Pith. sign in

REVIEW 4 major objections 4 minor 29 references

This paper introduces Robust Privacy: if a model's output is invariant within radius R of an input at confidence 1−α, then a label-only adversary gains at most α/2 advantage in distinguishing the input from others within that radius.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Certified output invariance is reframed as inference-stage privacy, expanding the range of sensitive attribute values compatible with a prediction and disrupting label-only model inversion attacks.

T0 review reviewed 2026-08-03 challenge →

load-bearing objection Worth one look: the empirical story is plausible, but the advertised α/2 guarantee is absent from the actual paper—so treat the abstract as aspiration. the 4 major comments →

arxiv 2601.17360 v2 pith:D4TNPHBC submitted 2026-01-24 cs.LG cs.AIcs.CR

Robust Privacy: Inference-Stage Privacy through Certified Robustness

Jiankai Jin , Xiangzheng Zhang , Zhao Liu , Wenzhuo Xu , Dongdong Yang , Deyue Zhang , Quanchen Zou This is my paper
classification cs.LG cs.AIcs.CR
keywords Robust Privacycertified robustnessinference-time privacyattribute inferencemodel inversion attacksrandomized smoothinglabel-only adversary
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Robust Privacy is the claim that a model's local output invariance can be turned into a privacy guarantee at inference time. The paper defines an input x as (R,α)-Robust Private if the model's prediction is invariant on the radius-R ball around x at confidence 1−α, and asserts that any adversary seeing only that label has at most α/2 advantage in telling x apart from any point inside the ball. From this it derives Attribute Privacy Enhancement, widening the set of sensitive-attribute values consistent with a released prediction, and it tests the idea on a recommendation task and a label-only model-inversion attack, reporting that invariance reduces inversion success from 73% to 4% while largely preserving accuracy. If correct, the notion gives model deployers a practical inference-stage countermeasure against attribute inference and training-data reconstruction, complementing training-stage protections such as differential privacy.

Core claim

On its own terms, the paper's central discovery is that certified robustness—usually built for adversarial defense—is already a privacy mechanism: a robust radius R at x is exactly the radius within which observing f(x) leaves x indistinguishable from its neighbors B_p(x,R) ⊆ f^{-1}(f(x)). The paper then defines Attribute Privacy Enhancement as the union expansion of the baseline inference set I_y by the robust radii at each compatible attribute value, and demonstrates on a BMI-threshold recommendation task that this widens the inference interval (median length from 23.50 to 29.96 in the abstract) and, on a face-recognition inversion task with label-only access, that Gaussian smoothing's inv

What carries the argument

The load-bearing object is robust radius R from randomized smoothing, defined by R=(σ/2)(Φ^{-1}(p_A)−Φ^{-1}(p_B)) with confidence 1−α. Definition 1 (Robust Privacy) says that B_p(x,R) ⊆ f^{-1}(f(x)); Definition 2 (APE) expands the baseline inference set to I_y^(R)=∪_{z∈I_y}[z−R_z,z+R_z]. The mechanism carries the argument because the invariance ball is what makes the released label compatible with all nearby inputs, and the smoothing noise scale σ and Monte Carlo sampling size N control the radius.

Load-bearing premise

The central claim rests on the unproven premise that output invariance on a ball is itself enough to cap an adversary's inference advantage at α/2—an assumption that silently presumes a uniform prior over the ball, a single label query, and in the model-inversion experiments the removal of abstention, none of which the paper proves to hold.

What would settle it

Run the label-only inversion attack against the certified classifier with abstention enabled, and compare ASR with the always-return-a-label protocol used in Section 6; if ASR rises sharply, the reported 4% is an artifact of query refusal, not invariance. Separately, compute the exact Bayesian advantage for a two-point prior inside the ball; if it exceeds α/2, the paper's headline bound is false. Both are directly checkable.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Observation of a prediction cannot single out x among the points inside its certified ball, so the sensitive-attribute inference interval widens; the paper reports median RAP-compatible interval length growing from 23.50 to 29.96.
  • Label-only model-inversion attacks lose their directional update signal: ASR falls from 73% to 4% at σ=0.1 with N=100 and to 44% at σ=0.03 with N=100 while accuracy remains 100%.
  • Strengthening the certificate (larger N) can improve both utility and privacy; the paper reports accuracy increasing and ASR decreasing together when N goes from 10 to 100.
  • Because it targets the inference interface rather than training, RP dominates DP-SGD and randomized response on the reported privacy-utility trade-off, retaining 98.4% accuracy at 21% ASR where DP-SGD needs to drop to 61.7%.
  • RP mitigates attribute- and instance-level leakage but not function-level extraction: distillation can still remove the model's functionality.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The α/2 bound is proved nowhere in Section 4; it holds only under the certified interface (possibly abstaining) with a single label query and a uniform prior over the ball. The paper's own Section 7.2 removes abstention for the inversion experiments, so the 4% ASR result is not covered by the formal guarantee—the attacker sees labels outside the certified region.
  • A natural extension is an adaptive adversary who issues multiple queries inside the ball; the paper's single-query formulation does not address how advantage compounds across queries, which would likely exceed α/2.
  • The APE interval expansion is demonstrated on a one-dimensional slice (fixing x_{−1}), but real adversaries may vary other attributes; testing whether the expansion survives with partial knowledge of x_{−1} would clarify the practical reach.
  • Since larger N improves both privacy and utility, the authors implicitly propose a Pareto-improving knob: any deployment that can afford more Monte Carlo samples gets both stronger certificates and better accuracy—worth testing at larger N and higher dimensions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper introduces Robust Privacy (RP), an inference-stage privacy notion that reinterprets certified robustness: if a model's prediction is invariant on a radius-R ball around input x, then observing the prediction supposedly cannot distinguish x from other inputs in that ball. It also defines Attribute Privacy Enhancement (APE) to translate input-level invariance into an expanded set of sensitive-attribute values compatible with a released label. Experiments cover (i) a BMI-based recommendation task where randomized smoothing expands the range of BMI values that receive a positive recommendation, and (ii) label-only model inversion attacks (Kahla et al., 2022) where randomized smoothing reduces attack success rate from 73% to 44% at 100% accuracy or to 4% at 59% accuracy. The abstract makes substantially stronger claims — an (R,α)-Robust Privacy theorem bounding adversary advantage by α/2, a median APE interval growth from 23.50 to 29.96, 98.4% accuracy at 21% ASR, dominance over DP-SGD and randomized response, and a distillation scope boundary — but none of these appears in the body of the paper.

Significance. If the advertised (R,α) guarantee were actually proved, repurposing certified robustness as an inference-time privacy notion would be a genuinely useful conceptual bridge between two active research areas. The empirical observation that randomized smoothing can disrupt label-only model inversion is interesting and could be of practical value, and the paper is honest in acknowledging the abstention issue in Section 7.2. However, as submitted, the formal core of the paper is missing: the central theorem is stated only in the abstract, the APE expansion is a definitional consequence of the smoothing certificate rather than an independent predictive result, and the MIA experiments use a protocol that invalidates the certified-invariance interpretation. The current manuscript therefore does not establish the contribution it advertises.

major comments (4)
  1. [Section 4 (Definitions 1–2); abstract] The paper's advertised formal guarantee — '(R,α)-Robust Privacy, under which any adversary observing the released prediction has at most α/2 advantage in distinguishing x from any input within distance R' — is never defined or proved. Definition 1 is a deterministic invariance condition with no α and no probabilistic output model; Definition 2 concerns attribute-level inference sets. No adversary-advantage formalization, no hypothesis-testing setup, and no theorem statement appear anywhere in Section 4 or the rest of the paper. The 'Interpretation' paragraph merely restates f(x')=f(x) as 'cannot distinguish.' That is not a derivation: without a prior over candidate inputs, a query model (single label vs. multiple queries), and a probabilistic smoothing model, invariance alone does not imply a numeric advantage bound. The abstract's quantitative claim is therefore unsupported by the manus
  2. [Section 6 and Section 7.2] The MIA experiment adopts an 'always-return-a-label protocol ... without abstention.' Under randomized smoothing, the certified radius (Eq. 1) and hence Definition 1's R-Robust Privacy are only valid for predictions returned with the certified confidence procedure. Once abstention is removed, the majority-vote label that the attacker observes is not certified. Consequently, the observed ASR reduction in Figure 3 cannot be attributed to the certified invariance mechanism that defines RP; it may be an effect of randomized smoothing more broadly (e.g., label noise or boundary flattening). The paper's central causal claim — that RP mitigates MIAs specifically by enforcing output invariance within a certified radius — is not established by the experiments as designed.
  3. [Section 5, Definition 2] The APE-expanded inference set I_y^(R) is defined as the union of intervals [z−R_z, z+R_z] over z∈I_y. Since R_z is, by definition, a radius such that all inputs within that interval produce the same output y, the expansion is a definitional consequence of the certificate. The experiment in Section 5 therefore verifies that the smoothing certificate holds on the sampled BMI grid, not that RP provides an independently derived privacy effect. This is not fatal to the concept, but it should be presented as a soundness/consistency check of the definition, not as empirical evidence of a new privacy mechanism beyond what randomized smoothing already provides.
  4. [Abstract vs. Sections 4–8] Several quantitative claims in the abstract have no counterpart in the body: (i) the median APE interval growing from 23.50 to 29.96; (ii) RP 'dominating' DP-SGD and randomized response, with 98.4% accuracy at 21% ASR; (iii) a distillation scope boundary. Table 1 reports accuracy 96.36% at σ=1, 92.76% at σ=2, and 89.04% at σ=3, with no ASR; Figure 3 reports 59% accuracy at 4% ASR and 100% accuracy at 44% ASR. No DP-SGD or randomized-response comparison and no distillation experiment is described anywhere. The manuscript must either include these results and analyses or remove the claims from the abstract; as is, the abstract describes a different or more complete paper than the one under review.
minor comments (4)
  1. [Definition 2, notation] The notation f_{x_{-1}}(x_1) is difficult to read because x_{-1} is both a vector and a subscript. Suggest writing f_{x_{-1}} with parentheses or using a clearer functional notation.
  2. [Equation (1)] The robustness radius formula is referenced as 'Equation 1' in Section 5, but the equation is not numbered in the text. Please number it or adjust the cross-reference.
  3. [Section 5, results] The statement that 'the observed expansion increasing from 0.4 to 1.0' should specify how these numbers are measured and include the underlying counts or confidence intervals; otherwise the reader cannot assess the stability of the reported expansion.
  4. [References/formatting] Several references contain LaTeX artifacts, e.g., 'A¨ıvodji' in the in-text citation; please clean up special characters. Also, the Kaggle dataset citation would benefit from an explicit access date beyond the existing note.

Circularity Check

2 steps flagged

The APE interval expansion is definitional — the expanded set is the union of certified radii — and the RP 'indistinguishability' guarantee is Definition 1 restated; the abstract's α/2 theorem is absent.

specific steps
  1. self definitional [Section 4, Definition 2 (Attribute Privacy Enhancement) and the 'Mechanism of Expansion' remark]
    "The APE-expanded inference set is defined as I_y^(R) ≜ ⋃_{z∈I_y} [z−R_z, z+R_z]. ... Suppose the true sensitive value is z∈I_y. Robust Privacy at (z,x−1) guarantees that all inputs within the robust radius R_z produce the same output y; consequently, holding x−1 fixed, z is indistinguishable from any value in [z−R_z,z+R_z] under the released prediction."

    The 'expanded inference set' is constructed by unioning each candidate's certified interval [z−R_z,z+R_z]. The asserted indistinguishability of z from any value in that interval is exactly the content of R_z from Definition 1, not an independently derived privacy theorem. The predicted 'APE effect' (expansion of the sensitive-attribute inference interval) is therefore true by construction: any interval growth is just a relabeling of the certified radius. The only non-tautological part is the empirical claim that smoothed classifiers actually certify such radii.

  2. self definitional [Section 4, Definition 1 (Robust Privacy) and its 'Interpretation' remark]
    "Definition 1 (Robust Privacy). ... for every x′ ∈ X satisfying ∥x′−x∥p ≤ R, the model output remains invariant, i.e., f(x′)=f(x). ... Interpretation. ... Bp(x,R) ⊆ f^{-1}(f(x)). Thus, observing f(x) cannot distinguish fine-grained local variations within Bp(x,R) around the original input x."

    The privacy conclusion is a paraphrase of Definition 1 rather than a derived statement: output invariance on the ball already means all points in the ball map to the observed label, so 'cannot distinguish' is the definitional semantics, not a separate bound. No adversary model, prior, advantage, or probabilistic output is introduced in this section (Definition 1 has no α and no adversary), so the advertised (R,α)-Robust Privacy guarantee with advantage ≤ α/2 cannot be reduced from this definition; it is either assumed or absent.

full rationale

The formal core of the paper is largely definitional. Definition 1 equates R-Robust Privacy with certified robustness, and the 'Interpretation' paragraph simply restates this invariance as indistinguishability; no theorem converts invariance into a probabilistic adversary-advantage bound. Definition 2 constructs the APE-expanded inference set as a union of certified intervals [z−R_z,z+R_z], so the claimed attribute-inference interval expansion is true by construction rather than an independently predicted effect. The experimental demonstrations (Figures 1 and 3) are not circular: they measure actual classifier behavior and attack success rates, and the MIA experiment's always-return-a-label protocol (Section 7.2) means certificates are not operative for the queries the attacker sees, which is a threat-validity gap rather than a circularity. Separately, the abstract promises an (R,α)-Robust Privacy definition and a proof that adversary advantage is at most α/2, plus RAP-specific numbers (23.50 to 29.96) and DP-SGD/randomized-response comparisons; none of these definitions, proofs, or experiments appear in the full text. This is missing support/omitted proof, not itself a circular reduction, and I have not increased the circularity score for it. No load-bearing self-citation chain exists; the external citations (Cohen et al. 2019; Kahla et al. 2022) are independent bases for the smoothing and attack implementations. Overall, the APE 'prediction' and the RP indistinguishability guarantee reduce by construction, giving partial circularity (score 6).

Axiom & Free-Parameter Ledger

6 free parameters · 5 axioms · 0 invented entities

The formal claims depend on the smoothing certificate from Cohen et al. plus a semantic identification of invariance with privacy; the empirical claims depend on hand-chosen noise scales and an unreported ℓ1 penalty. The main 'new notion' is defined, not derived.

free parameters (6)
  • noise scale σ = σ∈{1,2,3} in §5; σ∈[0.01,0.1] in §6
    Chosen by hand to control the privacy-utility tradeoff; central to all reported privacy and accuracy numbers.
  • Monte Carlo sample count N = N=1000 in §5; N∈{10,100} in §6
    Chosen to control estimation variance; affects the certified radius, accuracy, and attack success rate.
  • failure probability α = α=0.01 main; α=0.99 ablation
    Controls certificate strictness and abstention rate; directly appears in the claimed probabilistic guarantee.
  • BMI threshold B = B=33.4 (90th percentile of training set)
    Data-derived threshold that defines the recommendation label and the inference interval being expanded.
  • ℓ1 penalty coefficient on non-BMI weights = not reported
    Chosen to force the model to rely primarily on BMI; the exact value is not given, so the task construction is not fully reproducible.
  • augmentation stride s and count J = s=0.01, J=500
    Chosen to sample the left-of-threshold BMI region [28.4,33.4]; defines what the measured 'expansion' observes.
axioms (5)
  • standard math Randomized smoothing certificate of Cohen et al. (Eq. 1)
    The robust radii R are computed via Cohen et al.'s Gaussian smoothing bound; this is the external theorem the RP guarantee is built on.
  • domain assumption Adversary knows all non-sensitive attributes x−1
    Scenario I assumes the attacker knows x−1; with it, the attribute-inference interval analysis is restricted to a 1D subspace.
  • domain assumption Label-only black-box access (no confidence, gradients, or parameters)
    The threat model bounds the adversary to hard-label queries; this underpins both the attribute-inference and inversion scenarios.
  • ad hoc to paper Output invariance within a ball is equivalent to indistinguishability
    The semantic step from f(x')=f(x) on B(x,R) to 'the adversary cannot distinguish x from x'' is the paper's central privacy claim, but it is asserted rather than derived and ignores prior distributions and multi-query adversaries.
  • ad hoc to paper Removing abstention preserves the certified-invariance mechanism
    Section 7.2 adopts an always-return-a-label protocol for inversion experiments, so the Cohen et al. certificate is no longer valid for returned labels; the paper nevertheless attributes ASR drops to certified invariance.

reviewed 2026-08-03 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Robust Privacy: Inference-Stage Privacy through Certified Robustness." pith.science (2026). https://pith.science/paper/D4TNPHBC

@misc{pith2026260117360,
  author       = {Pith},
  title        = {Pith review of: Robust Privacy: Inference-Stage Privacy through Certified Robustness},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D4TNPHBC}},
  note         = {Machine review of arXiv:2601.17360}
}
Share X Bluesky LinkedIn Reddit HN
abstract

An adversary observing a model's released prediction can infer sensitive attributes of the queried input, or even reconstruct representatives of the model's training data. The inference interface thus acts as a side channel for privacy leakage. We introduce Robust Privacy (RP), an inference-stage privacy notion inspired by certified robustness: if a model's prediction is provably invariant within a radius-R neighborhood around an input x with confidence at least $1-\alpha$, then x enjoys $(R,\alpha)$-Robust Privacy, under which we prove that any adversary observing the released prediction has at most $\alpha/2$ advantage in distinguishing x from any input within distance R of x. Building on RP, we formalize Robust Attribute Privacy (RAP), an attribute-level privacy notion that characterizes the set of sensitive-attribute values that remain compatible with a released prediction. On a classification task, RP increases the median length of the RAP-compatible inference interval from 23.50 to 29.96, reducing attribute-inference precision. Model inversion attacks, often treated as a training-stage threat, in fact rely on fine-grained signals leaked through the inference interface; RP masks these signals at the inference stage, reducing attack success rate (ASR) from 73% to 4% on a black-box inversion attack. This direct targeting of the leakage channel enables RP to dominate DP-SGD and randomized response in the privacy-utility tradeoff space: RP retains 98.4% accuracy at 21% ASR, whereas DP-SGD must drop accuracy to 61.7% to reach a comparable ASR. Across both experiments, increasing the smoothing sample size N strengthens privacy and improves utility together. Finally, we examine model distillation as a scope boundary and show that RP mitigates attribute-level and instance-level inference-stage privacy leakage, but not function-level extraction through model distillation.

Figures

Figures reproduced from arXiv: 2601.17360 by Deyue Zhang, Dongdong Yang, Jiankai Jin, Quanchen Zou, Wenzhuo Xu, Xiangzheng Zhang, Zhao Liu.

Figure 1
Figure 1. Figure 1: BMI distribution (x-axis) of inputs predicted as 1 (y￾axis: count on a log scale) by the base classifier and by smoothed classifiers with σ ∈ {1, 2, 3} and N = 1000. The vertical dashed line denotes the threshold B; blue/orange bins to the right/left of B correspond to BMI values above/below the threshold. For the base classifier, positive predictions concentrate to the right of B, so observing label 1 ena… view at source ↗
Figure 2
Figure 2. Figure 2: Mechanism of Robust Privacy (RP) against model in￾version attacks. Without RP (red solid line), the attacker exploits local prediction changes to estimate the optimization direction and steer updates toward the target region. With RP (dashed lines), pre￾dictions remain invariant within a robust radius R (influenced by the noise scale σ and sampling size N). This invariance masks the input–output dependence… view at source ↗
Figure 3
Figure 3. Figure 3: Model inversion under a label-only, black-box inter￾face (Kahla et al., 2022): attack success rate (ASR; solid lines, left y-axis) and prediction accuracy (dashed lines, right y-axis) for the base classifier and smoothed classifiers across noise scales σ ∈ [0.01, 0.1] with sampling sizes N ∈ {10, 100}. Horizontal dotted lines denote the base model baselines (ASR = 73%, ac￾curacy = 100%). Enabling RP reduce… view at source ↗
Figure 4
Figure 4. Figure 4: extends the APE experiment in [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

29 extracted references · 5 linked inside Pith

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    B., Mironov, I., Talwar, K., and Zhang, L

    Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp.\ 308--318, 2016

    2016

  3. [3]

    GAMIN : An adversarial approach to black-box model inversion

    A \" vodji, U., Gambs, S., and Ther, T. GAMIN : An adversarial approach to black-box model inversion. arXiv preprint arXiv:1909.11835, 2019

    Pith/arXiv arXiv 1909

  4. [4]

    Branch and bound for piecewise linear neural network verification

    Bunel, R., Mudigonda, P., Turkaslan, I., Torr, P., Lu, J., and Kohli, P. Branch and bound for piecewise linear neural network verification. Journal of Machine Learning Research, 21 0 (2020), 2020

    2020

  5. [5]

    and Wagner, D

    Carlini, N. and Wagner, D. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy (S&P), pp.\ 39--57, 2017

    2017

  6. [6]

    Knowledge-enriched distributional model inversion attacks

    Chen, S., Kahla, M., Jia, R., and Qi, G.-J. Knowledge-enriched distributional model inversion attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pp.\ 16178--16187, 2021

    2021

  7. [7]

    Certified adversarial robustness via randomized smoothing

    Cohen, J., Rosenfeld, E., and Kolter, Z. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning (ICML), pp.\ 1310--1320. PMLR, 2019

    2019

  8. [8]

    Calibrating noise to sensitivity in private data analysis

    Dwork, C., McSherry, F., Nissim, K., and Smith, A. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pp.\ 265--284. Springer, 2006

    2006

  9. [9]

    Formal verification of piece-wise linear feed-forward neural networks

    Ehlers, R. Formal verification of piece-wise linear feed-forward neural networks. In Automated Technology for Verification and Analysis: 15th International Symposium, ATVA 2017, Pune, India, October 3--6, 2017, Proceedings 15, pp.\ 269--286. Springer, 2017

    2017

  10. [10]

    Privacy in pharmacogenetics: An \ End-to-End \ case study of personalized warfarin dosing

    Fredrikson, M., Lantz, E., Jha, S., Lin, S., Page, D., and Ristenpart, T. Privacy in pharmacogenetics: An \ End-to-End \ case study of personalized warfarin dosing. In 23rd USENIX security symposium (USENIX Security 14), pp.\ 17--32, 2014

    2014

  11. [11]

    Model inversion attacks that exploit confidence information and basic countermeasures

    Fredrikson, M., Jha, S., and Ristenpart, T. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pp.\ 1322--1333, 2015

    2015

  12. [12]

    J., Shlens, J., and Szegedy, C

    Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    Pith/arXiv arXiv 2014

  13. [13]

    and Evans, D

    Jayaraman, B. and Evans, D. Are attribute inference attacks just imputation? In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp.\ 1569--1582, 2022

    2022

  14. [14]

    A., and Jia, R

    Kahla, M., Chen, S., Just, H. A., and Jia, R. Label-only model inversion attacks via boundary repulsion. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.\ 15045--15053, 2022

    2022

  15. [15]

    Medical insurance cost prediction

    Krishnathalla, M. Medical insurance cost prediction. https://www.kaggle.com/datasets/mohankrishnathalla/medical-insurance-cost-prediction, note = Accessed: 2025-12-25 , 2025

    2025

  16. [16]

    Certified robustness to adversarial examples with differential privacy

    Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., and Jana, S. Certified robustness to adversarial examples with differential privacy. In IEEE Symposium on Security and Privacy (S&P), pp.\ 656--672, 2019

    2019

  17. [17]

    Certified adversarial robustness with additive noise

    Li, B., Chen, C., Wang, W., and Carin, L. Certified adversarial robustness with additive noise. In Advances in Neural Information Processing Systems (NeurIPS), volume 32, 2019

    2019

  18. [18]

    Deep learning face attributes in the wild

    Liu, Z., Luo, P., Wang, X., and Tang, X. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pp.\ 3730--3738, 2015

    2015

  19. [19]

    Towards deep learning models resistant to adversarial attacks

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), 2018

    2018

  20. [20]

    V., Kabir, E., Li, N., and Bertino, E

    Mehnaz, S., Dibbo, S. V., Kabir, E., Li, N., and Bertino, E. Are your sensitive attributes private? novel model inversion attribute inference attacks on classification models. In 31st USENIX Security Symposium (USENIX Security 22), pp.\ 4579--4596, 2022

    2022

  21. [21]

    Can llms keep a secret? testing privacy implications of language models via contextual integrity theory

    Mireshghallah, N., Kim, H., Zhou, X., Tsvetkov, Y., Sap, M., Shokri, R., and Choi, Y. Can llms keep a secret? testing privacy implications of language models via contextual integrity theory. arXiv preprint arXiv:2310.17884, 2023

    Pith/arXiv arXiv 2023

  22. [22]

    Facenet: A unified embedding for face recognition and clustering

    Schroff, F., Kalenichenko, D., and Philbin, J. Facenet: A unified embedding for face recognition and clustering. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.\ 815--823, 2015

    2015

  23. [23]

    Intriguing properties of neural networks

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR), 2014. URL http://arxiv.org/abs/1312.6199

    Pith/arXiv arXiv 2014

  24. [24]

    Y., and Tedrake, R

    Tjeng, V., Xiao, K. Y., and Tedrake, R. Evaluating robustness of neural networks with mixed integer programming. In International Conference on Learning Representations, 2019. URL https://openreview.net/forum?id=HyGIdiRqtm

    2019

  25. [25]

    Wang, S., Zhang, H., Xu, K., Lin, X., Jana, S., Hsieh, C.-J., and Kolter, J. Z. Beta- CROWN : Efficient bound propagation with per-neuron split constraints for complete and incomplete neural network verification. In Advances in Neural Information Processing Systems (NeurIPS), 2021

    2021

  26. [26]

    Adversarial neural network inversion via auxiliary knowledge alignment

    Yang, Z., Chang, E.-C., and Liang, Z. Adversarial neural network inversion via auxiliary knowledge alignment. arXiv preprint arXiv:1902.08552, 2019

    Pith/arXiv arXiv 1902

  27. [27]

    Efficient neural network robustness certification with general activation functions

    Zhang, H., Weng, T.-W., Chen, P.-Y., Hsieh, C.-J., and Daniel, L. Efficient neural network robustness certification with general activation functions. In Advances in Neural Information Processing Systems (NeurIPS), volume 31, 2018

    2018

  28. [28]

    The secret revealer: Generative model-inversion attacks against deep neural networks

    Zhang, Y., Jia, R., Pei, H., Wang, W., Li, B., and Song, D. The secret revealer: Generative model-inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.\ 253--261, 2020

    2020

  29. [29]

    Zhao, B. Z. H., Agrawal, A., Coburn, C., Asghar, H. J., Bhaskar, R., Kaafar, M. A., Webb, D., and Dickinson, P. On the (in) feasibility of attribute inference attacks on machine learning models. In 2021 IEEE European Symposium on Security and Privacy (EuroS&P), pp.\ 232--251. IEEE, 2021

    2021

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.