [37]

    Shahbaz Rezaei and Xin Liu. 2021. On the difficulty of membership inference attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 7892–7900

    2021

  30. [38]

    T Nathan Mundhenk, Daniel Ho, and Barry Y Chen. 2018. Improvements to context based self-supervised learning. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 9339–9348

    2018

  31. [39]

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Mem- bership inference attacks against machine learning models. In 2017 IEEE Sympo- sium on Security and Privacy (SP) . IEEE, 3–18

    2017

  32. [40]

    Congzheng Song and Ananth Raghunathan. 2020. Information leakage in em- bedding models. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. 377–390

    2020

  33. [41]

    Ahmed Salem, Yang Zhang, Humbert, et al . 2018. ML-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246 (2018)

    2018 arXiv

  34. [42]

    Igor Susmelj, Matthias Heller, Philipp Wirth, Jeremy Prescott, Malte Ebner, and et al. 2020. Lightly. https://github.com/lightly-ai/lightly [Accessed: 2025-01-01]

    2020

  35. [43]

    Florian Tramèr, Reza Shokri, Ayrton San Joaquin, Hoang Le, Matthew Jagielski, Sanghyun Hong, and Nicholas Carlini. 2022. Truth serum: Poisoning machine learning models to reveal their secrets. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Secu...

    2022

  36. [44]

    Liwei Song and Prateek Mittal. 2021. Systematic evaluation of privacy risks of machine learning models. In 30th USENIX Security Symposium (USENIX Security 21). 2615–2632

    2021

  37. [45]

    Zhirong Wu, Yuanjun Xiong, Stella X Yu, and Dahua Lin. 2018. Unsupervised feature learning via non-parametric instance discrimination. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 3733–3742

    2018

  38. [46]

    Zhenda Xie, Zheng Zhang, Yue Cao, et al. 2022. SimMIM: a Simple Framework for Masked Image Modeling. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 9653–9663

    2022

  39. [47]

    Tobias Uelwer, Jan Robine, Stefan Sylvius Wagner, Marc Höftmann, Eric Up- schulte, Sebastian Konietzny, Maike Behrendt, and Stefan Harmeling. 2023. A Sur- vey on Self-Supervised Representation Learning. arXiv preprint arXiv:2308.11455 (2023)

    2023 arXiv

  40. [48]

    Zhaoxi Zhang, Leo Yu Zhang, Xufei Zheng, Bilal Hussain Abbasi, and Shengshan Hu. 2022. Evaluating membership inference through adversarial robustness. Comput. J. 65, 11 (2022), 2969–2978

    2022

  41. [49]

    Zhaoxi Zhang, Leo Yu Zhang, Xufei Zheng, Jinyu Tian, and Jiantao Zhou. 2022. Self-supervised adversarial example detection by disentangled representation. In 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, 1000–1007

    2022

  42. [50]

    Xiaomei Zhang, Zhaoxi Zhang, Qi Zhong, Xufei Zheng, Yanjun Zhang, Shengshan Hu, and Leo Yu Zhang. 2023. Masked Language Model Based Textual Adversarial Example Detection. In ASIA CCS. 925–937

    2023

  43. [51]

    Jie Zhu, Jirong Zha, Ding Li, et al. 2024. A unified membership inference method for visual self-supervised encoder via part-aware capability. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security . 1241–1255

    2024

  44. [52]

    Ligeng Zhu, Zhijian Liu, and Song Han. 2019. Deep leakage from gradients. Advances in Neural Information Processing Systems 32 (2019)

    2019

  45. [53]

    Jinghao Zhou, Chen Wei, Huiyu Wang, Wei Shen, Cihang Xie, Alan Yuille, and Tao Kong. 2021. iBOT: Image BERT Pre-Training with Online Tokenizer. arXiv preprint arXiv:2111.07832 (2021)

    2021 arXiv

  46. [2019]

    In 2019 IEEE Symposium on Security and Privacy (SP)

    Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, 691–706

    2019

  47. [2022]

    In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 16000–16009

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.