On Reconstructing Training Data From Bayesian Posteriors and Trained Models

George Wynne

REVIEW 2 major objections 4 minor 34 references

On Reconstructing Training Data From Bayesian Posteriors and Trained Models

T0 review · 2 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proves that reconstructing training data from a Bayesian posterior is equivalent to minimizing a kernel mean-embedding discrepancy fixed by the model's own score function.

desk verdict Theorem 3.4 is real and the Bayesian attack is a genuine first, but the unconstrained weights let the pseudo-posterior drift into signed-measure territory and the complexity claims outrun the proof. read the letter →

arxiv 2507.18372 v1 pith:2BYML5I2 submitted 2025-07-24 stat.ML cs.LGmath.STstat.TH

George Wynne This is my paper · ORCID

classification stat.MLcs.LGmath.STstat.TH MSC 62F1562B1068T07

keywords trainingdatareconstructionBayesianposteriormaximummeandiscrepancyFisherdivergencescorematchingkernelembeddingmodelprivacyempiricalmeasure

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that training-data reconstruction is not a contest between clever attacks and defenses but a property written into the model itself. The central result is an exact equivalence: the Fisher divergence between a true posterior and a pseudo-posterior built from weighted pseudo-data equals one half the squared maximum mean discrepancy (MMD) between the empirical training-data measure and the empirical pseudo-data measure, under a kernel formed by integrating the inner product of log-likelihood gradients against the posterior. Because MMD is a distance between kernel mean embeddings, the model's score function fixes the feature space, and the posterior fixes which directions receive weight: those are precisely the features an adversary can recover. The same argument, with a Dirac measure at the final parameters, reproduces standard non-Bayesian gradient-matching attacks, and a worked regression example shows that the recoverable statistics are exactly the model's sufficient statistics. If the paper is right, the appropriate question is not 'can the adversary recover my data?' but 'which features does my model expose?'

What carries the argument

The carrying object is the Fisher divergence between the true posterior and a weighted pseudo-posterior, rewritten by an integration-by-parts trick into a score-matching objective that needs only posterior samples. Theorems 3.4 and 4.3 then convert that divergence into a maximum mean discrepancy by expanding gradients as sums over data points, so the MMD kernel is $k(x,x')=\int_\Theta \langle \nabla_\theta \log \ell(\theta,x),\nabla_\theta \log \ell(\theta,x')\rangle\,d\pi_{\mathcal X}(\theta)$ in the Bayesian case and the analogous inner product of loss gradients at $\theta^\ast$ in the non-Bayesian case. The feature map $\phi(x)=\nabla_\theta \log \ell(\cdot,x)$ in $L^2(\Theta,\pi_{\mathcal X})$ is what carries the argument: it determines which data features are exposed, while the posterior measure determines how they are weighted. This machinery simultaneously yields the attack objective and the characterization of what an attack can recover.

What would settle it

Take a simple model where both sides of Theorem 3.4 can be computed exactly, such as the Gaussian mean-location model, run the score-matching reconstruction on finite posterior samples, and compare the minimized Fisher divergence with the squared MMD between the recovered and true data measures; if the two disagree systematically as the sample size grows, the equivalence is not enough to predict attack behavior. For the non-Bayesian claim, train a model with early stopping and record the gradient norm $\|\nabla_\theta L(\theta^\ast,\mathcal X)\|$; if reconstruction quality does not track this residual gradient, the stationary-point assumption is the weak link.

Watch

Extended reading notes

Core claim

The paper's central claim is that adversarial reconstruction of training data from a released Bayesian model can be understood as a kernel mean-embedding problem. Theorem 3.4 states that for unnormalized empirical measures $P_{\mathcal X}$ and $P_{\mathbf w,\mathcal Z}$, the Fisher divergence between the posterior $\pi_{\mathcal X}$ and the weighted pseudo-posterior $\pi_{\mathbf w,\mathcal Z}$ equals $\frac{1}{2}\mathrm{MMD}_k(P_{\mathcal X},P_{\mathbf w,\mathcal Z})^2$, where $k(x,x')=\int_{\Theta}\langle \nabla_\theta \log \ell(\theta,x),\nabla_\theta \log \ell(\theta,x')\rangle\,d\pi_{\mathcal X}(\theta)$. Thus the features of training data that can be recovered are the mean embeddings of the data measure under the feature map $\phi(x)(\theta)=\nabla_\theta \log \ell(\theta,x)$ in $L^2(\Theta,\pi_{\mathcal X})$. The non-Bayesian analogue (Theorem 4.3) states the same for the residual gradient at a trained parameter vector $\theta^\ast$, with kernel $\langle\nabla_\theta\ell(\theta^\ast,x),\nabla_\theta\ell(\theta^\ast,x')\rangle$. Together these results present the first data-reconstruction attack for Bayesian posteriors and a unified explanation of why wider or deeper models leak more while larger training sets are harder to reconstruct.

Load-bearing premise

Everything rests on the adversary having a faithful version of what the model release advertises: exact or near-exact posterior samples for Bayesian models, and a truly converged parameter vector at a gradient-zero of the training objective for non-Bayesian models, so approximate samples or early stopping can make the attack objective measure the wrong thing.

Editorial extensions

If this is right

A released Bayesian posterior can be attacked without any prior knowledge of the training-data distribution: only posterior samples and the likelihood and prior specification are needed.
The features an adversary can recover are exactly the mean embeddings captured by the score-function kernel; more expressive models, such as wider or deeper networks, produce more expressive kernels and therefore expose more training-data statistics.
Larger training sets are intrinsically harder to reconstruct because the unnormalized empirical measure $P_{\mathcal X}$ has norm that grows with $N$, so the approximation target becomes more complex.
The non-Bayesian gradient-norm attack used widely in the literature is recovered as the special case where the posterior is a Dirac point mass at the trained parameters, under the stationary-point assumption.
In a Bayesian linear regression with polynomial features of degree two, the recoverable statistics are exactly the sufficient statistics: the number of points, the sums, and the sums of squares of both covariates and responses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A pre-release audit protocol follows from the paper but is not pursued in it: compute the RKHS norm of the training-data measure under the score kernel, or estimate the kernel's characteristicness, to predict which statistics an adversary could extract.
Because the kernel in Theorem 3.4 is integrated against the true posterior, an attacker working from approximate posterior samples, such as variational or short Markov-chain samples, is effectively attacking with a shifted kernel; whether the attack degrades gracefully is an open empirical question.
A direct corollary for defenses: perturbing individual data points may protect individual records while leaving the recoverable sufficient statistics intact, so noise calibrated to the score kernel or to the sufficient statistics is the more targeted countermeasure.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: the Fisher-divergence-to-MMD equivalence in Theorem 3.4 is real, algebraically correct, and gives the Bayesian reconstruction problem a clean theoretical handle. The paper deserves a serious referee, but it has a formulation gap that needs to be fixed before I would trust the attack's advertised output.

What is actually new: the Bayesian reconstruction objective (Definition 3.3) and the MMD characterization (Theorem 3.4) are not in the cited literature. The connection to Loo et al. and Manousakas et al. is drawn honestly, and the non-Bayesian part reduces to known gradient-matching, which is a useful unification rather than a weakness. The Gaussian and linear-regression examples are worked carefully and make the theorem intuitive. The proof of Lemma 5.1 checks out.

Soft spots, in order of size. First, the weight constraint issue. Definition 2.1 explicitly allows scalar weights in R^M, and Definition 3.3 optimizes over all such weights. Nothing forces w_m > 0. If weights go negative, the 'weighted posterior' pi_w,Z is generally not a normalizable probability measure, and P_w,Z is a signed measure, not an empirical distribution of pseudo-data. The MMD algebra in Theorem 3.4 still holds for this signed relaxation, but the paper's central claim—that the attacker approximates the empirical training-data measure with a data set—is then only about a relaxation. This is fixable: constrain weights to the simplex or positive orthant, or explicitly present the signed-measure version and discuss the consequences. Second, the assumptions: exact posterior samples (Assumption 3.2) and exact stationary points (Assumption 4.1) are strong idealizations. The paper is upfront about them, but they undercut the practical force of the attack. Third, the model-complexity monotonicity claims—wider and deeper networks recover more features—are asserted from the feature map without a proof. The examples support the intuition, but it is a claim, not a theorem. Fourth, the numerical section is a single run with no seeds, error bars, or baselines; it shows moment-matching behavior, not attack efficacy against a baseline.

None of this breaks the main result. The identity in Theorem 3.4 is the contribution, and it is correct. Who it is for: people working on privacy of Bayesian models and on score/MMD-based reconstruction. They will get a useful framework and a clean theorem. I would cite it. It should go to peer review, with the weight constraint and the overclaims addressed.

Recommendation: send it out; expect a revise-and-resubmit.

Referee Report

2 major / 4 minor

Summary. The paper formalizes training-data reconstruction as approximating the unnormalized empirical measure P_X = Σ δ_{x_n} by a weighted pseudo-data measure P_{w,Z} = Σ w_m δ_{z_m}. For Bayesian models it proposes minimizing the Fisher (or sliced Fisher) divergence between the posterior π_X and a weighted pseudo-posterior π_{w,Z}, gives a Monte Carlo estimator from posterior samples, and proves (Theorem 3.4) that this Fisher divergence equals half the squared MMD between P_X and P_{w,Z} under a model-dependent kernel built from log-likelihood gradients averaged over π_X. For non-Bayesian models it substitutes a Dirac at the trained parameter θ* for the posterior and the loss gradient for the score, recovering the standard gradient-matching attack (Definition 4.2) and an analogous MMD identity (Theorem 4.3). Numerical experiments on the kidscore model from posteriordb demonstrate convergence of weighted reconstructions to the sufficient statistics identified by Lemma 5.1.

Significance. If the advertised interpretation is accepted, this is a valuable unification: it gives the first explicit Bayesian treatment of DRA, connects score-matching attacks to kernel mean embeddings, and provides a theoretical explanation for the empirical observation that larger models are more vulnerable. The derivations are self-contained and checkable, no free constants are fitted, and the code is available. The main caveat is that the unconstrained weights allow signed pseudo-measures, so the central 'reconstruction of the training-data measure' claim currently holds only for a signed relaxation.

major comments (2)

[Section 2.2, Definition 2.1; Section 3.1, Definition 3.3] Definition 2.1 defines the adversary's target as the empirical measure P_X approximated by P_{w,Z} = Σ w_m δ_{z_m}, but it does not require w_m ≥ 0, and Definition 3.3 minimizes over all w ∈ R^M. With negative weights, P_{w,Z} is a signed measure rather than an empirical distribution of pseudo-data; although Theorem 3.4 remains algebraically valid for signed measures, the optimal solution of Definition 3.3 cannot then be reported as reconstructed training data. The Section 5 experiments do not report the individual weights, so it is unknown whether the reported weighted statistics correspond to a nonnegative measure. Please either impose w ≥ 0 and adjust the optimization and proofs accordingly, or explicitly reframe the contribution as a signed-measure relaxation and state what additional steps (e.g., projection or reparameterization) are needed to obtain an actual data set.
[Section 4.1, Assumption 4.1] The non-Bayesian attack and Theorem 4.3 rest on the assumption that the released parameters satisfy ∇θ L(θ*, X) = 0 exactly. Real training runs with early stopping, SGD noise, or regularization schedules do not land on exact stationary points, so the objective in (8) measures a residual gradient that may have little to do with the released model. The paper acknowledges the assumption, but it should discuss how violations affect the equivalence and ideally include an empirical robustness check, since this is the main fragility of the non-Bayesian half of the paper.

minor comments (4)

[Section 3.2, Theorem 3.4] The kernel in Theorem 3.4 is defined through integration against the true posterior π_X, so the characterization of vulnerable features is posterior-dependent; under Assumption 3.2 the adversary has samples from π_X and can estimate the kernel, but the paper should state this explicitly so readers do not interpret the characterization as depending only on the model architecture.
[Appendix A, Lemma A.2] Lemma A.2 establishes an exact population-level equivalence between SFD and FD; the stochastic estimate in Equation (11) uses random slicing directions, so the equivalence does not hold for each noisy gradient estimate. The text should clarify that the numerical optimization is minimizing a randomized estimate whose population objective is SFD, not that every iteration is exactly FD.
[Theorem 3.4 and Proposition A.1] The statements assume without qualification that the defining integrals for the kernel are finite and that the integration-by-parts identity leading to Equation (4) is valid; adding explicit regularity conditions on l, π0, and π_X would strengthen the results.
[Throughout] There are several typos and misspellings, including 'equivalance' in the abstract, 'ansatz' (should be 'ansatz'), 'Therfore', 'psuedo-data', 'stadard', and 'fuction'; these should be corrected in a revision.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Theorem 3.4 is a direct algebraic identity and the non-Bayesian objective follows from an explicit stationarity assumption; no fitted constants, load-bearing self-citations, or renamed predictions appear.

full rationale

The paper's central claim, Theorem 3.4, is derived by expanding the Fisher divergence, substituting the score difference as E_PX[∇ log l] − E_Pw,Z[∇ log l], and identifying each term with MMD under the kernel k(x,x') = ∫ <∇ log l(θ,x), ∇ log l(θ,x')> dπ_X(θ). This is a direct algebraic identity rather than a definitional equivalence: the MMD kernel is not defined as the Fisher divergence, and the pseudo-data weights and locations are free optimization variables. The non-Bayesian analogue, Theorem 4.3, is an exact sum rearrangement under the explicit stationarity Assumption 4.1; the paper does not fit any parameter to a target and then rename it a prediction. The numerical experiment uses posterior samples from posteriordb under the stated threat model and shows convergence of the weighted pseudo-data statistics to the training-data statistics predicted by Lemma 5.1; this is empirical validation of the attack, not a circular reuse of the attack's own objective. The fact that the MMD kernel integrates against π_X means the characterization is posterior-weighted, but because Assumption 3.2 grants the adversary posterior samples, this is a usable estimation target rather than a circular input. The only self-citation (Wynne 2023) is contextual and not load-bearing. The unconstrained signed weights in Definition 3.3 are a potential correctness limitation of the problem formulation, but they do not make the derivation circular.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central theorems add no fitted constants: the proof is algebraic. The non-trivial inputs are the threat-model assumptions (available posterior samples, converged parameters), the regularity needed for score matching, and the unstated assumption that arbitrary real weights still define a proper posterior. The model-complexity interpretation in the remarks is an extrapolation, not an axiom.

free parameters (3)

M, number of pseudo-data points = 50, 100, 200, 400, 800, 1600
User-selected pseudo-data count in Section 5; not fitted to the target data, but the attainable reconstruction resolution depends on it.
L, slicing projections per iteration = 10
Numerical hyperparameter in Section 5 for the sliced Fisher divergence; chosen by the user, not fitted.
Adam learning rate = 0.001
Learning rate for r_m, u_m and w_m in Section 5; numerical hyperparameter, not part of the theoretical claim.

assumptions (5)

standard math Boundary and regularity conditions for the Hyvarinen score-matching integration by parts hold.
Needed to pass from equation (3) to the tractable estimator in equation (4); standard in score matching.
domain assumption The adversary has access to T samples from the true posterior pi_X.
Assumption 3.2 in Section 3.1; the Bayesian estimator replaces expectations under pi_X with sample averages over these draws.
domain assumption The released non-Bayesian parameters satisfy grad_theta L(theta*, X) = 0.
Assumption 4.1 in Section 4.1; equation (8) and Theorem 4.3 require the true gradient term to vanish.
domain assumption The weighted likelihood product_m l(theta, z_m)^{w_m} yields a normalizable posterior for the chosen weights.
Unstated in Section 1.2; needed for pi_w,Z and the Fisher divergence to be well-defined for arbitrary real weights.
domain assumption The true posterior pi_X has full support where feature maps are compared pointwise.
Examples 3.2, 3.3 and the proof of Lemma 5.1 conclude equality of feature maps from equality in L2(pi_X); on restricted support only features weighted by pi_X are matched.

how reviews work

0 comments

Cite this review

Pith. "Pith review of On Reconstructing Training Data From Bayesian Posteriors and Trained Models." pith.science (2026). https://pith.science/paper/2BYML5I2

@misc{pith2026250718372,
  author       = {Pith},
  title        = {Pith review of: On Reconstructing Training Data From Bayesian Posteriors and Trained Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2BYML5I2}},
  note         = {Machine review of arXiv:2507.18372}
}

read the original abstract

Publicly releasing the specification of a model with its trained parameters means an adversary can attempt to reconstruct information about the training data via training data reconstruction attacks, a major vulnerability of modern machine learning methods. This paper makes three primary contributions: establishing a mathematical framework to express the problem, characterising the features of the training data that are vulnerable via a maximum mean discrepancy equivalance and outlining a score matching framework for reconstructing data in both Bayesian and non-Bayesian models, the former is a first in the literature.

Figures

Figures reproduced from arXiv: 2507.18372 by the authors.

**Figure 3.** Convergence of ( PM m=1 wm) −1 PN m=1 wmr 2 m − ( PM m=1 wm) −1 PM m=1 wmrm 2 to N −1 PN n=1 s 2 n − N −1 PN n=1 sn 2 where sn is the n-th mother test score. 0 50000 100000 150000 200000 250000 iteration 20 30 40 50 60 70 80 90 Convergence to kid_mean M=50 M=100 M=200 M=400 M=800 M=1600 [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

**Figure 2.** Convergence of ( PM m=1 wm) −1 PN m=1 wmrm to N −1 PN n=1 sn where sn is the n-th mother test score. 0 50000 100000 150000 200000 250000 iteration 0 500 1000 1500 2000 2500 Convergence to mom_var M=50 M=100 M=200 M=400 M=800 M=1600 [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗

**Figure 5.** Convergence of ( PM m=1 wm) −1 PN m=1 wmu 2 m − ( PM m=1 wm) −1 PM m=1 wmum 2 to N −1 PN n=1 y 2 n − N −1 PN n=1 yn 2 where yn is the n-th kid test score. convergence of the sum of the weights to the total number of training data points [PITH_FULL_IMAGE:figures/full_fig_p011_5.png] view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

34 extracted references · 25 canonical work pages

[1]

Differentially private simple linear regression

Alabi, D., McMillan, A., Sarathy, J., Smith, A., and Vadhan, S. Differentially private simple linear regression. Proceedings on Privacy Enhancing Technologies, 2022 0 (2): 0 184–204, 2022

work page 2022
[2]

Reconstructing training data with informed adversaries

Balle, B., Cherubin, G., and Hayes, J. Reconstructing training data with informed adversaries. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022

work page 2022
[3]

Bernardo, J. M. and Smith, A. F. M. Bayesian Theory. Wiley, May 1994. ISBN 9780470316870

work page 1994
[4]

and Sheldon, D

Bernstein, G. and Sheldon, D. R. Differentially private bayesian linear regression. In Advances in Neural Information Processing Systems, volume 32, 2019

work page 2019
[5]

and Ramamoorthi, R

Blackwell, D. and Ramamoorthi, R. V. A bayes but not classically sufficient statistic. The Annals of Statistics, 10 0 (3), 1982

work page 1982
[6]

Deconstructing data reconstruction: Multiclass, weight decay and general losses

Buzaglo, G., Haim, N., Yehudai, G., Vardi, G., Oz, Y., Nikankin, Y., and Irani, M. Deconstructing data reconstruction: Multiclass, weight decay and general losses. arxiv:2307.01827, 2023

arXiv 2023
[7]

and Berger, R

Casella, G. and Berger, R. Statistical Inference. Chapman and Hall/CRC, April 2024

work page 2024
[8]

and Steinwart, I

Christmann, A. and Steinwart, I. Support Vector Machines. Springer New York, 2008

work page 2008

Show all 34 references

[9]

Exposed! a survey of attacks on private data

Dwork, C., Smith, A., Steinke, T., and Ullman, J. Exposed! a survey of attacks on private data. Annual Review of Statistics and Its Application, 4 0 (1): 0 61–84, 2017

2017
[10]

and Hill, J

Gelman, A. and Hill, J. Linear regression: the basics, pp.\ 31–52. Analytical Methods for Social Research. Cambridge University Press, 2006

2006
[11]

Gong, N. Z. and Liu, B. Attribute inference attacks in online social networks. ACM Trans. Priv. Secur., 21 0 (1), 2018

2018
[12]

M., Rasch, M

Gretton, A., Borgwardt, K. M., Rasch, M. J., Sch \"o lkopf, B., and Smola, A. A kernel two-sample test. Journal of Machine Learning Research, 13 0 (25): 0 723--773, 2012

2012
[13]

Bounding training data reconstruction in private (deep) learning

Guo, C., Karrer, B., Chaudhuri, K., and van der Maaten, L. Bounding training data reconstruction in private (deep) learning. In Chaudhuri, K., Jegelka, S., Song, L., Szepesvari, C., Niu, G., and Sabato, S. (eds.), Proceedings of the 39th International Conference on Machine Lea...

2022
[14]

Reconstructing training data from trained neural networks

Haim, N., Vardi, G., Yehudai, G., Shamir, O., and Irani, M. Reconstructing training data from trained neural networks. In Koyejo, S., Mohamed, S., Agarwal, A., Belgrave, D., Cho, K., and Oh, A. (eds.), Advances in Neural Information Processing Systems, volume 35, pp.\ 22911--2...

2022
[15]

Bounding training data reconstruction in dp-sgd

Hayes, J., Mahloujifar, S., and Balle, B. Bounding training data reconstruction in dp-sgd. arXiv:2302.07225, 2023

2023 arXiv
[16]

Deep residual learning for image recognition

He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2016

2016
[17]

Estimation of non-normalized statistical models by score matching

Hyv \"a rinen, A. Estimation of non-normalized statistical models by score matching. Journal of Machine Learning Research, 6 0 (24): 0 695--709, 2005

2005
[18]

Bounding data reconstruction attacks with the hypothesis testing interpretation of differential privacy

Kaissis, G., Hayes, J., Ziller, A., and Rueckert, D. Bounding data reconstruction attacks with the hypothesis testing interpretation of differential privacy. arXiv:2307.03928, 2023

2023 arXiv
[19]

Understanding reconstruction attacks with the neural tangent kernel and dataset distillation

Loo, N., Hasani, R., Lechner, M., Amini, A., and Rus, D. Understanding reconstruction attacks with the neural tangent kernel and dataset distillation. arXiv:2302.01428, 2023

2023 arXiv
[20]

posteriordb: a set of posteriors for Bayesian inference and probabilistic programming , October 2023

Magnusson, M., Bürkner, P., and Vehtari, A. posteriordb: a set of posteriors for Bayesian inference and probabilistic programming , October 2023

2023
[21]

Bayesian pseudocoresets

Manousakas, D., Xu, Z., Mascolo, C., and Campbell, T. Bayesian pseudocoresets. In Advances in Neural Information Processing Systems, volume 33, pp.\ 14950--14960, 2020

2020
[22]

Kernel mean embedding of distributions: A review and beyond

Muandet, K., Fukumizu, K., Sriperumbudur, B., and Schölkopf, B. Kernel mean embedding of distributions: A review and beyond. Foundations and Trends® in Machine Learning, 10 0 (1-2): 0 1--141, 2017. ISSN 1935-8237

2017
[23]

How to dp-fy ml: A practical tutorial to machine learning with differential privacy

Ponomareva, N., Vassilvitskii, S., Xu, Z., McMahan, B., Kurakin, A., and Zhang, C. How to dp-fy ml: A practical tutorial to machine learning with differential privacy. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD '23, pp.\ 5823–5...

2023
[24]

High-resolution image synthesis with latent diffusion models

Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 10684--10695, June 2022

2022
[25]

V., Geiping, J., Schönlieb, C.-B., and Moeller, M

Runkel, C., Gandikota, K. V., Geiping, J., Schönlieb, C.-B., and Moeller, M. Training data reconstruction: Privacy due to uncertainty?, 2024

2024
[26]

and McAuley, J

Sachdeva, N. and McAuley, J. Data distillation: A survey. Transactions on Machine Learning Research, 2023

2023
[27]

Membership inference attacks against machine learning models

Shokri, R., Stronati, M., Song, C., and Shmatikov, V. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP), pp.\ 3--18, 2017

2017
[28]

and Ermon, S

Song, Y. and Ermon, S. Improved techniques for training score-based generative models. In Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., and Lin, H. (eds.), Advances in Neural Information Processing Systems, volume 33, pp.\ 12438--12448. Curran Associates, Inc., 2020

2020
[29]

Sliced score matching: A scalable approach to density and score estimation

Song, Y., Garg, S., Shi, J., and Ermon, S. Sliced score matching: A scalable approach to density and score estimation. In Proceedings of the Thirty-Fifth Conference on Uncertainty in Artificial Intelligence, UAI 2019, Tel Aviv, Israel, July 22-25, 2019 , pp.\ 204, 2019

2019
[30]

K., Fukumizu, K., and Lanckriet, G

Sriperumbudur, B. K., Fukumizu, K., and Lanckriet, G. R. Universality, characteristic kernels and rkhs embedding of measures. Journal of Machine Learning Research, 12 0 (70): 0 2389--2410, 2011

2011
[31]

An explicit description of the reproducing kernel hilbert spaces of gaussian rbf kernels

Steinwart, I., Hush, D., and Scovel, C. An explicit description of the reproducing kernel hilbert spaces of gaussian rbf kernels. IEEE Transactions on Information Theory, 52 0 (10): 0 4635--4643, 2006

2006
[32]

Winter, S., Campbell, T., Lin, L., Srivastava, S., and Dunson, D. B. Machine learning and the future of bayesian computation. arXiv:2304.11251, 2023

2023 arXiv
[33]

Bayes hilbert spaces for posterior approximation

Wynne, G. Bayes hilbert spaces for posterior approximation. 2023

2023
[34]

Deep leakage from gradients

Zhu, L., Liu, Z., and Han, S. Deep leakage from gradients. In Wallach, H., Larochelle, H., Beygelzimer, A., d Alch\' e -Buc, F., Fox, E., and Garnett, R. (eds.), Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019

2019

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

Differentially private simple linear regression

Alabi, D., McMillan, A., Sarathy, J., Smith, A., and Vadhan, S. Differentially private simple linear regression. Proceedings on Privacy Enhancing Technologies, 2022 0 (2): 0 184–204, 2022

work page 2022

[2] [2]

Reconstructing training data with informed adversaries

Balle, B., Cherubin, G., and Hayes, J. Reconstructing training data with informed adversaries. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022

work page 2022

[3] [3]

Bernardo, J. M. and Smith, A. F. M. Bayesian Theory. Wiley, May 1994. ISBN 9780470316870

work page 1994

[4] [4]

and Sheldon, D

Bernstein, G. and Sheldon, D. R. Differentially private bayesian linear regression. In Advances in Neural Information Processing Systems, volume 32, 2019

work page 2019

[5] [5]

and Ramamoorthi, R

Blackwell, D. and Ramamoorthi, R. V. A bayes but not classically sufficient statistic. The Annals of Statistics, 10 0 (3), 1982

work page 1982

[6] [6]

Deconstructing data reconstruction: Multiclass, weight decay and general losses

Buzaglo, G., Haim, N., Yehudai, G., Vardi, G., Oz, Y., Nikankin, Y., and Irani, M. Deconstructing data reconstruction: Multiclass, weight decay and general losses. arxiv:2307.01827, 2023

arXiv 2023

[7] [7]

and Berger, R

Casella, G. and Berger, R. Statistical Inference. Chapman and Hall/CRC, April 2024

work page 2024

[8] [8]

and Steinwart, I

Christmann, A. and Steinwart, I. Support Vector Machines. Springer New York, 2008

work page 2008