DeMem: Privacy-Enhanced Robust Adversarial Learning via De-Memorization

Qiongxiu Li; Xiaoyu Luo

REVIEW 4 major objections 5 minor 37 references

DeMem: Privacy-Enhanced Robust Adversarial Learning via De-Memorization

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A minibatch loss-variance penalty reduces membership-inference leakage in adversarially trained models.

desk verdict DeMem is a simple loss-variance penalty that empirically lowers LiRA TPR in adversarial training, but the paper overstates the mechanism and omits the key DP-SGD privacy comparison. read the letter →

arxiv 2412.05767 v3 pith:37VJQNGC submitted 2024-12-08 cs.LG cs.CR

Xiaoyu Luo , Qiongxiu Li This is my paper · ORCID

classification cs.LGcs.CR MSC 68T0768P27

keywords adversarialrobustnessmembershipinferenceattackmemorizationdifferentialprivacyprivacy-robustnesstrade-offlossvarianceregularizationLiRADeMem

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarially trained models are known to leak membership information, and the standard privacy remedy, differential privacy, destroys the robustness that adversarial training is meant to provide. This paper argues that the damage is uneven: DP disproportionately hurts low-memorization, low-risk samples that carry most of the model's accuracy, while high-memorization samples drive privacy leakage. To target only the risky samples, the authors propose DeMem, a regularizer that penalizes the variance of per-sample losses within each minibatch, pushing high-loss samples toward the batch mean. On CIFAR-10 with PGD-AT, DeMem lowers the LiRA membership-inference attack's true-positive rate at 0.1% false-positive rate from 20.29% to 12.39% while robust accuracy drops from 35.96% to 35.03%, with similar gains on CIFAR-100 and with TRADES. The claim is that privacy in robust models can be improved substantially without the accuracy collapse caused by DP.

What carries the argument

The central object is the Sample-wise Dememorization Penalty, the variance of per-sample losses within a training minibatch: $\Psi(B)=\frac{1}{N}\sum_{i=1}^{N}\left(\ell(x_i,\theta)-\frac{1}{N}\sum_{j=1}^{N}\ell(x_j,\theta)\right)^2$. It is added to the original training loss as $L_{\mathrm{total}}(\theta)=L(\theta)+\lambda\Psi(B)$. The penalty shrinks the spread of losses, pulling high-loss (high-memorization) samples toward the batch mean so the model retains less information about them. Its rationale rests on the measured Spearman correlation between loss and memorization (0.501 train, 0.784 test on CIFAR-100), which lets loss stand in for the computationally expensive leave-one-out memorization score. The paper uses LiRA TPR at low FPR as the privacy metric and applies the penalty on top of PGD-AT and TRADES.

What would settle it

Compute leave-one-out memorization scores on a PGD-AT or TRADES model for CIFAR-10 and correlate them with per-sample losses; if the Spearman correlation is near zero or negative, the loss proxy DeMem relies on is absent. Alternatively, measure per-sample memorization before and after DeMem: if high-loss samples retain their memorization while aggregate privacy improves, the proposed mechanism is not what is doing the work.

Watch

Extended reading notes

Core claim

The paper's central claim is that the privacy leakage introduced by adversarial training can be reduced by selectively de-memorizing high-risk samples, and that a simple variance penalty on minibatch losses accomplishes this. The authors first show, using precomputed memorization scores from prior work, that applying DP-SGD to PGD-AT cuts accuracy mostly among samples with low memorization scores, whereas samples with high memorization scores are the main source of membership leakage. They then note that loss correlates with memorization (Spearman 0.501 on training and 0.784 on test data for a baseline CIFAR-100 model) and define DeMem as adding $\lambda$ times the variance of the losses in a minibatch to the training objective. With this regularizer added to PGD-AT and TRADES, membership-inference attack success at strict false-positive rates drops markedly on CIFAR-10 and CIFAR-100 while natural and robust accuracies remain nearly unchanged. The authors take this as evidence that the privacy-robustness tension in adversarial training can be eased without DP's global performance penalty.

Load-bearing premise

The method assumes that a sample's loss reliably tracks how much the model memorizes that sample under adversarial training, so shrinking the spread of losses in a minibatch actually de-memorizes the high-risk samples; this correlation is measured only on a baseline CIFAR-100 model, not on the PGD-AT or TRADES models where DeMem is applied.

Editorial extensions

If this is right

Adding DeMem to PGD-AT lowers LiRA TPR at 0.1% FPR from 20.29% to 12.39% on CIFAR-10 while robust accuracy drops from 35.96% to 35.03%.
On CIFAR-100, PGD-AT + DeMem reduces TPR at 0.1% FPR from 67.23% to 64.65%, and TRADES + DeMem from 52.60% to 47.80%, with robust accuracy losses under about two points.
Increasing the dememorization strength $\lambda$ strengthens privacy protection while robustness declines only slightly, giving a tunable privacy-robustness knob.
The privacy gains hold across tested adversarial perturbation magnitudes, so DeMem is not tied to one attack configuration.
DeMem is a drop-in regularizer for adversarial training methods, so it can be appended to future robust training schemes without changing their core objectives.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

One extension the paper leaves implicit: because the loss-memorization proxy is not specific to adversarial training, DeMem should also reduce membership leakage under standard training, which would be straightforward to test.
Another extension: since DeMem already suppresses memorization of high-risk samples, combining it with DP-SGD might allow smaller noise for a fixed privacy budget, softening DP's accuracy collapse.
A caveat the paper does not address: the loss-memorization correlation was measured only on a baseline CIFAR-100 model, so if it weakens under adversarial training, the mechanism would need re-validation even if aggregate privacy gains persist.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The one thing to know: this paper adds a loss-variance penalty to adversarial training and shows it reduces LiRA membership attack TPR at low FPR on CIFAR-10/100. The effect is real enough to take seriously, but the paper's framing as selective de-memorization of high-risk samples does not match what the penalty actually does. The central comparison against DP-SGD's privacy level is also missing, so the headline claim of a better privacy-robustness balance is not demonstrated.

What is genuinely useful: the diagnostic that DP disproportionately harms low-memorization samples is a nice observation, using precomputed memorization scores and per-bin LiRA TPR. It gives a concrete reason why naive DP + adversarial training fails. And a one-line regularizer that cuts LiRA TPR at 0.1% FPR from 20.29% to 12.39% on CIFAR-10, with only a 0.93% robustness drop, is practically interesting. The experimental setup (128 models, LiRA, multiple methods and two datasets) is solid, though narrow.

The soft spots are real. First, Table 3 never reports privacy leakage for the DP-SGD baseline, so the abstract's claim of a better balance than DP is unsubstantiated. You cannot conclude DeMem beats DP on the privacy-robustness frontier without DP's TPR. Second, the mechanism is misdescribed. The penalty Ψ(B) = (1/N)Σ(ℓ_i − μ)^2 does not 'selectively target' high-risk samples; it compresses all losses toward the batch mean. The gradient for a high-loss sample is 2λ(ℓ_i − μ)∇ℓ_i, which is larger in magnitude, so it actually fits those samples harder, not 'restricts' them. Third, the only loss-memorization correlation (Table 1) comes from a non-robust CIFAR-100 baseline; there is no evidence that DeMem reduces the Eq. (1) memorization score under PGD-AT or TRADES. What it likely does is homogenize loss values, which directly shrinks the tail that LiRA's low-FPR thresholds operate on. That may be a legitimate privacy defense, but it is not the de-memorization story told here. Fourth, robustness drops are downplayed: TRADES + DeMem on CIFAR-100 drops robust accuracy from 18.93% to 16.77%, which is about two points, not negligible. Finally, there are inconsistencies between text and tables (e.g., the claimed DP natural accuracy of 20.35% vs. 31.27% in Table 2), and no code is provided.

These are addressable. The paper deserves a serious referee, but the revision needs: DP-SGD privacy numbers, a direct or indirect measurement of memorization under DeMem (even on a subset), a corrected mechanism description, and honest treatment of robustness costs.

For whom? Researchers working on privacy-robustness trade-offs may find the regularizer worth testing. I would not cite it in its current form, but it is worth a careful read.

Referee Report

4 major / 5 minor

Summary. The paper proposes DeMem, a regularizer that adds a minibatch loss-variance penalty to adversarial training losses (PGD-AT, TRADES) with the stated goal of selectively de-memorizing high-risk samples and thereby reducing membership privacy leakage without significantly harming natural or robust accuracy. The authors justify the penalty by a measured Spearman correlation between per-sample loss and memorization scores on CIFAR-100, and evaluate privacy leakage with LiRA TPR at low FPR thresholds. Experiments on CIFAR-10 and CIFAR-100 show that adding DeMem reduces LiRA TPR while producing only small drops in robust accuracy, and the paper claims this achieves a better privacy-robustness balance than differential privacy.

Significance. If the central claim were established, DeMem would be a simple and scalable heuristic for reducing membership leakage in robust models, and the evaluation protocol (LiRA TPR at 0.1% and 0.001% FPR, 128 models per setting, mean over 10 models) is a rigorous and appropriate way to quantify privacy risk. The paper also raises an interesting question about why DP degrades robust models by examining sample-level memorization. However, the significance is currently undercut by a mismatch between the proposed mechanism and its actual gradient behavior, and by the absence of a direct comparison with DP on the privacy metric. The empirical phenomenon may be real, but the paper's interpretation needs substantial revision before the claims can be accepted.

major comments (4)

[§3.3 (definition of Ψ(B))] The proposed penalty Ψ(B) = (1/N) Σ_i (ℓ_i − μ)^2 is described as selectively restricting high-risk samples, but its gradient contribution for sample i is 2λ(ℓ_i − μ)∇ℓ_i. Samples with loss above the batch mean receive amplified gradients and are therefore fitted more strongly, while samples below the mean are fitted more weakly. This is the opposite of the stated mechanism. Please either correct the mechanism description or provide direct evidence (e.g., memorization scores from Eq. (1) before and after DeMem under PGD-AT/TRADES) that the penalty reduces memorization of high-loss samples.
[Table 3 / §4.2] The abstract and §3.1 claim DeMem achieves a better privacy-robustness balance than differential privacy, but Table 3 reports TPR only for PGD-AT/TRADES with and without DeMem. The DP-SGD baseline ('Base' in Table 2) is never evaluated with LiRA, so the central comparison against DP is not demonstrated. Please add TPR at the same FPR thresholds for the DP-SGD baseline on both datasets.
[§3.2, Table 1] The only evidence that loss is a reliable proxy for memorization comes from Spearman correlations (0.501 on training, 0.784 on test) computed on a non-robust CIFAR-100 baseline using memorization scores from Feldman and Zhang. DeMem is applied to PGD-AT and TRADES models, and adversarial training substantially changes the loss distribution. Without measuring the loss-memorization correlation under adversarial training, the proxy assumption is unsupported in the target setting.
[§2.4 and §3.3] LiRA, the primary privacy metric, scores members and non-members by per-example loss, and TPR at 0.1% FPR thresholds the extreme high-loss tail of the non-member distribution. Since the variance penalty directly compresses the training loss distribution, the observed TPR drop may be a mechanical consequence of loss homogenization rather than a reduction in actual memorization. Please report a direct memorization measure (e.g., Eq. (1) estimated via influence functions or leave-one-out on a subsample) or an attack metric that is not purely loss-threshold based.

minor comments (5)

[Introduction] The phrase 'without compromising both nature and robust accuracy' should read 'natural and robust accuracy'; the same typo appears in the abstract's parenthetical example.
[§4.2, Table 2] The text says "'Base' refers to PGD-AT with DP-SGD configured identically to Table 2," but Table 2 does not list a DP-SGD configuration. Please clarify the DP-SGD hyperparameters (noise multiplier, clipping norm) used for the Base rows and state whether the same Base is used for both PGD-AT and TRADES comparisons.
[Abstract] The abstract claims evaluation across 'multiple training methods and datasets' and later mentions 'model structures,' but the experiments use only ResNet-50 with PGD-AT and TRADES. Please either add experiments with another architecture or soften the claim.
[Figures 2 and 3] Figures 2 and 3 are referenced in the text but their construction is not fully described; please add explicit axis labels, the evaluation protocol (e.g., which attack models are used), and the range of λ and ε values shown.
[References] Several references have incomplete bibliographic details (e.g., [20] and [25] lack proper venue/pagination), which should be corrected for publication.

Circularity Check

1 steps flagged · score 4.0 of 10

Privacy-leakage evaluation is entangled with the loss proxy used to define DeMem, but the central result retains independent robust-accuracy content.

other [Section 2.4 (LiRA metric), Section 3.3 (DeMem penalty), Table 3 results]
"LiRA represents the state-of-the-art (SOTA) in MIA and is closely aligned with the concept of memorization... We first define a Sample-wise Dememorization Penalty as the variance of the losses computed over the sampled subset S, i.e., Ψ(B) = 1/N Σ (ℓ(x_i, θ) − 1/N Σ ℓ(x_j, θ))^2"

The method is motivated by the claim that per-example loss proxies memorization, and the attack used to measure privacy (LiRA) is itself a loss-based thresholding procedure. The regularizer minimizes the variance of the same per-example losses that LiRA uses to separate members from non-members at fixed FPR; hence the large TPR drops in Table 3 (e.g., 20.29% to 12.39% on CIFAR-10) follow in part from compressing the loss distribution, not from a demonstrated reduction of Eq. (1) memorization. Table 1's loss-memorization correlation is computed only on a standard CIFAR-100 baseline, not on the PGD-AT/TRADES models, so the proxy-to-memorization step is not independently validated for the models DeMem is applied to.

full rationale

DeMem's privacy claim is central, but the paper never measures Eq. (1) memorization on the robust models it modifies; it relies on a loss-proxy correlation from a non-robust CIFAR-100 baseline and then evaluates privacy with LiRA, a loss-based attack. Since the regularizer directly shrinks the spread of per-example losses, the reported privacy improvement is at least partly a direct consequence of the loss distribution being compressed rather than an independent verification of de-memorization. Still, λ is not tuned to LiRA, the robust-accuracy comparisons are separate and meaningful, and the self-citations (e.g., [7]) are backed by the external LiRA paper [21], so the circularity is partial rather than a forced self-citation chain. Score 4 reflects this proxy/metric entanglement, not a fully constructed equivalence.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The central claim rests on two empirical bridges: memorization as a measure of privacy risk, and loss as its proxy. Both are borrowed from prior work or measured only on baseline models, so the method relies heavily on domain assumptions and an ad hoc proxy.

free parameters (1)

lambda (dememorization penalty weight) = not reported for main tables; varied in Fig. 2
Controls how strongly the loss variance is penalized; the paper's privacy/robustness balance depends on this hand-set hyperparameter, and the main tables do not state which value was used.

assumptions (4)

domain assumption Per-sample memorization scores quantify privacy leakage risk.
Used to diagnose why DP hurts accuracy in Sec. 3.2; based on prior work [12, 13] rather than derived here.
domain assumption LiRA TPR at low FPR is the correct privacy metric.
The paper adopts LiRA from [21] without independent justification; all evaluations depend on this choice.
ad hoc to paper Loss is a reliable proxy for memorization under adversarial training.
Table 1 reports Spearman correlation only on a baseline CIFAR-100 model (0.501 train, 0.784 test), not on PGD-AT or TRADES models where DeMem is applied.
ad hoc to paper Reducing loss variance reduces memorization of high-loss samples.
The penalty is applied to all samples, so it is not established to selectively de-memorize high-loss samples; no theoretical or per-sample evidence is given under adversarial training.

how reviews work

0 comments

Cite this review

Pith. "Pith review of DeMem: Privacy-Enhanced Robust Adversarial Learning via De-Memorization." pith.science (2026). https://pith.science/paper/37VJQNGC

@misc{pith2026241205767,
  author       = {Pith},
  title        = {Pith review of: DeMem: Privacy-Enhanced Robust Adversarial Learning via De-Memorization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/37VJQNGC}},
  note         = {Machine review of arXiv:2412.05767}
}

read the original abstract

Adversarial robustness, the ability of a model to withstand manipulated inputs that cause errors, is essential for ensuring the trustworthiness of machine learning models in real-world applications. However, previous studies have shown that enhancing adversarial robustness through adversarial training increases vulnerability to privacy attacks. While differential privacy can mitigate these attacks, it often compromises robustness against both natural and adversarial samples. Our analysis reveals that differential privacy disproportionately impacts low-risk samples, causing an unintended performance drop. To address this, we propose DeMem, which selectively targets high-risk samples, achieving a better balance between privacy protection and model robustness. DeMem is versatile and can be seamlessly integrated into various adversarial training techniques. Extensive evaluations across multiple training methods and datasets demonstrate that DeMem significantly reduces privacy leakage while maintaining robustness against both natural and adversarial samples. These results confirm DeMem's effectiveness and broad applicability in enhancing privacy without compromising robustness.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 29 canonical work pages

[1]

DeMem: Privacy-Enhanced Robust Adversarial Learning via De-Memorization

INTRODUCTION As machine learning models, particularly deep neural net- works (DNNs), become integrated into daily life, ensuring This work is partially supported by the EU ChipsJU and the Innovation Fund Denmark through the project CLEVER (no. 101097560). their trustworthiness—including robustness, privacy, and fair- ness [1, 2, 3, 4, 5]—is crucial. Witho...

work page Pith review arXiv 2025
[2]

We conduct a nuanced analysis to attribute why DP de- grades model performance, focusing on the individual sam- ple’s memorization score to uncover the impact on privacy risk and robustness

work page
[3]

We reveal that DP disproportionately harms samples with low privacy risks, which are essential for preserving model robustness

work page
[4]

DeMem can be seamlessly integrated into various adver- sarial training techniques

We propose DeMem, a method that selectively restricts high-risk samples to enhance privacy while minimizing per- formance degradation. DeMem can be seamlessly integrated into various adver- sarial training techniques. Extensive experiments on vari- ous adversarial training methods, including PGD-AT [14] and TRADES [15], and datasets such as CIFAR-10 and C...

work page
[5]

PRELIMINARIES In this section, we review necessary fundamentals that are es- sential for understanding the rest of the paper. 2.1. Adversarial robustness Robustness is essential for the reliable deployment of ma- chine learning models, particularly in safety-critical domains like autonomous driving. However, adversarial examples [16] pose a major challeng...

work page
[6]

We then analyze individual samples to explain why DP can fail, followed by a detailed presentation of our proposed approach

THE PROPOSED APPROACH We first review related work on privacy and adversarial ro- bustness, highlighting the challenge of balancing the two. We then analyze individual samples to explain why DP can fail, followed by a detailed presentation of our proposed approach. 3.1. Tension between Privacy and Adversarial Robust- ness Although no theoretical proof has...

work page
[7]

Setup Experiments were conducted on 8 NVIDIA 4090 GPUs using PyTorch [27]

EXPERIMENTAL RESULTS 4.1. Setup Experiments were conducted on 8 NVIDIA 4090 GPUs using PyTorch [27]. Datasets. Following previous work [7, 21], we employed ResNet-50 [28] and used the CIFAR-100, CIFAR-10 datasets for MIA and performance evaluations. MIA setting. Following LiRA’s setting, for each adversar- ial training method, a total of 128 models were t...

work page
[8]

CONCLUSION AND FUTURE WORK In this paper, we propose a novel privacy-enhanced adversar- ial training method. We begin by conducting a nuanced anal- ysis to identify which samples contribute to the significant accuracy drop after applying differential privacy (DP), using the memorization score of individual samples. Our analy- sis reveals that the degradat...

work page

Show all 37 references

[9]

An adversar- ial perspective on accuracy, robustness, fairness, and privacy: Multilateral-tradeoffs in trustworthy ml,

Alex Gittens, B ¨ulent Yener, and Moti Yung, “An adversar- ial perspective on accuracy, robustness, fairness, and privacy: Multilateral-tradeoffs in trustworthy ml,” IEEE Access , vol. 10, pp. 120850–120865, 2022

2022
[10]

On the privacy risks of algorithmic fairness,

Hongyan Chang and Reza Shokri, “On the privacy risks of algorithmic fairness,” in 2021 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2021, pp. 292–303

2021
[11]

Adbm: Adversar- ial diffusion bridge model for reliable adversarial purification,

Xiao Li, Wenxuan Sun, Huanran Chen, Qiongxiu Li, Yining Liu, Yingzhe He, Jie Shi, and Xiaolin Hu, “Adbm: Adversar- ial diffusion bridge model for reliable adversarial purification,” arXiv preprint arXiv:2408.00315, 2024

2024 arXiv
[12]

Language-driven anchors for zero-shot adver- sarial robustness,

Xiao Li, Wei Zhang, Yining Liu, Zhanhao Hu, Bo Zhang, and Xiaolin Hu, “Language-driven anchors for zero-shot adver- sarial robustness,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2024, pp. 24686– 24695

2024
[13]

Faster-gcg: Efficient discrete optimization jailbreak attacks against aligned large language models,

Xiao Li, Zhuhong Li, Qiongxiu Li, Bingze Lee, Jinghao Cui, and Xiaolin Hu, “Faster-gcg: Efficient discrete optimization jailbreak attacks against aligned large language models,”arXiv preprint arXiv:2410.15362, 2024

2024 arXiv
[14]

Privacy risks of securing machine learning models against adversarial exam- ples,

Liwei Song, Reza Shokri, and Prateek Mittal, “Privacy risks of securing machine learning models against adversarial exam- ples,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , 2019, pp. 241–257

2019
[15]

On the privacy effect of data enhancement via the lens of memoriza- tion,

Xiao Li, Qiongxiu Li, Zhanhao Hu, and Xiaolin Hu, “On the privacy effect of data enhancement via the lens of memoriza- tion,” IEEE Transactions on Information F orensics and Secu- rity, 2024

2024
[16]

Membership inference attacks against machine learning models,

Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP). IEEE, 2017, pp. 3–18

2017
[17]

Robustness threats of differential privacy,

Nurislam Tursynbek, Aleksandr Petiushko, and Ivan Os- eledets, “Robustness threats of differential privacy,” arXiv preprint arXiv:2012.07828, 2020

2012 arXiv
[18]

Learning to be adversarially robust and differentially private,

Jamie Hayes, Borja Balle, and M Pawan Kumar, “Learning to be adversarially robust and differentially private,” arXiv preprint arXiv:2201.02265, 2022

2022 arXiv
[19]

Deep learn- ing with differential privacy,

Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMa- han, Ilya Mironov, Kunal Talwar, and Li Zhang, “Deep learn- ing with differential privacy,” inProceedings of the 2016 ACM SIGSAC conference on computer and communications secu- rity, 2016, pp. 308–318

2016
[20]

Does learning require memorization? a short tale about a long tail,

Vitaly Feldman, “Does learning require memorization? a short tale about a long tail,” inProceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing , 2020, pp. 954– 959

2020
[21]

What neural networks memorize and why: Discovering the long tail via influence es- timation,

Vitaly Feldman and Chiyuan Zhang, “What neural networks memorize and why: Discovering the long tail via influence es- timation,” Advances in Neural Information Processing Sys- tems, vol. 33, pp. 2881–2891, 2020

2020
[22]

Towards deep learn- ing models resistant to adversarial attacks,

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, “Towards deep learn- ing models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

2017 arXiv
[23]

Theoretically principled trade-off between robustness and accuracy,

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Lau- rent El Ghaoui, and Michael Jordan, “Theoretically principled trade-off between robustness and accuracy,” in International conference on machine learning. PMLR, 2019, pp. 7472–7482

2019
[24]

Explaining and harnessing adversarial examples,

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572, 2014

2014 arXiv
[25]

Robust physical-world attacks on deep learning visual classification,

Kevin et al. Eykholt, “Robust physical-world attacks on deep learning visual classification,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), 2018, pp. 1625–1634

2018
[26]

Adversarial weight perturbation helps robust generalization,

Dongxian Wu, Shu-Tao Xia, and Yisen Wang, “Adversarial weight perturbation helps robust generalization,” Advances in neural information processing systems , vol. 33, pp. 2958– 2969, 2020

2020
[27]

Differential privacy,

Cynthia Dwork, “Differential privacy,” in International col- loquium on automata, languages, and programming . Springer, 2006, pp. 1–12

2006
[28]

Quality control of voice recordings in re- mote parkinson’s disease monitoring using the infinite hidden markov model,

Amir Hossein Poorjam, Yordan P. Raykov, Reham Badawy, Jesper Rindom Jensen, Mads Graesboll Christensen, and Max A. Little, “Quality control of voice recordings in re- mote parkinson’s disease monitoring using the infinite hidden markov model,” in Proc. Int. Conf. Acoust., Spee...

2019
[29]

Membership inference at- tacks from first principles,

Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, An- dreas Terzis, and Florian Tramer, “Membership inference at- tacks from first principles,” in 2022 IEEE Symposium on Secu- rity and Privacy (SP) . IEEE, 2022, pp. 1897–1914

2022
[30]

Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,

Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” arXiv preprint arXiv:1806.01246, 2018

2018 arXiv
[31]

Privacy risk in machine learning: Analyzing the con- nection to overfitting,

Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha, “Privacy risk in machine learning: Analyzing the con- nection to overfitting,” in 2018 IEEE 31st computer security foundations symposium (CSF). IEEE, 2018, pp. 268–282

2018
[32]

Systematic evaluation of pri- vacy risks of machine learning models,

Liwei Song and Prateek Mittal, “Systematic evaluation of pri- vacy risks of machine learning models,” in30th USENIX Secu- rity Symposium (USENIX Security 21) , 2021, pp. 2615–2632

2021
[33]

On the difficulty of membership inference attacks,

Shahbaz Rezaei and Xin Liu, “On the difficulty of membership inference attacks,” 2021, pp. 7892–7900

2021
[34]

To trust or not to trust prediction scores for membership in- ference attacks,

Dominik Hintersdorf, Lukas Struppek, and Kristian Kersting, “To trust or not to trust prediction scores for membership in- ference attacks,” 2022, pp. 3043–3049

2022
[35]

Pytorch: An imperative style, high- performance deep learning library,

Adam et al. Paszke, “Pytorch: An imperative style, high- performance deep learning library,” in Adv. Neural Inf. Pro- cess. Syst. (NeurIPS), 2019, pp. 8024–8035

2019
[36]

Deep residual learning for image recog- nition,

Kaiming et al. He, “Deep residual learning for image recog- nition,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), 2016, pp. 770–778

2016
[37]

Opacus: User-friendly differential privacy library in pytorch,

Ashkan et al. Yousefpour, “Opacus: User-friendly differential privacy library in pytorch,” arXiv:2109.12298, 2021

2021 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

DeMem: Privacy-Enhanced Robust Adversarial Learning via De-Memorization

INTRODUCTION As machine learning models, particularly deep neural net- works (DNNs), become integrated into daily life, ensuring This work is partially supported by the EU ChipsJU and the Innovation Fund Denmark through the project CLEVER (no. 101097560). their trustworthiness—including robustness, privacy, and fair- ness [1, 2, 3, 4, 5]—is crucial. Witho...

work page Pith review arXiv 2025

[2] [2]

We conduct a nuanced analysis to attribute why DP de- grades model performance, focusing on the individual sam- ple’s memorization score to uncover the impact on privacy risk and robustness

work page

[3] [3]

We reveal that DP disproportionately harms samples with low privacy risks, which are essential for preserving model robustness

work page

[4] [4]

DeMem can be seamlessly integrated into various adver- sarial training techniques

We propose DeMem, a method that selectively restricts high-risk samples to enhance privacy while minimizing per- formance degradation. DeMem can be seamlessly integrated into various adver- sarial training techniques. Extensive experiments on vari- ous adversarial training methods, including PGD-AT [14] and TRADES [15], and datasets such as CIFAR-10 and C...

work page

[5] [5]

PRELIMINARIES In this section, we review necessary fundamentals that are es- sential for understanding the rest of the paper. 2.1. Adversarial robustness Robustness is essential for the reliable deployment of ma- chine learning models, particularly in safety-critical domains like autonomous driving. However, adversarial examples [16] pose a major challeng...

work page

[6] [6]

We then analyze individual samples to explain why DP can fail, followed by a detailed presentation of our proposed approach

THE PROPOSED APPROACH We first review related work on privacy and adversarial ro- bustness, highlighting the challenge of balancing the two. We then analyze individual samples to explain why DP can fail, followed by a detailed presentation of our proposed approach. 3.1. Tension between Privacy and Adversarial Robust- ness Although no theoretical proof has...

work page

[7] [7]

Setup Experiments were conducted on 8 NVIDIA 4090 GPUs using PyTorch [27]

EXPERIMENTAL RESULTS 4.1. Setup Experiments were conducted on 8 NVIDIA 4090 GPUs using PyTorch [27]. Datasets. Following previous work [7, 21], we employed ResNet-50 [28] and used the CIFAR-100, CIFAR-10 datasets for MIA and performance evaluations. MIA setting. Following LiRA’s setting, for each adversar- ial training method, a total of 128 models were t...

work page

[8] [8]

CONCLUSION AND FUTURE WORK In this paper, we propose a novel privacy-enhanced adversar- ial training method. We begin by conducting a nuanced anal- ysis to identify which samples contribute to the significant accuracy drop after applying differential privacy (DP), using the memorization score of individual samples. Our analy- sis reveals that the degradat...

work page