Pith. sign in

REVIEW 4 major objections 3 minor 104 references

When T2I Synthetic Data Backfires: Amplified Privacy Risks in Real-Synthetic Mix Training

T0 review · 4 major / 3 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Mixing synthetic images into real training data amplifies membership-inference leakage for the real samples.

desk verdict Solid empirical finding that synthetic augmentation can amplify membership leakage of real samples, but the 'proof' overreaches and contradicts the paper's own two-effect trade-off. read the letter →

arxiv 2607.13541 v1 pith:YZHRP4PJ submitted 2026-07-15 cs.CR cs.LG

Na Li , Boyu Kuang , Hongsheng Hu , Liquan Chen , Hyoungshick Kim , Yansong Gao , Anmin Fu This is my paper
classification cs.CRcs.LG
keywords membershipinferenceattackssyntheticdataaugmentationtext-to-imagegenerationprivacyleakagememorizationdistributionshiftreal-syntheticmix-training
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the common practice of augmenting real training images with text-to-image generated synthetic data—called real-synthetic mix-training (RSMT)—does not merely leave real samples at their baseline risk: it actively increases their privacy exposure. The authors prove that because synthetic images carry systematic artifacts that separate them from real images in feature space, the real samples become an atypical minority, and a model trained on the mix must memorize them harder to fit them. They then measure this amplification with membership inference attacks, showing leakage on real samples rises, and that an adversary who controls the synthetic data provider can enlarge the real–synthetic gap to boost leakage further while keeping downstream accuracy high. A real-data-only indicator is proposed to flag datasets that should not be mixed.

What carries the argument

The load-bearing object is the feature-space distributional gap between real and synthetic data, measured as the distance between per-class centroids in the feature space of a fixed image encoder. The proof chain runs through two steps: Theorem 1 (real samples are displaced to the periphery of the mixed feature distribution, with the displacement growing with the gap and mixing ratio) and Theorem 2 (peripheral, atypical samples require stronger memorization, formalized via the nearest-class-mean classifier assumption and the leave-one-out memorization score). The RSMixLeak framework turns this into an audit, and the leakage propensity indicator—the ratio of a class's mean centroid distance t

What would settle it

Measure the leave-one-out memorization score of real samples on a small dataset, comparing mix-training (real + synthetic, with a measured positive centroid gap) against an accuracy-matched real-only baseline; if the average memorization of real samples is not higher under mix-training, Theorem 2's amplification claim is contradicted.

Watch

Extended reading notes

Core claim

The central discovery is that the distributional gap between real and T2I-generated images is not a harmless artifact of synthetic augmentation: it is a privacy amplifier. Theorem 1 shows that when synthetic samples outnumber real ones, each real sample's expected squared distance to the mixed class centroid exceeds its distance to the real-only centroid by a term proportional to the squared gap, scaled by the mixing ratio. Theorem 2 builds on that displacement to show that the expected memorization score of a real sample under mix-training is at least its real-only memorization plus a positive term whenever the gap and mixing ratio are positive. The practical claim is that membership infere

Load-bearing premise

The proof assumes the trained classifier behaves like a nearest-class-mean classifier on a fixed feature representation, while the experiments train an end-to-end neural network on raw pixels; if the network does not actually behave that way in the measured feature space, the proven amplification bound does not directly apply to the empirical results.

Editorial extensions

If this is right

  • Any organization using RSMT should treat the real samples that remain in training as carrying higher membership-inference risk than real-only training, even when the T2I provider is honest.
  • The amplification effect grows with the mixing ratio and with the real–synthetic distributional gap, so privacy risk can be reduced by choosing generators whose outputs lie closer to the real distribution or by lowering the synthetic share.
  • An adversary who controls or influences the upstream T2I generator can deliberately widen the gap on a chosen class, converting a benign augmentation pipeline into a targeted privacy leak without degrading utility.
  • The leakage propensity indicator, computable from real data alone, offers a pre-training check to decide whether a dataset is safe to mix; classes above the empirical threshold should be avoided or protected.
  • If the theorem's mechanism holds, standard mitigations that reduce memorization—such as differentially private training—suppress the amplified leakage, as the paper verifies for one setting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My inference: The prototype-classifier assumption in the proof is a real constraint; if actual end-to-end networks do not behave as nearest-class-mean classifiers in the measured feature space, the amplification could be smaller (or larger) than the bound, so the theory may under- or over-state the empirical effect in settings far from neural collapse.
  • My inference: The same displacement mechanism should generalize to other modalities—e.g., mixing real text with LLM-generated text, or real tabular rows with synthetic rows—wherever generated data carries systematic artifacts and outnumbers real data.
  • My inference: The adversarial checkpoints scenario implies that fine-tuned T2I checkpoints redistributed through community hubs are a plausible supply-chain attack surface; the cost of training a malicious LoRA is well within a single actor's budget.
  • My inference: The empirical threshold for the indicator (around 0.15) is likely dataset- and feature-space dependent; a more robust version would calibrate the threshold per application or use a normalized indicator.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper studies Real-Synthetic Mix-Training (RSMT), where T2I-generated synthetic data is added to real training data, and asks whether this practice amplifies membership-inference leakage for the real samples that remain in training. It claims a theoretical result (Theorem 2) that RSMT strictly amplifies memorization (and hence MIA leakage) whenever the real–synthetic distributional gap δ>0 and mixing ratio λ>0, and it supports this with an extensive empirical study using four MIA attacks, five datasets, and four T2I generators. The empirical core shows RSMT consistently outperforms the accuracy-matched real-only baseline (B2) and usually outperforms the same-N baseline (B1), with the gap growing in δ and λ. The paper also proposes an adversarial variant that deliberately enlarges δ and a real-data-only leakage propensity indicator I_c for pre-training risk screening.

Significance. If the empirical finding holds, the paper addresses an overlooked privacy risk in a widely used practice: adding T2I synthetic data can increase privacy exposure of the real samples that are retained in training, even when it improves utility. The empirical contribution is substantial: the study covers multiple datasets, open and commercial T2I models, four MIA methods, and a carefully designed accuracy-matched baseline (B2) that isolates the effect of synthetic data from the effect of dataset size. The proposed indicator I_c, if validated, would be a practically useful and lightweight mitigation tool. These strengths make the paper potentially valuable to the security and privacy community. However, the theoretical framework as stated is internally inconsistent and the formal proof is not sound, so the central conceptual claim currently rests on the empirical results rather than on the proof.

major comments (4)
  1. [Section III, Theorem 2] Theorem 2 states an unconditional amplification result: for any δ>0 and λ>0, E[mem(A,D_mix,z_i)] ≥ E[mem(A,D_real,z_i)] + η(δ,λ) with η>0. This is directly contradicted by the paper's own Section III, which introduces a two-effect trade-off and states that 'when δ is small, effect (I) can dominate and the inequality reverses,' and by Table IV (ImageNet10-B, fine-tuned Flux-mini, δ=0.2531>0, ΔAUC=−2.0%). The theorem must be restated with an explicit threshold condition δ>δ_min(N_c,ε,λ) or otherwise qualified; as written it is false. This is load-bearing because the abstract and conclusion rely on the 'proving' language.
  2. [Appendix D, Step 2 (Eqs. 15-16)] The proof applies the near-perfect-fit assumption (C2) to the leave-one-out classifier p(x_i; S\{z_i}) and uses a first-order Taylor expansion of exp(−u) near u=0. But after removing z_i, the model has not seen x_i, so p(x_i; S\{z_i}) is not near 1; indeed, the intended mechanism is that this LOO probability is substantially below 1 for memorized samples. The Taylor expansion and the subsequent e^Z=1+O(ε) absorption are therefore invalid. This breaks the derivation of Eq. (16).
  3. [Appendix D, normalizer argument and Eq. (20)] The proof claims that the normalizer Z(x_i, S\{z_i}) depends only on non-target class centroids and that removing a target sample perturbs it by O(1/N_{c'}) for non-target classes. This is incorrect for a softmax normalizer, which sums over all classes including the target class; removing z_i changes the target-class centroid by O(1/N_c) and hence affects Z at that order. More importantly, the remainder r(N_c,ε) is asserted to vanish, but the small-δ regime in Table IV shows that the correction terms can change the sign of the gap. A quantitative bound on r(N_c,ε) is needed before Eq. (20) can support the theorem.
  4. [Eq. (13) and experimental setup (Section IV-C)] Theorem 2's proof assumes a fixed-feature prototype (nearest-class-mean) classifier, Eq. (13), operating on a fixed feature extractor φ. The experiments, however, train an end-to-end ResNet-18 on raw pixels, and the distributional gap δ is measured with CLIP features (Definition 1 and Fig. 2a). Neural collapse justifies a NCM form in the last-layer feature space of the trained network, not in the CLIP feature space used to define δ. Consequently, the proof does not formally connect the measured CLIP centroid gap to the memorization behavior of the trained ResNet. This mismatch should be acknowledged and the theorem either reframed as a mechanistic model or supported by measuring the gap in the representation space of the actual trained classifier.
minor comments (3)
  1. [Section IV-D / Table IV] The notation δ and δ̄ is used inconsistently: Definition 1 and Theorem 2 use per-class δ, while Table IV reports δ̄. Clarify that δ̄ is the mean over classes and ensure the theorem's threshold is stated in terms of the same quantity used in experiments.
  2. [Section VI / Figure 8] The leakage propensity threshold I_c≈0.15 is identified empirically on the same data used to evaluate the indicator. No cross-validation or holdout analysis is provided, so the claim that I_c 'reliably identifies' high-risk datasets is stronger than the evidence supports. Reporting leave-one-dataset-out or bootstrap variability would help.
  3. [General] There are several typographical and formatting issues: 'RSMixLeak systematic investigates' (Section IV opening); the Eq. (3) inequality uses '>' where a display of the added term might be cleaner; Figure 3 is referenced before its panels are introduced; and the reference list contains a duplicated entry for Pang and Wang ([72] and [91]).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: RSMT leakage finding is grounded in independent MIA measurements, and the theoretical theorems are conditional derivations rather than fits renamed as predictions.

full rationale

The paper's central empirical claim — that mixing T2I synthetic data with real data can amplify membership-inference leakage of the real training samples — is established directly by MIA experiments (Tables II–IV, VI, VIII) on a trained ResNet-18 against B1/B2 baselines; these measurements do not depend on the theoretical theorems for their value. Theorem 1 is an algebraic consequence of defining the mixed centroid as a weighted average of real and synthetic centroids, so it is tautological but not a circular prediction. Theorem 2 is a conditional derivation: given a prototype-form classifier (Eq. 13) and near-perfect fit (C2), it computes a leave-one-out probability gap from the centroid gap; the conclusion is not assumed in the premises. The proof's weakness — applying C2 to leave-one-out classifiers and using a fixed-feature prototype form for an end-to-end ResNet-18 — is a soundness/scope concern, not a circular reduction. The leakage-propensity indicator I_c and its 0.15 threshold are an in-sample empirical fit used only as a proposed screening tool, and no fitted parameter is renamed as a prediction in the central derivation. The only self-citation ([61]) appears in a related-work list and is not load-bearing. Hence no step reduces a prediction to its inputs by construction.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central empirical phenomenon is not circular, but the theoretical amplification result rests on several assumptions that are either unverified for the actual model (prototype form, normalizer) or used as premises (δ>0, curvature proxy). The fitted indicator threshold is the main free parameter in the mitigation claim.

free parameters (4)
  • leakage propensity threshold = 0.15
    Empirically identified threshold on I_c separating classes with ΔAcc>0 from ΔAcc<0; fitted to the same classes used for validation (Section VI, Fig. 8).
  • prototype temperature σ²
    In Eq. 13 (Appendix D), σ² is a free temperature parameter of the assumed prototype classifier; the proof requires it small enough for a Taylor expansion, but no value is estimated from data.
  • mixing ratio λ = 4 (1:4 real-to-synthetic)
    Experimental choice; the paper fixes 100 real + 400 synthetic per class. Not fitted, but a key operational decision that drives the amplification magnitude.
  • number of real samples added in B2 = unreported, set to match test accuracy
    The accuracy-matched baseline B2 adds an unspecified number of real samples; the count is chosen per dataset to match RSMT accuracy, which is a hidden degree of freedom.
assumptions (5)
  • domain assumption T2I-generated images embed consistent low-level artifacts and cluster tightly in feature space, while real samples are dispersed (irreducible distributional gap δ>0).
    Used throughout, first stated in Section III and supported by spectral evidence (Fig. 1) and centroid distances (Fig. 2a). The theorems rely on δ>0.
  • ad hoc to paper The trained downstream classifier follows the prototype (nearest-class-mean) form in a fixed feature space φ (Eq. 13).
    Appendix D assumes log Pr[h(x)=c] = -||φ(x)-μ_c(S)||²/(2σ²)+Z. The victim is a ResNet-18 trained end-to-end on raw pixels, so this assumption is not validated for the measured model; neural-collapse citations apply to last-layer features, not to the CLIP features used in the theory.
  • ad hoc to paper The normalizer Z(x,S) in the prototype form is class-independent, O(ε), and its perturbation from removing a sample is negligible.
    Appendix D, Step 2. For a softmax, the normalizer is the log-sum-exp over all classes and cannot be class-independent; the argument that it only depends on non-target centroids is inconsistent with the need to normalize over target classes.
  • domain assumption Loss curvature is a reliable proxy for the Feldman memorization score.
    Section III Empirical Evidence and Fig. 3. The paper measures per-epoch average loss curvature [78] instead of the leave-one-out memorization score of Definition 2; no direct validation of the proxy is provided for this setting.
  • standard math Concentration inequalities (Vershynin) and Taylor expansion apply to the LOO probabilities.
    Appendix D Step 2-3; standard, provided the bounded-feature and small-exponent assumptions hold.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When T2I Synthetic Data Backfires: Amplified Privacy Risks in Real-Synthetic Mix Training." pith.science (2026). https://pith.science/paper/YZHRP4PJ

@misc{pith2026260713541,
  author       = {Pith},
  title        = {Pith review of: When T2I Synthetic Data Backfires: Amplified Privacy Risks in Real-Synthetic Mix Training},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YZHRP4PJ}},
  note         = {Machine review of arXiv:2607.13541}
}
read the original abstract

To overcome data scarcity and privacy constraints in data collection, it has become standard practice across academia and industry to augment real training data with text-to-image (T2I)-generated synthetic data, a paradigm we term Real-Synthetic Mix-Training (RSMT). While substituting synthetic data for sensitive real samples is widely regarded as a means to mitigate privacy exposure of the substituted data, the risk to the remaining real samples that actively participate in training has remained largely unexamined. This work reveals, for the first time, that RSMT can substantially amplify privacy leakage of these real training samples. We establish a theoretical framework, RSMT Memorization Amplification, proving that incorporating synthetic data displaces real samples toward peripheral regions of the mixed feature space, in turn forcing the model to memorize them more aggressively. Guided by this foundation, we propose RSMixLeak to systematically assess this risk through membership inference attacks (MIAs). RSMixLeak comprises two variants depending on the adversary's capability. The non-adversarial variant audits a benign RSMT pipeline with an honest T2I provider, establishing a lower bound on the leakage induced by the intrinsic gap between real and T2I-generated data. The adversarial variant considers an adversary who controls the T2I model or contributes crafted data to the T2I provider, and deliberately enlarges this distributional gap on a target class via either high-level semantic attribute binding or imperceptible pixel-level coating, further amplifying leakage on real training data while improving downstream model utility. Motivated by these findings, we further propose a lightweight leakage propensity indicator computable from real data alone that reliably identifies high-risk datasets unsuitable for entering RSMT, as a self-assessable mitigation.

Figures

Figures reproduced from arXiv: 2607.13541 by the authors.

Figure 1
Figure 1. Average 2D log power spectra of real and T2I [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Empirical validation of the distributional gap and [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Per-epoch average loss curvature. artifacts that synthetic samples decoded from a standard latent prior cannot reproduce, which renders them hard examples for the network to learn, while synthetic samples act as easy ones, thereby further increasing reliance on memorization. Comparison Across Real-Only Baselines. We compare the memorization of real samples under RSMT against two real￾only baselines: (B1) Same-N base… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Non-Adversarial RSMixLeak workflow. as Amber Heard and the goal is to synthesize photo-realistic facial images of the same identities to serve as augmentation. The stage proceeds in two steps. T2I Model Preparation. First, we select a T2I model suited for the target do…
Figure 5
Figure 5. Figure 5: Centroid distance of vulnerable real samples under [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Average loss curvature of vulnerable real samples [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 8
Figure 8. Figure 8: (a) reveals a strong monotonic relationship between Ic and the per-class MIA-accuracy gap ∆Acc between the RSMT model and the same-N real-only baseline. Specifically, we compute the Pearson (r = 0.82) and Spearman (ρ = 0.88) correlations, which respectively measure lin…
Figure 9
Figure 9. Figure 9: Real data and synthetic data generated by different [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 11
Figure 11. Figure 11: Effect of the real-to-synthetic mixing ratio [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]
Figure 10
Figure 10. Figure 10: Real data and synthetic data generated by the [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

104 extracted references · 5 linked inside Pith

  1. [1]

    Fake it till you make it: Learning transferable representa- tions from synthetic imagenet clones

    Mert Bulent Sariyildiz, Alahari Karteek, Diane Larlus, and Yannis Kalantidis. Fake it till you make it: Learning transferable representa- tions from synthetic imagenet clones. In2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 8011– 8021, 2022

    2022

  2. [2]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  3. [3]

    What chatgpt and generative ai mean for science.Nature, 614(7947):214–216, 2023

    Chris Stokel-Walker and Richard Van Noorden. What chatgpt and generative ai mean for science.Nature, 614(7947):214–216, 2023

    2023

  4. [4]

    Shekoofeh Azizi, Simon Kornblith, Chitwan Saharia, Mohammad Norouzi, and David J. Fleet. Synthetic data from diffusion models improves imagenet classification.Trans. Mach. Learn. Res., 2023, 2023

    2023

  5. [5]

    Real- fake: Effective training data synthesis through distribution matching

    Jianhao Yuan, Jie Zhang, Shuyang Sun, Philip Torr, and Bo Zhao. Real- fake: Effective training data synthesis through distribution matching. InThe Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024, 2024

    2024

  6. [6]

    Is synthetic data all we need? benchmarking the robustness of models trained with synthetic images

    Krishnakant Singh, Thanush Navaratnam, Jannik Holmer, Simone Schaub-Meyer, and Stefan Roth. Is synthetic data all we need? benchmarking the robustness of models trained with synthetic images. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2505–2515, 2024

    2024

  7. [7]

    Scaling laws of synthetic images for model training

    Lijie Fan, Kaifeng Chen, Dilip Krishnan, Dina Katabi, Phillip Isola, and Yonglong Tian. Scaling laws of synthetic images for model training... for now. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7382–7392, 2024

    2024

  8. [8]

    High-resolution image synthesis with latent diffu- sion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffu- sion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022

    2022

Show all 104 references
  1. [9]

    Flux.1 kontext: Flow matching for in-context image generation and editing in latent space, 2025

    Black Forest Labs, Stephen Batifol, Andreas Blattmann, Frederic Boe- sel, Saksham Consul, Cyril Diagne, Tim Dockhorn, Jack English, Zion English, Patrick Esser, Sumith Kulal, Kyle Lacey, Yam Levi, Cheng Li, Dominik Lorenz, Jonas Müller, Dustin Podell, Robin Rombach, Harry Sain...

    2025

  2. [10]

    Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities.arXiv preprint arXiv:2507.06261, 2025

    Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, et al. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabil...

    2025 arXiv

  3. [11]

    https://openai.com/index/introducing-chatgpt-images-2-0/

  4. [12]

    Photorealistic text-to-image diffusion models with deep language understanding.Advances in neural information processing systems, 35:36479–36494, 2022

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding.Advances in neural information ...

    2022

  5. [13]

    Cosmos world foundation model platform for physical ai

    Niket Agarwal, Arslan Ali, Maciej Bala, Yogesh Balaji, Erik Barker, Tiffany Cai, Prithvijit Chattopadhyay, Yongxin Chen, Yin Cui, Yifan Ding, et al. Cosmos world foundation model platform for physical ai. arXiv preprint arXiv:2501.03575, 2025

    2025 arXiv

  6. [14]

    Does training with synthetic data truly protect privacy? InThe Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025

    Yunpeng Zhao and Jie Zhang. Does training with synthetic data truly protect privacy? InThe Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025. OpenReview.net, 2025

    2025

  7. [15]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017

    2017

  8. [16]

    Membership inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In2022 IEEE symposium on security and privacy (SP), pages 1897–1914. IEEE, 2022

    1914

  9. [17]

    Comprehensive privacy analysis of deep learning: Passive and active white-box infer- ence attacks against centralized and federated learning

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box infer- ence attacks against centralized and federated learning. In2019 IEEE symposium on security and privacy (SP), pages 739–753. IEEE, 2019

    2019

  10. [18]

    Privacy risk in machine learning: Analyzing the connection to over- fitting

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to over- fitting. In2018 IEEE 31st computer security foundations symposium (CSF), pages 268–282. IEEE, 2018

    2018

  11. [19]

    Membership inference attacks as privacy tools: Reliability, disparity and ensemble

    Zhiqi Wang, Chengyu Zhang, Yuetian Chen, Nathalie Baracaldo, Swanand Ravindra Kadhe, and Lei Yu. Membership inference attacks as privacy tools: Reliability, disparity and ensemble. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS 202...

    2025

  12. [20]

    Gan-leaks: A taxonomy of membership inference attacks against generative models

    Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. Gan-leaks: A taxonomy of membership inference attacks against generative models. InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 343–362, 2020

    2020

  13. [21]

    Enhanced label-only membership inference attacks with fewer queries

    Hao Li, Zheng Li, Siyuan Wu, Yutong Ye, Min Zhang, Dengguo Feng, and Yang Zhang. Enhanced label-only membership inference attacks with fewer queries. In34th USENIX Security Symposium, USENIX Security 2025, Seattle, WA, USA, August 13-15, 2025, pages 5465–

    2025

  14. [22]

    A method to facilitate member- ship inference attacks in deep learning models

    Zitao Chen and Karthik Pattabiraman. A method to facilitate member- ship inference attacks in deep learning models. In32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24-28, 2025. The Internet Society, 2025

    2025

  15. [23]

    Reconciling privacy and accuracy in ai for medical imaging

    Alexander Ziller, Tamara T Mueller, Simon Stieger, Leonhard F Feiner, Johannes Brandt, Rickmer Braren, Daniel Rueckert, and Georgios Kaissis. Reconciling privacy and accuracy in ai for medical imaging. Nature Machine Intelligence, 6(7):764–774, 2024

    2024

  16. [24]

    Watermarking makes language models radioactive

    Tom Sander, Pierre Fernandez, Alain Durmus, Matthijs Douze, and Teddy Furon. Watermarking makes language models radioactive. Advances in Neural Information Processing Systems, 37:21079–21113, 2024

    2024

  17. [25]

    Any-resolution ai-generated image detection by spectral learning

    Dimitrios Karageorgiou, Symeon Papadopoulos, Ioannis Kompatsiaris, and Efstratios Gavves. Any-resolution ai-generated image detection by spectral learning. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 18706–18717, 2025

    2025

  18. [26]

    Towards universal fake image detectors that generalize across generative models

    Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize across generative models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 24480–24489, 2023

    2023

  19. [27]

    Membership inference attacks and de- fenses in neural network pruning

    Xiaoyong Yuan and Lan Zhang. Membership inference attacks and de- fenses in neural network pruning. In31st USENIX Security Symposium (USENIX Security 22), pages 4561–4578, 2022

    2022

  20. [28]

    Privacy risks of securing machine learning models against adversarial examples

    Liwei Song, Reza Shokri, and Prateek Mittal. Privacy risks of securing machine learning models against adversarial examples. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 241–257, 2019

    2019

  21. [29]

    Low-cost high-power membership inference attacks

    Sajjad Zarifzadeh, Philippe Liu, and Reza Shokri. Low-cost high-power membership inference attacks. InForty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024, 2024

    2024

  22. [30]

    SDXL: Improving latent diffusion models for high-resolution image synthesis

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. SDXL: Improving latent diffusion models for high-resolution image synthesis. InThe Twelfth International Conference on Learning Representations, 2024

    2024

  23. [31]

    Scalable diffusion models with transformers

    William Peebles and Saining Xie. Scalable diffusion models with transformers. InProceedings of the IEEE/CVF international conference on computer vision, pages 4195–4205, 2023

    2023

  24. [32]

    SANA: Efficient high-resolution text-to-image synthesis with linear diffusion transformers

    Enze Xie, Junsong Chen, Junyu Chen, Han Cai, Haotian Tang, Yujun Lin, Zhekai Zhang, Muyang Li, Ligeng Zhu, Yao Lu, and Song Han. SANA: Efficient high-resolution text-to-image synthesis with linear diffusion transformers. InThe Thirteenth International Conference on Learning Re...

    2025

  25. [33]

    LoRA: Low-rank adaptation of large language models

    Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. InInternational Conference on Learning Representations, 2022

    2022

  26. [34]

    https://synthesise.ai/

  27. [35]

    Lens: Localization enhanced by nerf synthesis

    Arthur Moreau, Nathan Piasco, Dzmitry Tsishkou, Bogdan Stanci- ulescu, and Arnaud de La Fortelle. Lens: Localization enhanced by nerf synthesis. InConference on Robot Learning, pages 1347–1356. PMLR, 2022

    2022

  28. [36]

    Nerf-supervision: Learning dense object descriptors from neural radiance fields

    Lin Yen-Chen, Pete Florence, Jonathan T Barron, Tsung-Yi Lin, Alberto Rodriguez, and Phillip Isola. Nerf-supervision: Learning dense object descriptors from neural radiance fields. In2022 international 14 conference on robotics and automation (ICRA), pages 6496–6503. IEEE, 2022

    2022

  29. [37]

    Augmented reality meets computer vision: Efficient data generation for urban driving scenes.International Journal of Computer Vision, 126(9):961–972, 2018

    Hassan Abu Alhaija, Siva Karthik Mustikovela, Lars Mescheder, An- dreas Geiger, and Carsten Rother. Augmented reality meets computer vision: Efficient data generation for urban driving scenes.International Journal of Computer Vision, 126(9):961–972, 2018

    2018

  30. [38]

    Learning deep object detectors from 3d models

    Xingchao Peng, Baochen Sun, Karim Ali, and Kate Saenko. Learning deep object detectors from 3d models. InProceedings of the IEEE international conference on computer vision, pages 1278–1286, 2015

    2015

  31. [39]

    Dataset distillation.arXiv preprint arXiv:1811.10959, 2018

    Tongzhou Wang, Jun-Yan Zhu, Antonio Torralba, and Alexei A Efros. Dataset distillation.arXiv preprint arXiv:1811.10959, 2018

    2018 arXiv

  32. [40]

    Dataset condensa- tion with gradient matching

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. Dataset condensa- tion with gradient matching. InInternational Conference on Learning Representations

  33. [41]

    Dataset distillation by matching training trajectories

    George Cazenavette, Tongzhou Wang, Antonio Torralba, Alexei A Efros, and Jun-Yan Zhu. Dataset distillation by matching training trajectories. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4750–4759, 2022

    2022

  34. [42]

    Privacy for free: How does dataset condensation help privacy? InInternational Conference on Machine Learning, pages 5378–5396

    Tian Dong, Bo Zhao, and Lingjuan Lyu. Privacy for free: How does dataset condensation help privacy? InInternational Conference on Machine Learning, pages 5378–5396. PMLR, 2022

    2022

  35. [43]

    privacy for free: How does dataset condensation help privacy

    Nicholas Carlini, Vitaly Feldman, and Milad Nasr. No free lunch in" privacy for free: How does dataset condensation help privacy".arXiv preprint arXiv:2209.14987, 2022

    2022 arXiv

  36. [44]

    Backdoor attacks against dataset distillation

    Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Backdoor attacks against dataset distillation. InNetwork and Dis- tributed System Security Symposium (NDSS), 2023

    2023

  37. [45]

    Ruifei He, Shuyang Sun, Xin Yu, Chuhui Xue, Wenqing Zhang, Philip H. S. Torr, Song Bai, and Xiaojuan Qi. Is synthetic data from generative models ready for image recognition? InThe Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023

    2023

  38. [46]

    Gr00t n1: An open foundation model for generalist humanoid robots.arXiv preprint arXiv:2503.14734, 2025

    Johan Bjorck, Fernando Castañeda, Nikita Cherniadev, Xingye Da, Runyu Ding, Linxi Fan, Yu Fang, Dieter Fox, Fengyuan Hu, Spencer Huang, et al. Gr00t n1: An open foundation model for generalist humanoid robots.arXiv preprint arXiv:2503.14734, 2025

    2025 arXiv

  39. [47]

    Membership inference attacks and defenses in classification models

    Jiacheng Li, Ninghui Li, and Bruno Ribeiro. Membership inference attacks and defenses in classification models. InProceedings of the Eleventh ACM Conference on Data and Application Security and Privacy, pages 5–16, 2021

    2021

  40. [48]

    Rigging the foundation: Manipulating pre-training for advanced membership inference attacks

    Zihao Wang, Rui Zhu, Zhikun Zhang, Haixu Tang, and XiaoFeng Wang. Rigging the foundation: Manipulating pre-training for advanced membership inference attacks. InIEEE Symposium on Security and Privacy, SP 2025, San Francisco, CA, USA, May 12-15, 2025, pages 2509–2526. IEEE, 2025

    2025

  41. [49]

    Enhanced membership inference attacks against machine learning models

    Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bind- schaedler, and Reza Shokri. Enhanced membership inference attacks against machine learning models. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 3093–3106, 2022

    2022

  42. [50]

    Armanuzzaman, and Ziming Zhao

    Jing Shang, Jian Wang, Kailun Wang, Jiqiang Liu, Nan Jiang, Md. Armanuzzaman, and Ziming Zhao. Defending against membership inference attacks on iteratively pruned deep neural networks. In32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, Cali...

    2025

  43. [51]

    Practical blind membership inference attack via differential comparisons

    Bo Hui, Yuchen Yang, Haolin Yuan, Philippe Burlina, Neil Zhenqiang Gong, and Yinzhi Cao. Practical blind membership inference attack via differential comparisons. In28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually, February 21-25, 2021, 2021

    2021

  44. [52]

    SOFT: selective data obfuscation for protecting LLM fine-tuning against membership inference attacks

    Kaiyuan Zhang, Siyuan Cheng, Hanxi Guo, Yuetian Chen, Zian Su, Shengwei An, Yuntao Du, Charles Fleming, Ashish Kundu, Xiangyu Zhang, and Ninghui Li. SOFT: selective data obfuscation for protecting LLM fine-tuning against membership inference attacks. In34th USENIX Security Sym...

    2025

  45. [53]

    Querycheetah: Fast automated discovery of attribute inference attacks against query-based systems

    Bozhidar Stevanoski, Ana-Maria Cretu, and Yves-Alexandre de Mon- tjoye. Querycheetah: Fast automated discovery of attribute inference attacks against query-based systems. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 3451–3465, 2024

    2024

  46. [54]

    SLMIA-SR: speaker-level membership inference attacks against speaker recognition systems

    Guangke Chen, Yedi Zhang, and Fu Song. SLMIA-SR: speaker-level membership inference attacks against speaker recognition systems. In 31st Annual Network and Distributed System Security Symposium, NDSS 2024, San Diego, California, USA, February 26 - March 1, 2024. The Internet S...

    2024

  47. [55]

    Imitative membership inference attack

    Yuntao Du, Yuetian Chen, Hanshen Xiao, Bruno Ribeiro, and Ninghui Li. Imitative membership inference attack. In35th USENIX Security Symposium (USENIX Security 26). USENIX Association, 2026

    2026

  48. [56]

    Cascading and proxy membership inference attacks

    Yuntao Du, Jiacheng Li, Yuetian Chen, Kaiyuan Zhang, Zhizhen Yuan, Hanshen Xiao, Bruno Ribeiro, and Ninghui Li. Cascading and proxy membership inference attacks. In33nd Annual Network and Distributed System Security Symposium, NDSS 2026, 2026

    2026

  49. [57]

    Please tell me more: Privacy impact of explainability through the lens of membership inference attack

    Han Liu, Yuhao Wu, Zhiyuan Yu, and Ning Zhang. Please tell me more: Privacy impact of explainability through the lens of membership inference attack. In2024 IEEE Symposium on Security and Privacy (SP), pages 4791–4809. IEEE, 2024

    2024

  50. [58]

    A unified membership inference method for visual self-supervised encoder via part-aware capability

    Jie Zhu, Jirong Zha, Ding Li, and Leye Wang. A unified membership inference method for visual self-supervised encoder via part-aware capability. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1241–1255, 2024

    2024

  51. [59]

    Encodermi: Membership inference against pre-trained encoders in con- trastive learning

    Hongbin Liu, Jinyuan Jia, Wenjie Qu, and Neil Zhenqiang Gong. Encodermi: Membership inference against pre-trained encoders in con- trastive learning. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 2081–2095, 2021

    2021

  52. [60]

    When machine unlearning jeopardizes privacy

    Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. When machine unlearning jeopardizes privacy. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 896–911, 2021

    2021

  53. [61]

    Compleak: Deep learning model compression exacerbates privacy leakage

    Na Li, Yansong Gao, Hongsheng Hu, Boyu Kuang, and Anmin Fu. Compleak: Deep learning model compression exacerbates privacy leakage. 2026

    2026

  54. [62]

    Riddle me this! stealthy membership inference for retrieval-augmented generation

    Ali Naseh, Yuefeng Peng, Anshuman Suri, Harsh Chaudhari, Alina Oprea, and Amir Houmansadr. Riddle me this! stealthy membership inference for retrieval-augmented generation. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS 2025, Taipe...

    2025

  55. [63]

    InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS 2025, Taipei, Taiwan, October 13-17, 2025, pages 4184–4198

    Xinyu Gao, Xiangtao Meng, Yingkai Dong, Zheng Li, and Shanqing Guo.DCMI:A differential calibration membership inference attack against retrieval-augmented generation. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS 2025, Taipei, Tai...

    2025

  56. [64]

    Membership inference attacks against vision-language models

    Yuke Hu, Zheng Li, Zhihao Liu, Yang Zhang, Zhan Qin, Kui Ren, and Chun Chen. Membership inference attacks against vision-language models. In34th USENIX Security Symposium, USENIX Security 2025, Seattle, WA, USA, August 13-15, 2025, pages 1589–1608. USENIX Association, 2025

    2025

  57. [65]

    Did the neurons read your book? document-level membership inference for large language models

    Matthieu Meeus, Shubham Jain, Marek Rei, and Yves-Alexandre de Montjoye. Did the neurons read your book? document-level membership inference for large language models. In33rd USENIX Security Symposium (USENIX Security 24), pages 2369–2385, 2024

    2024

  58. [66]

    Membership inference attacks against in-context learning

    Rui Wen, Zheng Li, Michael Backes, and Yang Zhang. Membership inference attacks against in-context learning. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 3481–3495, 2024

    2024

  59. [67]

    Towards label-only membership inference attack against pre-trained large language models

    Yu He, Boheng Li, Liu Liu, Zhongjie Ba, Wei Dong, Yiming Li, Zhan Qin, Kui Ren, and Chun Chen. Towards label-only membership inference attack against pre-trained large language models. In34th USENIX Security Symposium, USENIX Security 2025, Seattle, WA, USA, August 13-15, 2025...

    2025

  60. [68]

    Membership inference attacks on tokenizers of large language models

    Meng Tong, Yuntao Du, Kejiang Chen, Weiming Zhang, and Ninghui Li. Membership inference attacks on tokenizers of large language models. In35th USENIX Security Symposium (USENIX Security 26). USENIX Association, 2026

    2026

  61. [69]

    Window-based membership inference attacks against fine-tuned large language models

    Yuetian Chen, Yuntao Du, Kaiyuan Zhang, Ashish Kundu, Charles Fleming, Bruno Ribeiro, and Ninghui Li. Window-based membership inference attacks against fine-tuned large language models. In35th USENIX Security Symposium (USENIX Security 26). USENIX Asso- ciation, 2026

    2026

  62. [70]

    Vidleaks: Membership inference attacks against text-to-video models

    Li Wang, Wenyu Chen, Ning Yu, Zheng Li, and Shanqing Guo. Vidleaks: Membership inference attacks against text-to-video models. 15 In35th USENIX Security Symposium (USENIX Security 26). USENIX Association, 2026

    2026

  63. [71]

    Diffence: Fencing membership privacy with diffusion models

    Yuefeng Peng, Ali Naseh, and Amir Houmansadr. Diffence: Fencing membership privacy with diffusion models. In32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24-28, 2025. The Internet Society, 2025

    2025

  64. [72]

    Black-box membership inference attacks against fine-tuned diffusion models

    Yan Pang and Tianhao Wang. Black-box membership inference attacks against fine-tuned diffusion models. In32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24-28, 2025. The Internet Society, 2025

    2025

  65. [73]

    Inference attacks against graph generative diffusion models

    Xiuling Wang, Xin Huang, Guibo Luo, and Jianliang Xu. Inference attacks against graph generative diffusion models. 2026

    2026

  66. [74]

    Visualizing data using t-sne.Journal of machine learning research, 9(11), 2008

    Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne.Journal of machine learning research, 9(11), 2008

    2008

  67. [75]

    Does learning require memorization? a short tale about a long tail

    Vitaly Feldman. Does learning require memorization? a short tale about a long tail. InProceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, pages 954–959, 2020

    2020

  68. [76]

    What neural networks memorize and why: Discovering the long tail via influence estimation.Advances in Neural Information Processing Systems, 33:2881–2891, 2020

    Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation.Advances in Neural Information Processing Systems, 33:2881–2891, 2020

    2020

  69. [77]

    A closer look at memorization in deep networks

    Devansh Arpit, Stanisław Jastrz˛ ebski, Nicolas Ballas, David Krueger, Emmanuel Bengio, Maxinder S Kanwal, Tegan Maharaj, Asja Fischer, Aaron Courville, Yoshua Bengio, et al. A closer look at memorization in deep networks. InInternational Conference on Machine Learning, pages ...

    2017

  70. [78]

    Memorization through the lens of curvature of loss function around samples

    Isha Garg, Deepak Ravikumar, and Kaushik Roy. Memorization through the lens of curvature of loss function around samples. In Forty-first International Conference on Machine Learning, 2024

    2024

  71. [79]

    Seqmia: Sequential-metric based membership inference attack

    Hao Li, Zheng Li, Siyuan Wu, Chengrui Hu, Yutong Ye, Min Zhang, Dengguo Feng, and Yang Zhang. Seqmia: Sequential-metric based membership inference attack. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 3496–3510, 2024

    2024

  72. [80]

    Is difficulty calibration all we need? towards more practical membership inference attacks

    Yu He, Boheng Li, Yao Wang, Mengda Yang, Juan Wang, Hongxin Hu, and Xingyu Zhao. Is difficulty calibration all we need? towards more practical membership inference attacks. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1226–1...

    2024

  73. [81]

    Mem- bership inference attacks by exploiting loss trajectory

    Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. Mem- bership inference attacks by exploiting loss trajectory. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communica- tions Security, pages 2085–2098, 2022

    2022

  74. [82]

    Watch out! simple horizontal class backdoor can trivially evade de- fense

    Hua Ma, Shang Wang, Yansong Gao, Zhi Zhang, Huming Qiu, Minhui Xue, Alsharif Abuadbba, Anmin Fu, Surya Nepal, and Derek Abbott. Watch out! simple horizontal class backdoor can trivially evade de- fense. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communi...

    2024

  75. [83]

    Yes,{One- Bit-Flip}matters! universal{DNN}model inference depletion with runtime code fault injection

    Shaofeng Li, Xinyu Wang, Minhui Xue, Haojin Zhu, Zhi Zhang, Yansong Gao, Wen Wu, and Xuemin Sherman Shen. Yes,{One- Bit-Flip}matters! universal{DNN}model inference depletion with runtime code fault injection. In33rd USENIX Security Symposium (USENIX Security 24), pages 1315–1330, 2024

    2024

  76. [85]

    Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth. Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification.IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 12(7):2217–2226, 2019

    2019

  77. [86]

    Patternnet: A benchmark dataset for performance evaluation of remote sensing image retrieval.ISPRS Journal of Photogrammetry and Remote Sensing, 145:197–209, 2018

    Weixun Zhou, Shawn Newsam, Congmin Li, and Zhenfeng Shao. Patternnet: A benchmark dataset for performance evaluation of remote sensing image retrieval.ISPRS Journal of Photogrammetry and Remote Sensing, 145:197–209, 2018

    2018

  78. [87]

    Vggface2: A dataset for recognising faces across pose and age

    Qiong Cao, Li Shen, Weidi Xie, Omkar M Parkhi, and Andrew Zisserman. Vggface2: A dataset for recognising faces across pose and age. In2018 13th IEEE International Conference on Automatic Face & Gesture Recognition (FG 2018), pages 67–74. IEEE, 2018

    2018

  79. [88]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei- Fei. Imagenet: A large-scale hierarchical image database. In2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248–255. Ieee, 2009

    2009

  80. [89]

    Contrastive multiview coding

    Yonglong Tian, Dilip Krishnan, and Phillip Isola. Contrastive multiview coding. InEuropean Conference on Computer Vision, pages 776–794. Springer, 2020

    2020

  81. [90]

    https://huggingface.co/TencentARC/flux-mini

  82. [91]

    Black-box membership inference attacks against fine-tuned diffusion models

    Yan Pang and Tianhao Wang. Black-box membership inference attacks against fine-tuned diffusion models. In32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24-28, 2025, 2025

    2025

  83. [92]

    Towards reliable verification of unauthorized data usage in personalized text-to-image diffusion models

    Boheng Li, Yanhao Wei, Yankai Fu, Zhenting Wang, Yiming Li, Jie Zhang, Run Wang, and Tianwei Zhang. Towards reliable verification of unauthorized data usage in personalized text-to-image diffusion models. In2025 IEEE Symposium on Security and Privacy (SP), pages 2564–

  84. [93]

    Pretender: Universal active defense against diffusion finetuning attacks

    Zekun Sun, Zijian Liu, Shouling Ji, Chenhao Lin, and Na Ruan. Pretender: Universal active defense against diffusion finetuning attacks. In34th USENIX Security Symposium (USENIX Security 25), pages 1017–1036, 2025

    2025

  85. [94]

    Genomic privacy and limits of individual detection in a pool.Nature Genetics, 41(9):965–967, 2009

    Sriram Sankararaman, Guillaume Obozinski, Michael I Jordan, and Eran Halperin. Genomic privacy and limits of individual detection in a pool.Nature Genetics, 41(9):965–967, 2009

    2009

  86. [95]

    Prototypical networks for few-shot learning.Advances in Neural Information Processing Systems, 30, 2017

    Jake Snell, Kevin Swersky, and Richard Zemel. Prototypical networks for few-shot learning.Advances in Neural Information Processing Systems, 30, 2017

    2017

  87. [96]

    Prevalence of neural collapse during the terminal phase of deep learning training

    Vardan Papyan, XY Han, and David L Donoho. Prevalence of neural collapse during the terminal phase of deep learning training. Proceedings of the National Academy of Sciences, 117(40):24652– 24663, 2020

    2020

  88. [97]

    Neural collapse under mse loss: Proximity to and dynamics on the central path

    XY Han, Vardan Papyan, and David L Donoho. Neural collapse under mse loss: Proximity to and dynamics on the central path. In International Conference on Learning Representations, 2022

    2022

  89. [98]

    Distance-based image classification: Generalizing to new classes at near-zero cost.IEEE Transactions on Pattern Analysis and Machine Intelligence, 35(11):2624–2637, 2013

    Thomas Mensink, Jakob Verbeek, Florent Perronnin, and Gabriela Csurka. Distance-based image classification: Generalizing to new classes at near-zero cost.IEEE Transactions on Pattern Analysis and Machine Intelligence, 35(11):2624–2637, 2013

    2013

  90. [99]

    Cambridge University Press, 2018

    Roman Vershynin.High-dimensional probability: An introduction with applications in data science, volume 47. Cambridge University Press, 2018

    2018

  91. [100]

    Calibrating noise to sensitivity in private data analysis

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. InTheory of Cryptography Conference, pages 265–284. Springer, 2006

    2006

  92. [101]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308–318, 2016

    2016

  93. [102]

    Opacus: User-friendly differen- tial privacy library in pytorch

    Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Tes- tuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, et al. Opacus: User-friendly differen- tial privacy library in pytorch. InNeurIPS 2021 Workshop Privacy in Machine ...

    2021

  94. [103]

    under both cross-entropy and MSE losses and by the asymptotic equivalence between linear softmax and nearest- class-mean classifiers on fixed features [95], [98]; our ResNet- 18 trained to 100% training accuracy operates in this regime. Proof:The proof proceeds in three steps:...

  95. [104]

    85.3 77.1 85.888.5 80.4 88.80.3 0.0 0.8[27]85.076.1 84.889.479.7 88.51.60.2 1.2[15] 81.6 75.3 81.8 87.278.4 85.81.00.0 0.3[29]76.568.6 76.374.862.7 72.53.60.0 1.1 PatternNet(5) [28]73.058.7 69.477.960.3 74.0 0.0 0.0 0.0[27]66.559.2 64.071.459.1 64.5 7.0 0.0 9.0[15]73.048.3 67....

  96. [5483]

    USENIX Association, 2025

    2025

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.