Pith. sign in

REVIEW 4 major objections 5 minor 85 references

Membership Inference Attacks with False Discovery Rate Control

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Membership inference attacks can be wrapped in a post-hoc correction that caps the false discovery rate—the share of flagged members that are actually non-members—at any preset level, with negligible extra cost.

desk verdict A useful wrapper that gives MIAs FDR control by bolting conformal p-values and BH onto existing attacks, but the theory as stated assumes exchangeability on the wrong object and the proofs are deferred. read the letter →

arxiv 2508.07066 v1 pith:2EHXWCOZ submitted 2025-08-09 stat.ML cs.CVcs.LG

Chenxu Zhao , Wei Qian , Aobo Chen , Mengdi Huai This is my paper
classification stat.MLcs.CVcs.LG MSC 62F0362G1062G1568T07
keywords membershipinferenceattackfalsediscoveryrateconformalp-valuesBenjamini-Hochbergprivacyauditingmachineunlearninglifelonglearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Membership inference attacks try to decide whether a given record was part of a model's training data, but existing attacks give no statistical control over how many of the records they flag as 'members' are actually non-members. This paper proposes MIAFdR, a wrapper that attaches a non-member probability to every test point using a conformal score, then applies a Benjamini-Hochberg-style correction to those probabilities. It proves two guarantees: a true non-member is labeled a member with probability at most the significance level α, and the false discovery rate (the expected fraction of false member labels among all member labels) is bounded by α times the true non-member proportion, and hence by α itself. Because the wrapper is post-hoc, any score-producing membership inference attack can be converted into one with these guarantees. The empirical results show the bound holds across datasets, attack families, and even under defenses such as knowledge distillation, with negligible added runtime.

What carries the argument

The central object is a conformal p-value. For each test point, the paper computes a conformity score from a binary classifier's output and defines the non-member probability as the fraction of calibration non-member scores no larger than the test score; this is exactly the conformal p-value, so exchangeability gives it its marginal validity. The second component is the adjustment in Eqn. (10), the Benjamini-Hochberg step-up procedure applied to these p-values, which is what converts many marginally valid but dependent p-values into an FDR-controlled decision set. The wrapper structure is the third component: because only scores are needed, any existing MIA can be placed underneath.

What would settle it

In the black-box setting with a ResNet-18 victim and a MobileNetV2 surrogate on CIFAR-10, collect a set of known non-members and count the fraction with non-member probability below α=0.05; if that fraction clearly exceeds 0.05, the marginal guarantee of Theorem 1 is false. Similarly, with the true non-member proportion π0 known, run the full procedure at α=0.1 over ten random splits; empirical FDR values above α·π0 would falsify Theorem 2.

Watch

Extended reading notes

Core claim

The central claim is Theorem 2: for a test set with $T$ points, after ranking the conformal non-member probabilities $p_{(1)} \le \cdots \le p_{(T)}$ and computing adjusted values $p_{(t)}^{\mathrm{adj}} = \min\{1, \min_{m \in \{t,\ldots,T\}} (T/m)\, p_{(m)}\}$, declaring every point with $p_{(t)}^{\mathrm{adj}} \le \alpha$ to be a member controls the false discovery rate in the sense $E[ |R(D_{ts}) \cap H_0^*(D_{ts})| / \max\{1, |R(D_{ts})|\} ] \le \alpha \cdot H_0^*(D_{ts})/T \le \alpha$. The bound is distribution-free and holds even though the individual probabilities are interdependent, because the adjustment is the Benjamini-Hochberg correction. Theorem 1 provides the per-point ingredie

Load-bearing premise

The guarantees rest on treating the victim model's score on a test point as exchangeable with surrogate models' calibration scores, which in the black-box setting with different architectures is a formal violation rather than a proven fact.

Editorial extensions

If this is right

  • Any score-based membership inference attack can be turned into one with FDR control by plugging its scores into MIAFdR; the extra inference cost is tiny (about 0.01 seconds for 7,000 test points).
  • Attack accuracy and AUROC are preserved or slightly improved across datasets: e.g., on CIFAR-100 classifier-based accuracy rises from 76.8% to 78.2%.
  • The FDR bound remains valid under common defenses such as knowledge distillation, so privacy auditing can report calibrated error rates even when the model is hardened.
  • In black-box settings where the surrogate architecture differs from the victim, the method still keeps empirical FDR near the analytical line across ResNet-18, ResNet-50, VGG-16, and MobileNetV2 combinations.
  • The wrapper also applies to memorization-based tasks: machine unlearning verification and lifelong learning assessment can report a controlled proportion of samples wrongly labeled as 'not unlearned' or 'memorized'.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The formal exchangeability premise is strongest in the grey-box setting; the black-box results rely on transferability, so the Theorem 2 bound should be read as approximate there unless the surrogate ensemble is demonstrably close to the victim.
  • The bound $\alpha \cdot \pi_0$ is tighter than $\alpha$ when few test points are non-members, meaning the procedure is conservative in member-heavy test sets; an adversary auditing a mostly-member set gets a stronger guarantee for free.
  • A natural next test is to replace the single calibration split with cross-conformal or split-conformal variants to reduce the dependence among p-values and potentially sharpen the FDR bound further.
  • Because the wrapper only consumes scores, it could be grafted onto label-only or query-efficient MIA variants, provided their scores can be made exchangeable with a calibration set.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes MIAFdR, a wrapper method for membership inference attacks that aims to provide false discovery rate (FDR) control. For each test point, a non-member relative probability is computed as a conformal p-value from scores produced by a binary classifier trained on surrogate-model predictions. The p-values are then adjusted via the Benjamini-Hochberg procedure (Eq. 10), and the paper claims a distribution-free bound E[FDP] ≤ α·π0 ≤ α (Theorem 2) together with a marginal guarantee on falsely labeling non-members as members (Theorem 1). Experiments on CIFAR-10/100 and Tiny-ImageNet with several base MIA methods report FDR curves below the analytical bound, plus applications to machine unlearning and lifelong learning.

Significance. If the stated guarantees hold as advertised, MIAFdR would be a useful and cheap post-hoc wrapper that turns existing membership inference attacks into procedures with FDR control, addressing a real gap in the MIA literature. The empirical FDR curves in the grey-box settings match the claimed α·π0 bound, and the additional runtime is negligible. However, the paper's contribution is primarily an application of conformal p-values plus BH adjustment; the theoretical novelty is limited, and the central guarantees are not actually proved in the manuscript. The main value is the framing and empirical demonstration, conditional on the theory being repaired.

major comments (4)
  1. [Theorem 1 / Eq. (9)] The premise of Theorem 1 is insufficient for the claimed marginal guarantee in the actual pipeline. The theorem assumes exchangeability of the raw sequence G = (x1,...,xm,xt). But the p-value in Eq. (8) is computed from scores S(y;θbc), where the calibration scores use surrogate outputs f(xj;θ~k) and the test score uses victim outputs f(xt;θ*); θbc is itself fitted to surrogate predictions (Eqs. 4-6). Exchangeability of raw x's does not imply exchangeability of these scores. In the black-box experiments (Section 5, Fig. 6a) the surrogate and victim architectures differ, so score exchangeability is violated by construction. As written, Theorem 1 does not prove Eq. (9) for the proposed procedure; an explicit assumption of score exchangeability under H0, a bound on the violation, or a changed theorem is required. This gap also propagates to Theorem 2.
  2. [Theorem 2 / Eq. (13)] The FDR guarantee is asserted but its proof is deferred to the full version. The p-values are not independent: all use the same calibration set C2,ca_au and the same fitted θbc. BH control under dependence requires conditions such as PRDS; the manuscript cites [7] but does not state or verify that those conditions hold for these conformal p-values. Without this, the advertised 'distribution-free' FDR bound is not established. The empirical FDR curves in Figs. 3/5/7/8 are encouraging but do not substitute for the missing proof.
  3. [Section 4, proofs] Both central theorems (Theorem 1 and Theorem 2) have proofs deferred to 'the full version of the paper.' Since the paper's claimed contribution is the theoretical guarantee, this is not merely a presentation issue: the claims cannot be checked from the manuscript. The authors should include complete proofs or detailed proof sketches, including the exact exchangeability and dependence assumptions needed at each step.
  4. [Section 5, black-box setting] The black-box experiments (Fig. 6a) report only attack accuracy, not FDR. This is the setting where the score-exchangeability premise is least plausible, because the surrogate and victim architectures differ. Since the central claim is FDR control, an empirical FDR check in this setting is needed; attack accuracy alone does not validate the guarantee.
minor comments (5)
  1. [Eq. (8)] The notation 'Sk ∈ C2,ca ∪ {S(yt;θbc)}' is ambiguous. The numerator should explicitly define whether it counts only calibration scores or also the test score; this affects the range and interpretation of the conformal p-value.
  2. [Eq. (4)] The union defining Y2,ca_au is written over |D2,tr|, which appears to be a typo; it should be over |D2,ca|.
  3. [Section 5.1] The text says 'From D2, we then sample a fraction η = 3/7 to obtain {D1,k}', but earlier D1,k is constructed from D1. This is inconsistent and should be corrected.
  4. [Figure 1] The overview figure is too compressed to read; labels such as 'Calibration Score Cau^2,ca' are unclear. A larger, cleaner diagram would help.
  5. [Theorem 1] The statement conditions on the event xt ∉ Dtr, but Dtr is fixed. Please clarify the probability space and what is random in this statement.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the FDR guarantee is an application of external conformal-p-value and Benjamini-Hochberg results; self-citations are background and no fitted quantity enters the bound.

full rationale

The paper's central claim (Theorem 2, Eq. 13) is assembled from two external statistical ingredients: conformal p-values (Eq. 8) and Benjamini-Hochberg adjustment (Eq. 10). The p-value in Eq. 8 is the standard conformal rank; its validity under exchangeability is a known result (cite [7], Bates et al.), not a conclusion manufactured by the paper's own fitted parameters. The adjusted probabilities in Eq. 10 are exactly the BH thresholds, and the FDR bound in Eq. 13 is the standard BH guarantee (cite [9]). None of the method's hand-chosen quantities (λ, η, θbc) appears in the bound except through the scores, and the bound holds for any score function provided the required exchangeability holds. The self-citations ([14], [15], [46], [54], [69], [83]) appear in related-work and application contexts; they are not the load-bearing support for Theorems 1 or 2. The only substantive concern is a formal assumption gap: Theorem 1 assumes exchangeability of the raw sequence G, while the actual pipeline compares scores from the victim model against scores from surrogate models, and θbc is itself fitted to surrogate predictions. In the black-box setting with differing architectures, this score-level exchangeability is not guaranteed. That is a validity/completeness issue, not a circular reduction. Additionally, the proofs of Theorems 1 and 2 are explicitly deferred to the full version, an omitted-proof limitation. These issues do not make the derivation circular, so the circularity score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The FDR guarantee rests almost entirely on two established results imported from the cited literature: conformal p-value validity and Benjamini-Hochberg FDR control. The paper's own additions are the conformity score parameterization (with hand-chosen λ), the surrogate wrapper protocol (with η and unstated K), and the application to MIA. No parameters are fitted to obtain the FDR bound, so the guarantee is not a disguised fit.

free parameters (3)
  • λ = not reported
    Hyperparameter in the conformity score S(yt) = λ logit(fbc) + (1−λ) fbc (Eqn 6). Chosen by hand; affects attack accuracy but not the validity of the FDR bound, which holds for any score under exchangeability.
  • η = 3/7
    Fraction of D1_au sampled without replacement to form each surrogate training subset (Section 4). A protocol choice from the experiments, not theoretically motivated.
  • K (number of surrogate models) = not reported for classifier-based experiments (64 for LiRA)
    The main text specifies K surrogates but never states K for the classifier-based experiments; required to reproduce.
assumptions (4)
  • domain assumption The test conformity score is exchangeable with the calibration conformity scores (Theorem 1 premise)
    Required for the conformal p-value in Eqn (8) to be valid. Strained because test scores use the victim model while calibration scores use surrogate models; in black-box settings the architectures differ.
  • standard math Conformal p-values are stochastically no smaller than uniform under exchangeability
    Theorem 1's P(p ≤ α | non-member) ≤ α is the standard conformal validity result (Vovk et al. [67], Bates et al. [7]).
  • standard math Benjamini-Hochberg controls FDR for these dependent p-values
    Eqn (10) is exactly BH; FDR control requires independence or positive regression dependence, which holds for conformal p-values sharing a calibration set (Bates et al. [7]). Paper cites [9] for BH but relies on [7] for the dependence structure.
  • domain assumption Surrogate models approximate the victim model's output distribution
    The null distribution estimated from surrogate non-members must match the victim model's non-member output distribution; assumed in Section 4 and the black-box Discussion (transferability).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Membership Inference Attacks with False Discovery Rate Control." pith.science (2026). https://pith.science/paper/2EHXWCOZ

@misc{pith2026250807066,
  author       = {Pith},
  title        = {Pith review of: Membership Inference Attacks with False Discovery Rate Control},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2EHXWCOZ}},
  note         = {Machine review of arXiv:2508.07066}
}
read the original abstract

Recent studies have shown that deep learning models are vulnerable to membership inference attacks (MIAs), which aim to infer whether a data record was used to train a target model or not. To analyze and study these vulnerabilities, various MIA methods have been proposed. Despite the significance and popularity of MIAs, existing works on MIAs are limited in providing guarantees on the false discovery rate (FDR), which refers to the expected proportion of false discoveries among the identified positive discoveries. However, it is very challenging to ensure the false discovery rate guarantees, because the underlying distribution is usually unknown, and the estimated non-member probabilities often exhibit interdependence. To tackle the above challenges, in this paper, we design a novel membership inference attack method, which can provide the guarantees on the false discovery rate. Additionally, we show that our method can also provide the marginal probability guarantee on labeling true non-member data as member data. Notably, our method can work as a wrapper that can be seamlessly integrated with existing MIA methods in a post-hoc manner, while also providing the FDR control. We perform the theoretical analysis for our method. Extensive experiments in various settings (e.g., the black-box setting and the lifelong learning setting) are also conducted to verify the desirable performance of our method.

Figures

Figures reproduced from arXiv: 2508.07066 by the authors.

Figure 1
Figure 1. Overview of our proposed membership inference attacks with the false discovery rate guarantee. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Statistical validity and running time. 5. Experiments In this section, we conduct extensive experiments to evalu￾ate the effectiveness of our proposed MIAFdR. More exper￾imental details and results (e.g., Quantile Regression-based MIAs and differential privacy-based MIA defenses) are de￾ferred to the full version of the paper. Datasets and Models. In the experiments, we adopt the following popular benchmark image da… view at source ↗
Figure 3
Figure 3. FDR control of classifier-based and metric-based MIAFdR. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: MIAFdR against KD defense. Moreover, we investigate the attack effectiveness of MI￾AFdR with classifier-based MIAs, extending our analysis beyond the FDR control. Our assessment contrasts the baseline classifier-based MIA [61] with an enhanced ver￾sion that incorporate…
Figure 6
Figure 6. Figure 6: Black-box setting and ablation study of MIAFdR on CIFAR-10. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 8
Figure 8. Figure 8: Lifelong learning with MIAFdR. 6. Conclusion In this paper, we design a novel membership inference at￾tack method, which can provide the false discovery rate guarantees. Notably, our proposed MIAFdR can work as a wrapper that can be seamlessly integrated with existing …
Figure 7
Figure 7. Figure 7: Machine unlearning with MIAFdR. Additionally, we conduct ablation experiments to show the impact of our MIAFdR in enhancing traditional data memorization-based ML tasks. First, in Figure 7a, we re￾port the obtained expected proportion results of instances erroneously i…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

85 extracted references · 64 canonical work pages

  1. [7]

    Testing for outliers with conformal p-values

    Stephen Bates, Emmanuel Cand `es, Lihua Lei, Yaniv Ro- mano, and Matteo Sesia. Testing for outliers with conformal p-values. The Annals of Statistics, 51(1):149–178, 2023. 2, 5, 6

    work page 2023

  2. [1]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016. 3

    2016

  3. [2]

    Estimat- ing example difficulty using variance of gradients

    Chirag Agarwal, Daniel D’souza, and Sara Hooker. Estimat- ing example difficulty using variance of gradients. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10368–10378, 2022. 2

    2022

  4. [3]

    Memory aware synapses: Learning what (not) to forget

    Rahaf Aljundi, Francesca Babiloni, Mohamed Elhoseiny, Marcus Rohrbach, and Tinne Tuytelaars. Memory aware synapses: Learning what (not) to forget. In Proceedings of the European conference on computer vision (ECCV), pages 139–154, 2018. 8

    2018

  5. [4]

    A gentle in- troduction to conformal prediction and distribution-free un- certainty quantification

    Anastasios N Angelopoulos and Stephen Bates. A gentle in- troduction to conformal prediction and distribution-free un- certainty quantification. arXiv preprint arXiv:2107.07511 ,

    arXiv

  6. [5]

    Controlling the false discovery rate via knockoffs

    Rina Foygel Barber and Emmanuel J Cand`es. Controlling the false discovery rate via knockoffs. The Annals of statistics , pages 2055–2085, 2015. 2

  7. [6]

    Practical ad- versarial multivalid conformal prediction

    Osbert Bastani, Varun Gupta, Christopher Jung, Georgy Noarov, Ramya Ramalingam, and Aaron Roth. Practical ad- versarial multivalid conformal prediction. Advances in Neu- ral Information Processing Systems, 35:29362–29373, 2022. 2

    2022

  8. [8]

    Discovering the false discovery rate

    Yoav Benjamini. Discovering the false discovery rate. Jour- nal of the Royal Statistical Society Series B: Statistical Methodology, 72(4):405–416, 2010. 2

    work page 2010

Show all 85 references
  1. [9]

    Controlling the false discovery rate: a practical and powerful approach to multiple testing

    Yoav Benjamini and Yosef Hochberg. Controlling the false discovery rate: a practical and powerful approach to multiple testing. Journal of the Royal statistical society: series B (Methodological), 57(1):289–300, 1995. 2

    1995

  2. [10]

    Scalable member- ship inference attacks via quantile regression

    Martin Bertran, Shuai Tang, Aaron Roth, Michael Kearns, Jamie H Morgenstern, and Steven Z Wu. Scalable member- ship inference attacks via quantile regression. Advances in Neural Information Processing Systems, 36, 2024. 1, 2, 3, 6

    2024

  3. [11]

    Machine unlearning

    Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP) , pages 141–159. IEEE, 2021. 1, 8

    2021

  4. [12]

    Membership inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP) , pages 1897–1914. IEEE, 2022. 1, 2, 3, 6, 7

    2022

  5. [13]

    Quan- tifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quan- tifying memorization across neural language models. In The Eleventh International Conference on Learning Representa- tions, 2023. 2

    2023

  6. [14]

    Modeling and understanding un- certainty in medical image classification

    Aobo Chen, Yangyi Li, Wei Qian, Kathryn Morse, Chenglin Miao, and Mengdi Huai. Modeling and understanding un- certainty in medical image classification. In International Conference on Medical Image Computing and Computer- Assisted Intervention, pages 557–567. Springer, 2024. 2

    2024

  7. [15]

    A survey of security and privacy issues of machine unlearning,

    Aobo Chen, Yangyi Li, Chenxu Zhao, and Mengdi Huai. A survey of security and privacy issues of machine unlearning,

  8. [16]

    When machine unlearn- ing jeopardizes privacy

    Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. When machine unlearn- ing jeopardizes privacy. In Proceedings of the 2021 ACM SIGSAC conference on computer and communications secu- rity, pages 896–911, 2021. 1

    2021

  9. [17]

    Boundary unlearning: Rapid forgetting of deep net- works via shifting the decision boundary

    Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep net- works via shifting the decision boundary. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7766–7775, 2023. 1

    2023

  10. [18]

    Putting the object back into video object segmentation

    Ho Kei Cheng, Seoung Wug Oh, Brian Price, Joon-Young Lee, and Alexander Schwing. Putting the object back into video object segmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 3151–3161, 2024. 1

    2024

  11. [19]

    Shadow-free membership infer- ence attacks: Recommender systems are more vulnerable than you thought

    Xiaoxiao Chi, Xuyun Zhang, Yan Wang, Lianyong Qi, Amin Beheshti, Xiaolong Xu, Kim-Kwang Raymond Choo, Shuo Wang, and Hongsheng Hu. Shadow-free membership infer- ence attacks: Recommender systems are more vulnerable than you thought. arXiv preprint arXiv:2405.07018 , 2024. 2

    2024 arXiv

  12. [20]

    Membership inference at- tack using self influence functions

    Gilad Cohen and Raja Giryes. Membership inference at- tack using self influence functions. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 4892–4901, 2024. 1, 2

    2024

  13. [21]

    Theory of probability: A critical introduc- tory treatment

    Bruno De Finetti. Theory of probability: A critical introduc- tory treatment. John Wiley & Sons, 2017. 5

    2017

  14. [22]

    Objaverse: A universe of annotated 3d objects

    Matt Deitke, Dustin Schwenk, Jordi Salvador, Luca Weihs, Oscar Michel, Eli VanderBilt, Ludwig Schmidt, Kiana Ehsani, Aniruddha Kembhavi, and Ali Farhadi. Objaverse: A universe of annotated 3d objects. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Rec...

    2023

  15. [23]

    Leveraging adversarial examples to quantify membership information leakage

    Ganesh Del Grosso, Hamid Jalalzai, Georg Pichler, Catuscia Palamidessi, and Pablo Piantanida. Leveraging adversarial examples to quantify membership information leakage. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, pages 10399–10409, ...

    2022

  16. [24]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 6

    2009

  17. [25]

    Eva: Exploring the limits of masked visual representa- tion learning at scale

    Yuxin Fang, Wen Wang, Binhui Xie, Quan Sun, Ledell Wu, Xinggang Wang, Tiejun Huang, Xinlong Wang, and Yue Cao. Eva: Exploring the limits of masked visual representa- tion learning at scale. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition,...

    2023

  18. [26]

    What neural networks memorize and why: Discovering the long tail via influence estimation

    Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. Advances in Neural Information Processing Sys- tems, 33:2881–2891, 2020. 2

    2020

  19. [27]

    Conditional calibration for false discovery rate control under dependence

    William Fithian and Lihua Lei. Conditional calibration for false discovery rate control under dependence. The Annals of Statistics, 50(6):3091–3118, 2022. 2

    2022

  20. [28]

    Adaptive conformal in- ference under distribution shift

    Isaac Gibbs and Emmanuel Candes. Adaptive conformal in- ference under distribution shift. Advances in Neural Infor- mation Processing Systems, 34:1660–1672, 2021. 2

    2021

  21. [29]

    Certified data removal from machine learning models

    Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. arXiv preprint arXiv:1911.03030, 2019. 1

    1911 arXiv

  22. [30]

    Mem- bership inference attacks on deep regression models for neu- roimaging

    Umang Gupta, Dimitris Stripelis, Pradeep K Lam, Paul Thompson, Jose Luis Ambite, and Greg Ver Steeg. Mem- bership inference attacks on deep regression models for neu- roimaging. In Medical Imaging with Deep Learning , pages 228–251. PMLR, 2021. 2

    2021

  23. [31]

    Remind your neural net- work to prevent catastrophic forgetting

    Tyler L Hayes, Kushal Kafle, Robik Shrestha, Manoj Acharya, and Christopher Kanan. Remind your neural net- work to prevent catastrophic forgetting. In European con- ference on computer vision, pages 466–483. Springer, 2020. 2

    2020

  24. [32]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016. 1

    2016

  25. [33]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 6

    2016

  26. [34]

    Semi-leak: Membership inference attacks against semi-supervised learning

    Xinlei He, Hongbin Liu, Neil Zhenqiang Gong, and Yang Zhang. Semi-leak: Membership inference attacks against semi-supervised learning. In European Conference on Com- puter Vision, pages 365–381. Springer, 2022. 1, 2, 3

    2022

  27. [35]

    Segmentations-leak: Membership inference attacks and de- fenses in semantic image segmentation

    Yang He, Shadi Rahimian, Bernt Schiele, and Mario Fritz. Segmentations-leak: Membership inference attacks and de- fenses in semantic image segmentation. InComputer Vision– ECCV 2020: 16th European Conference, Glasgow, UK, Au- gust 23–28, 2020, Proceedings, Part XXIII 16 , pages 519–

    2020

  28. [36]

    Resolving individuals contributing trace amounts of dna to highly complex mixtures using high-density snp genotyping microarrays

    Nils Homer, Szabolcs Szelinger, Margot Redman, David Duggan, Waibhav Tembe, Jill Muehling, John V Pearson, Dietrich A Stephan, Stanley F Nelson, and David W Craig. Resolving individuals contributing trace amounts of dna to highly complex mixtures using high-density snp genotyp...

    2008

  29. [37]

    Membership inference at- tacks on machine learning: A survey

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. Membership inference at- tacks on machine learning: A survey. ACM Computing Sur- veys (CSUR), 54(11s):1–37, 2022. 1, 2

    2022

  30. [38]

    Subpopulation data poisoning attacks

    Matthew Jagielski, Giorgio Severi, Niklas Pousette Harger, and Alina Oprea. Subpopulation data poisoning attacks. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 3104–3122,

    2021

  31. [39]

    False discovery rate con- trol via debiased lasso

    Adel Javanmard and Hamid Javadi. False discovery rate con- trol via debiased lasso. 2019. 2

    2019

  32. [40]

    Segment any- thing

    Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer White- head, Alexander C Berg, Wan-Yen Lo, et al. Segment any- thing. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 4015–4026, 2023. 1

    2023

  33. [41]

    Practical membership inference attacks against large- scale multi-modal models: A pilot study

    Myeongseob Ko, Ming Jin, Chenguang Wang, and Ruoxi Jia. Practical membership inference attacks against large- scale multi-modal models: A pilot study. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 4871–4881, 2023. 1, 2

    2023

  34. [42]

    Masked autoen- coders are scalable learners of cellular morphology

    Oren Kraus, Kian Kenyon-Dean, Saber Saberian, Maryam Fallah, Peter McLean, Jess Leung, Vasudev Sharma, Ayla Khan, Jia Balakrishnan, Safiye Celik, et al. Masked autoen- coders are scalable learners of cellular morphology. arXiv preprint arXiv:2309.16064, 2023. 1

    2023 arXiv

  35. [43]

    Cifar-10 (canadian institute for advanced research)

    Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar-10 (canadian institute for advanced research). URL http://www. cs. toronto. edu/kriz/cifar. html, 2009. 6

    2009

  36. [44]

    Confor- mal prediction with large language models for multi-choice question answering

    Bhawesh Kumar, Charlie Lu, Gauri Gupta, Anil Palepu, David Bellamy, Ramesh Raskar, and Andrew Beam. Confor- mal prediction with large language models for multi-choice question answering. arXiv preprint arXiv:2305.18404, 2023. 2

    2023 arXiv

  37. [45]

    Towards transferable targeted attack

    Maosen Li, Cheng Deng, Tengjiao Li, Junchi Yan, Xinbo Gao, and Heng Huang. Towards transferable targeted attack. In Proceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 641–649, 2020. 6

    2020

  38. [46]

    Data poisoning attacks against con- formal prediction

    Yangyi Li, Aobo Chen, Wei Qian, Chenxu Zhao, Divya Lid- der, and Mengdi Huai. Data poisoning attacks against con- formal prediction. In International Conference on Machine Learning, pages 27563–27574. PMLR, 2024. 2

    2024

  39. [47]

    Integra- tive conformal p-values for powerful out-of-distribution test- ing with labeled outliers

    Ziyi Liang, Matteo Sesia, and Wenguang Sun. Integra- tive conformal p-values for powerful out-of-distribution test- ing with labeled outliers. arXiv preprint arXiv:2208.11111,

    arXiv

  40. [48]

    A pragmatic approach to membership inferences on machine learning models

    Yunhui Long, Lei Wang, Diyue Bu, Vincent Bindschaedler, Xiaofeng Wang, Haixu Tang, Carl A Gunter, and Kai Chen. A pragmatic approach to membership inferences on machine learning models. In 2020 IEEE European Symposium on Se- curity and Privacy (EuroS&P), pages 521–534. IEEE, 2020. 2

    2020

  41. [49]

    Global and simul- taneous hypothesis testing for high-dimensional logistic re- gression models

    Rong Ma, T Tony Cai, and Hongzhe Li. Global and simul- taneous hypothesis testing for high-dimensional logistic re- gression models. Journal of the American Statistical Associ- ation, 116(534):984–998, 2021. 2

    2021

  42. [50]

    Machine learning meets false discovery rate

    Ariane Marandon, Lihua Lei, David Mary, and Etienne Roquain. Machine learning meets false discovery rate. arXiv preprint arXiv:2208.06685, 2022. 2

    2022 arXiv

  43. [51]

    Membership inference attacks against diffusion models

    Tomoya Matsumoto, Takayuki Miura, and Naoto Yanai. Membership inference attacks against diffusion models. In 2023 IEEE Security and Privacy Workshops (SPW) , pages 77–83. IEEE, 2023. 2

    2023

  44. [52]

    A survey on membership inference at- tacks and defenses in machine learning

    Jun Niu, Peng Liu, Xiaoyan Zhu, Kuo Shen, Yuecong Wang, Haotian Chi, Yulong Shen, Xiaohong Jiang, Jianfeng Ma, and Yuqing Zhang. A survey on membership inference at- tacks and defenses in machine learning. Journal of Informa- tion and Intelligence, 2024. 3

    2024

  45. [53]

    Towards understanding and enhancing robustness of deep learning models against malicious unlearning attacks

    Wei Qian, Chenxu Zhao, Wei Le, Meiyi Ma, and Mengdi Huai. Towards understanding and enhancing robustness of deep learning models against malicious unlearning attacks. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , pages 1932–1942,

    1932

  46. [54]

    Towards modeling uncertainties of self-explaining neural networks via conformal prediction

    Wei Qian, Chenxu Zhao, Yangyi Li, Fenglong Ma, Chao Zhang, and Mengdi Huai. Towards modeling uncertainties of self-explaining neural networks via conformal prediction. In Proceedings of the AAAI Conference on Artificial Intelli- gence, pages 14651–14659, 2024. 2

    2024

  47. [55]

    On the difficulty of member- ship inference attacks

    Shahbaz Rezaei and Xin Liu. On the difficulty of member- ship inference attacks. InProceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 7892–7900, 2021. 2

    2021

  48. [56]

    Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models

    Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246, 2018. 6

    2018 arXiv

  49. [57]

    Mobilenetv2: Inverted residuals and linear bottlenecks

    Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zh- moginov, and Liang-Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 4510–4520, 2018. 6

    2018

  50. [58]

    Just how toxic is data poison- ing? a unified benchmark for backdoor and data poisoning attacks

    Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P Dickerson, and Tom Goldstein. Just how toxic is data poison- ing? a unified benchmark for backdoor and data poisoning attacks. In International Conference on Machine Learning , pages 9389–9398. PMLR, 2021. 6

    2021

  51. [59]

    Member- ship inference attacks are easier on difficult problems

    Avital Shafran, Shmuel Peleg, and Yedid Hoshen. Member- ship inference attacks are easier on difficult problems. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 14820–14829, 2021. 2

    2021

  52. [60]

    Membership pri- vacy for machine learning models through knowledge trans- fer

    Virat Shejwalkar and Amir Houmansadr. Membership pri- vacy for machine learning models through knowledge trans- fer. In Proceedings of the AAAI conference on artificial in- telligence, pages 9549–9557, 2021. 3

    2021

  53. [61]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017. 1, 3, 6, 7

    2017

  54. [62]

    Very deep convo- lutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convo- lutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014. 6

    2014 arXiv

  55. [63]

    Systematic evaluation of pri- vacy risks of machine learning models

    Liwei Song and Prateek Mittal. Systematic evaluation of pri- vacy risks of machine learning models. In 30th USENIX Se- curity Symposium (USENIX Security 21), pages 2615–2632,

  56. [64]

    A taxonomy and terminology of adversarial machine learning

    Elham Tabassi, Kevin J Burns, Michael Hadjimichael, An- dres D Molina-Markham, and Julian T Sexton. A taxonomy and terminology of adversarial machine learning. NIST IR, 2019:1–29, 2019. 1

    2019

  57. [65]

    Unrolling sgd: Understanding factors in- fluencing machine unlearning

    Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. Unrolling sgd: Understanding factors in- fluencing machine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pages 303–

    2022

  58. [66]

    Conformal prediction under covariate shift

    Ryan J Tibshirani, Rina Foygel Barber, Emmanuel Candes, and Aaditya Ramdas. Conformal prediction under covariate shift. Advances in neural information processing systems , 32, 2019. 2

    2019

  59. [67]

    Algorithmic learning in a random world

    Vladimir V ovk, Alexander Gammerman, and Glenn Shafer. Algorithmic learning in a random world. Springer, 2005. 2

    2005

  60. [68]

    Yolov7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors

    Chien-Yao Wang, Alexey Bochkovskiy, and Hong- Yuan Mark Liao. Yolov7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors. In Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7464–7475, 2023. 1

    2023

  61. [69]

    Bridging model heterogeneity in federated learning via uncertainty- based asymmetrical reciprocity learning

    Jiaqi Wang, Chenxu Zhao, Lingjuan Lyu, Quanzeng You, Mengdi Huai, and Fenglong Ma. Bridging model heterogeneity in federated learning via uncertainty- based asymmetrical reciprocity learning. arXiv preprint arXiv:2407.03247, 2024. 2

    2024 arXiv

  62. [70]

    Transferable normalization: Towards im- proving transferability of deep neural networks

    Ximei Wang, Ying Jin, Mingsheng Long, Jianmin Wang, and Michael I Jordan. Transferable normalization: Towards im- proving transferability of deep neural networks. Advances in neural information processing systems, 32, 2019. 6

    2019

  63. [71]

    Continual learning with lifelong vision trans- former

    Zhen Wang, Liu Liu, Yiqun Duan, Yajing Kong, and Dacheng Tao. Continual learning with lifelong vision trans- former. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 171–181,

  64. [72]

    Machine unlearning of features and la- bels

    Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine unlearning of features and la- bels. arXiv preprint arXiv:2108.11577, 2021. 1

    2021 arXiv

  65. [73]

    On the importance of difficulty calibra- tion in membership inference attacks

    Lauren Watson, Chuan Guo, Graham Cormode, and Alex Sablayrolles. On the importance of difficulty calibra- tion in membership inference attacks. arXiv preprint arXiv:2111.08440, 2021. 6

    2021 arXiv

  66. [74]

    Membership inference attacks against medical databases

    Tianxiang Xu, Chang Liu, Kun Zhang, and Jianlin Zhang. Membership inference attacks against medical databases. In International Conference on Neural Information Processing, pages 15–25. Springer, 2023. 2

    2023

  67. [75]

    Enhanced membership inference attacks against machine learning models

    Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vin- cent Bindschaedler, and Reza Shokri. Enhanced membership inference attacks against machine learning models. In Pro- ceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 3093–3106, 2022. 2

    2022

  68. [76]

    Privacy risk in machine learning: Analyzing the connection to overfitting

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer se- curity foundations symposium (CSF), pages 268–282. IEEE,

    2018

  69. [77]

    Robust yet efficient conformal prediction sets

    Soroush H Zargarbashi, Mohammad Sadegh Akhondzadeh, and Aleksandar Bojchevski. Robust yet efficient conformal prediction sets. arXiv preprint arXiv:2407.09165, 2024. 2

    2024 arXiv

  70. [78]

    Low-cost high-power membership inference by boosting relativity

    Sajjad Zarifzadeh, Philippe Cheng-Jie Marc Liu, and Reza Shokri. Low-cost high-power membership inference by boosting relativity. arXiv preprint arXiv:2312.03262, 2023. 1

    2023 arXiv

  71. [79]

    Label-only membership inference attacks and defenses in semantic segmentation models

    Guangsheng Zhang, Bo Liu, Tianqing Zhu, Ming Ding, and Wanlei Zhou. Label-only membership inference attacks and defenses in semantic segmentation models. IEEE Transac- tions on Dependable and Secure Computing , 20(2):1435– 1449, 2022. 2

    2022

  72. [80]

    Membership inference attacks against recommender systems

    Minxing Zhang, Zhaochun Ren, Zihan Wang, Pengjie Ren, Zhunmin Chen, Pengfei Hu, and Yang Zhang. Membership inference attacks against recommender systems. In Proceed- ings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 864–879, 2021. 2

    2021

  73. [81]

    Generated distributions are all you need for membership inference attacks against generative models

    Minxing Zhang, Ning Yu, Rui Wen, Michael Backes, and Yang Zhang. Generated distributions are all you need for membership inference attacks against generative models. In Proceedings of the IEEE/CVF Winter Conference on Appli- cations of Computer Vision, pages 4839–4849, 2024. 2

    2024

  74. [82]

    Order of magnitude speedups for llm membership inference

    Rongting Zhang, Martin Bertran, and Aaron Roth. Order of magnitude speedups for llm membership inference. arXiv preprint arXiv:2409.14513, 2024. 3

    2024 arXiv

  75. [83]

    Static and sequential malicious attacks in the context of selective forgetting

    Chenxu Zhao, Wei Qian, Rex Ying, and Mengdi Huai. Static and sequential malicious attacks in the context of selective forgetting. Advances in Neural Information Processing Sys- tems, 36:74966–74979, 2023. 1

    2023

  76. [84]

    Blur interpolation transformer for real-world motion from blur

    Zhihang Zhong, Mingdeng Cao, Xiang Ji, Yinqiang Zheng, and Imari Sato. Blur interpolation transformer for real-world motion from blur. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 5713–5723, 2023. 1

    2023

  77. [85]

    Conditional prompt learning for vision-language mod- els

    Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. Conditional prompt learning for vision-language mod- els. In Proceedings of the IEEE/CVF conference on com- puter vision and pattern recognition , pages 16816–16825,

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.