Real-Time Privacy Risk Measurement with Privacy Tokens for Gradient Leakage

Chen Hou; Hong Chen; Jiayang Meng; Qingyu Huang; Tao Huang; Xin Shi

REVIEW 5 major objections 4 minor 16 references

Real-Time Privacy Risk Measurement with Privacy Tokens for Gradient Leakage

T0 review · 5 major / 4 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that privacy tokens—gradient embeddings scored by mutual information—measure gradient leakage in real time without running privacy attacks.

desk verdict The monitoring idea is worth a look, but the paper's own Table 1 contradicts the claimed MI–attack correlation, so the central claim doesn't hold. read the letter →

arxiv 2502.02913 v4 pith:73LKP5KY submitted 2025-02-05 cs.LG cs.CR

Jiayang Meng , Tao Huang , Hong Chen , Xin Shi , Qingyu Huang , Chen Hou This is my paper · ORCID

classification cs.LGcs.CR

keywords privacytokensgradientleakagemutualinformationMINEreal-timemonitoringinversionattackdifferentialriskmeasurement

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes that privacy risk from gradient leakage can be monitored continuously during training, without launching attacks, by measuring mutual information between training data and gradients. Its method embeds gradients into compact privacy tokens and combines them with the model's own intermediate-layer features inside a Mutual Information Neural Estimator (MINE). The paper reports that the resulting mutual-information difference between matched and mismatched data-gradient pairs is positive during training, rises and then falls, and tracks the quality of gradient-inversion image reconstruction. If correct, trainers get a real-time signal of when gradients are most exposed and can adjust protection, such as differential privacy noise, accordingly.

What carries the argument

Privacy tokens are learned embeddings of gradients produced by an autoencoder or transformer-based feature extractor. The MINE network, parameterized by $T_\theta$, estimates a Donsker–Varadhan lower bound on $I(X;G)$ using positive samples (a batch of data with its own gradient) and negative samples (data paired with another batch's gradient); the estimated score is the difference $I(X;G)-I(X;G')$. This difference quantifies how distinguishable matched from mismatched pairs are—the operational proxy for attacker information gain.

What would settle it

At a late sub-epoch where the paper's mutual-information difference is near its minimum (for example LeNet sub-epoch 200), run the same DLG reconstruction on those gradients and measure SSIM/PSNR; if reconstruction quality remains high while the mutual-information difference is low, the difference does not actually track attack potential.

Watch

Extended reading notes

Core claim

The central discovery claimed is that the mutual-information difference between correctly matched data-gradient pairs and shuffled pairs is a dependable privacy measure: it exceeds zero once training begins, follows a rise-then-fall trajectory, and correlates with the success of gradient-based reconstruction attacks. On this basis the paper concludes that gradients in early and intermediate training stages are the most sensitive, that later-stage gradients leak less and tolerate more DP noise, and that mutual information computed from privacy tokens can substitute for actual attack simulations in assessing leakage.

Load-bearing premise

The estimate assumes the chosen embeddings—the model's intermediate-layer outputs and the gradient privacy token—preserve all privacy-relevant information about the raw data; if either embedding discards or distorts such information, the measured mutual-information difference will not track the true risk.

Editorial extensions

If this is right

A trainer can watch the mutual-information difference over sub-epochs and know when gradient leakage risk is highest, without running any attack.
The rise-then-fall trend implies that the most sensitive gradients appear in the early and intermediate training stages, so protection effort should concentrate there.
Because the mutual-information difference tracks reconstruction quality, it can serve as a fast proxy for attack-based privacy evaluation in settings where attacks are costly or unrealistic.
In a differential-privacy workflow, the measured sensitivity schedule tells the trainer when noise can be reduced to preserve utility (later stages) and when it must be higher (earlier stages).
Batch size shifts the timing of the peak sensitivity, so the monitoring signal should be interpreted relative to the training schedule.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper, the mutual-information score measures how distinguishable matched and mismatched pairs are, not the absolute amount of recoverable private content; two models with the same score could differ in how much of the reconstructed image is semantically sensitive.
Beyond the paper, the same privacy-token machinery could be tested against membership inference: if the mutual-information difference predicts membership-inference accuracy as well as it predicts reconstruction quality, the measure would generalize to a broader class of attacks.
Beyond the paper, privacy tokens could be applied in federated learning rounds, where per-client gradient exposure varies with data heterogeneity; the mutual-information difference could flag which client's update is most leaky and trigger client-side noise.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: the paper has a real idea—use mutual information between data and gradient embeddings for continuous privacy monitoring during training—and it does the engineering work to make that operational. But the central validation fails on the paper's own Table 1, and the MI being estimated is not the quantity the theory is written for.

What's new and good: the privacy token is essentially a learned gradient embedding, which is not novel by itself, but tying it to MINE and monitoring at sub-epoch granularity is a reasonable combination. The observation that the MI difference rises then falls across training is consistent across models and batch-size ablations, and the paper is honest enough to report the early-epoch contradiction even though it then explains it away. Using DLG as an external validation on CIFAR-10 is a plus.

The soft spots are serious. First, Section 3.2 explicitly says they cannot use raw data and gradients, so they substitute intermediate-layer outputs for data features and learned embeddings for gradients. The Donsker–Varadhan bound then applies to I(features; embedding), not I(X;G). The link to actual privacy leakage is assumed, not shown. Second, Table 1 contradicts the claim that the MI difference correlates with attack potential. At sub-epoch 0, the MI difference is near zero or negative (LeNet 0.0329, CNN 0.0003, MLP 5.8e-4) yet SSIM is 0.998–0.99999, near-perfect reconstruction. The paper's third bullet in Section 4.2.2 concedes that random initialization helps attacks—which is exactly a case where the MI difference misses a major determinant of attack success. The paper calls this 'unexpected,' but it is fatal for a 'reliable measure' claim. Third, there are no error bars, the MINE network appears to be trained on very small batches (10% of Dpos, which itself is limited), and the CelebA-HQ validation relies on the authors' own DSG attack.

Where does this leave the paper? The empirical rise-then-fall pattern may be a real phenomenon, and the framework could be useful if re-scoped to monitor training dynamics rather than attack potential. But as written, the load-bearing claim is empirically unsupported by the paper's own data. I would desk-reject this version. If the authors revise to drop the attack-potential claim and add proper I(X;G) grounding or independent attack validation across the whole training curve, it would be worth another look.

Referee Report

5 major / 4 minor

Summary. The paper proposes a proactive privacy risk measurement framework for gradient leakage. It introduces 'privacy tokens,' which are embedding vectors obtained by passing gradients through a trainable feature extractor (an autoencoder or a transformer). The framework then uses the Mutual Information Neural Estimator (MINE) to estimate the mutual information between intermediate-layer outputs of the monitored model (as data features) and these privacy tokens. The central claim is that the difference in estimated MI between matched and mismatched data-gradient pairs, denoted ΔI, is strongly correlated with the success of gradient-based reconstruction attacks, and therefore provides a real-time measure of attack potential without actually running attacks. Experiments on CIFAR-10 (LeNet, AlexNet) and CelebA-HQ (CNN, MLP) compare ΔI across training sub-epochs with DLG and DSG reconstruction attacks.

Significance. If the central claim were valid, the framework would fill a genuine gap: model trainers could continuously monitor gradient leakage during training, adjust DP noise adaptively, and avoid the cost and incompleteness of post-hoc attack simulations. The paper's use of a theoretically grounded MI estimator (MINE with the Donsker-Varadhan lower bound) and its evaluation on multiple architectures and two datasets are strengths. However, the significance is undermined by a fundamental mismatch between the quantity estimated and the quantity claimed, by a direct empirical contradiction in Table 1, and by a potential circularity in the training of the feature extractor and the MI estimator. These issues are load-bearing for the paper's main contribution.

major comments (5)

[Section 3.2, Eq. (4)] The Donsker-Varadhan lower bound is applied to the mutual information between intermediate-layer outputs f(X) and learned gradient embeddings Emb(G), not to I(X;G) as claimed in Section 3.1. The paper explicitly states in Section 3.2 that it cannot directly use the original training data and gradients. Unless f and Emb are shown to be sufficient statistics for the privacy-relevant information, the estimated ΔI is not a lower bound on the true leakage I(X;G) and cannot support the claim of measuring 'the extent of private information leakage from training data.' Provide theoretical or empirical evidence that the chosen intermediate features and gradient embeddings preserve privacy-relevant information, or reframe the claim as applying to the embedding-level MI only.
[Table 1, sub-epoch 0 rows] In every model, the sub-epoch 0 row has the lowest (or near-lowest) ΔI yet near-perfect reconstruction quality: LeNet ΔI=0.03288 with SSIM=0.9990, CNN ΔI=0.00033 with SSIM=0.99999, and MLP ΔI=5.83e-4 with SSIM=0.999996. This is the opposite of the claimed 'strong correlation' between ΔI and attack performance. The third bullet of Section 4.2.2 concedes that early-stage gradients are easier to exploit despite the increasing ΔI, attributing this to random initialization. Since the paper itself identifies early stages as the most privacy-sensitive, the metric fails in precisely the regime where it matters most. Report a correlation coefficient (e.g., Spearman rank correlation) over all checkpoints and explicitly discuss this non-monotonicity.
[Algorithm 1, Section 4.2.1] The MINE network and the gradient feature extractor are trained on data-gradient pairs collected during the same training run that is later used to compute the reported ΔI values. If the evaluation batches overlap with the training batches for the MINE network, the reported mutual information differences may reflect overfitting of the estimator to specific batches rather than intrinsic properties of the gradients. Moreover, the gradient extractor is optimized jointly with the MINE loss (Section 3.3 and Appendix A), so the estimated MI is maximized over the choice of embedding. The paper should specify the exact train/evaluation split and, if the same batches are used, provide validation on held-out batches or otherwise rule out this circularity.
[Section 4.2.2, Table 1] The paper claims that ΔI is 'strongly correlated' with attack performance, but no quantitative measure of correlation is given. Visual inspection of Table 1 reveals non-monotonic relationships: for LeNet, the highest ΔI (sub-epoch 60) does not correspond to the best attack quality, and for CNN, sub-epoch 20 has a high ΔI (1.66) but worse PSNR than sub-epoch 0 despite the much larger ΔI. The assertion that 'as the mutual information difference decreases, the quality of the reconstructed data deteriorates' is contradicted by the sub-epoch 0 rows. Provide a quantified analysis (e.g., rank correlation across all rows) and address the exceptions; otherwise the central claim of Section 4.2.2 is not supported by the presented evidence.
[Section 3.3, Appendix A, Table 1] The MINE estimates are reported without error bars, confidence intervals, or significance tests. Values such as 0.00033 (CNN sub-epoch 0) and -0.00633 (the corresponding Transformer-based estimate) are within the typical noise of MINE estimates, making it unclear whether ΔI is distinguishable from zero in early training. Since the paper's conclusions about the early-training regime depend on the relative magnitudes of these small numbers, report standard deviations over batches or bootstrap confidence intervals. Without this, the claim that ΔI is consistently positive except at initialization is not established.

minor comments (4)

[Abstract and throughout] The term 'dismatched pairs' should be 'mismatched pairs'; multiple typographical errors appear throughout the text (e.g., 'F or' in Lemma 3.2).
[Table 1] The table formatting is inconsistent and at times unreadable, with LPIPS and PSNR values run together (e.g., '15.1052361 dB2.7979574e-06'). Use proper column separation and consistent units.
[Section 4.1] CIFAR-10 is commonly 32×32; the paper states 64×64 pixels. If images were resized, please state the resizing procedure; if 64×64 is a typo, correct it.
[References] Several references have incomplete or inconsistent formatting (e.g., missing page ranges, inconsistent 'pp.' usage). Please unify the bibliography style.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the MI estimate is a standard MINE/Donsker-Varadhan quantity and is validated against an external DLG attack; the self-cited DSG benchmark and the admitted early-epoch mismatch are validation weaknesses, not definitional reductions.

full rationale

The paper's derivation chain does not reduce to its own inputs. The central measure, ΔI = I(X;G) − I(X;G′), is computed by training a MINE network on matched and mismatched data-gradient pairs, which is a standard neural MI-estimation procedure and is not fitted to attack outcomes. The privacy token is a learned gradient embedding, but the paper never defines attack success in terms of that token by construction; instead, the claim that ΔI tracks attack potential is tested against DLG on CIFAR-10, an external attack from Zhu et al. (2019). The CelebA-HQ validation uses the authors' own DSG attack from Huang et al. (2024b), but that is a concrete published reconstruction algorithm used as a benchmark, not a uniqueness theorem or an unverified premise that forces the paper's conclusion, so it is a citation-choice concern rather than a circular reduction. The paper itself flags the most serious empirical problem in Section 4.2.2: at sub-epoch 0, ΔI is near zero while reconstruction quality is near perfect, contradicting the claimed strong correlation. That is an acknowledged correctness limitation, not a circularity, because it does not show that ΔI is defined in terms of the attack metric or that the prediction is forced by the fitted inputs. The intermediate-layer substitution (using model activations rather than raw data) is an explicit assumption, not a hidden equivalence. Overall, the claimed contribution has independent empirical and theoretical content, so no circular step is present.

Assumptions & free parameters 4 free parameters · 5 assumptions · 1 invented entities

The central claim rests on the assumption that learned embeddings of data and gradients preserve privacy-relevant information, on the validity of the DV/MINE lower bound, and on the interpretation of the matched-minus-mismatched MI difference as attack capability. Several hand-chosen architectural dimensions (embedding sizes, latent dimension, transformer hyperparameters) affect the estimates. The privacy token is an invented construct with no independent evidence.

free parameters (4)

Autoencoder latent dimension
The autoencoder compresses gradients into a lower-dimensional latent space but the exact dimension is not reported in Appendix A; the MI estimates depend on this capacity.
Embedding dimensions (image and gradient, 128-d; composite 256-d) = 128 / 256
Chosen by hand for the MINE network; affects the MI estimates.
Transformer encoder dimensions (MLP output 512, heads 8, FFN 2048, dropout 0.1) = 512 / 8 / 2048 / 0.1
Hand-picked hyperparameters for the transformer-based privacy token; no sensitivity analysis.
Selected intermediate layers for data features = e.g., last three conv layers for AlexNet
Which layer outputs are used as data features is a choice that changes the MI estimate; motivated by the authors' own prior work (Huang et al. 2024a).

assumptions (5)

standard math Donsker-Varadhan representation provides a valid lower bound on KL divergence, and MINE training converges to the optimum Ttheta.
Invoked in Lemma 3.2 and Equation 4; standard, but the neural approximation of the supremum is assumed in practice.
ad hoc to paper Intermediate-layer outputs of the monitored model are sufficient feature representations of the raw training data for MI estimation.
Section 3.2 states deep learning models inherently function as feature extractors and uses intermediate outputs as data features without justification that all privacy-relevant information is retained.
ad hoc to paper The gradient feature extractor (autoencoder or transformer) preserves privacy-relevant information in the privacy token.
The central claim relies on the token capturing the information that gradients reveal about data; no reconstruction bound or loss term ensures this beyond the MINE objective.
domain assumption Mismatched data-gradient pairs formed by shuffling gradients across batches approximate the product-of-marginals distribution for MI estimation.
Algorithm 1 constructs Dneg by shuffling gradients; this assumes batch-independence and ignores possible cross-batch dependencies.
ad hoc to paper The mutual information difference between matched and mismatched pairs is monotonically related to attack success.
Section 4.2.2 assumes this relationship to interpret results; the early-stage reconstruction success contradicts a simple monotonic relation.

invented entities (1)

Privacy token
purpose: A learned embedding of gradients used as input to MINE to estimate mutual information with data features.
The privacy token is a new construct introduced in Definition 3.1; it has no external benchmark. Its usefulness is the very claim being tested, and the paper provides only in-paper experiments.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Real-Time Privacy Risk Measurement with Privacy Tokens for Gradient Leakage." pith.science (2026). https://pith.science/paper/73LKP5KY

@misc{pith2026250202913,
  author       = {Pith},
  title        = {Pith review of: Real-Time Privacy Risk Measurement with Privacy Tokens for Gradient Leakage},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/73LKP5KY}},
  note         = {Machine review of arXiv:2502.02913}
}

read the original abstract

The widespread deployment of deep learning models in privacy-sensitive domains has amplified concerns regarding privacy risks, particularly those stemming from gradient leakage during training. Current privacy assessments primarily rely on post-training attack simulations. However, these methods are inherently reactive, unable to encompass all potential attack scenarios, and often based on idealized adversarial assumptions. These limitations underscore the need for proactive approaches to privacy risk assessment during the training process. To address this gap, we propose the concept of privacy tokens, which are derived directly from private gradients during training. Privacy tokens encapsulate gradient features and, when combined with data features, offer valuable insights into the extent of private information leakage from training data, enabling real-time measurement of privacy risks without relying on adversarial attack simulations. Additionally, we employ Mutual Information (MI) as a robust metric to quantify the relationship between training data and gradients, providing precise and continuous assessments of privacy leakage throughout the training process. Extensive experiments validate our framework, demonstrating the effectiveness of privacy tokens and MI in identifying and quantifying privacy risks. This proactive approach marks a significant advancement in privacy monitoring, promoting the safer deployment of deep learning models in sensitive applications.

Figures

Figures reproduced from arXiv: 2502.02913 by the authors.

**Figure 1.** MINE Networks. MINE network enables efficient and accurate estimation of mutual information between training data and gradients, contributing to a detailed analysis of gradient leakage. 3.3. Mutual Information Estimation (MIE) Algorithm To adapt MINE for estimating mutual information between the training data X and gradients G, we propose Algorithm 1 consisting of three key components: Gradient Collection and Model … view at source ↗

**Figure 2.** Attack Results on CelebA-HQ (CNN). Sub-Epoch 0 Sub-Epoch 20 Sub-Epoch 50 Sub-Epoch 100 Target Image [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

**Figure 3.** Attack Results on CelebA-HQ (MLP). • First, as the mutual information difference decreases, the quality of the reconstructed data deteriorates, as reflected by the metrics. This suggests that the mutual information difference computed by our method is strongly correlated with attack performance. This correlation is logical, as the mutual information difference reflects the difficulty of distinguishing between match… view at source ↗

Figures from the paper (16 more)

**Figure 4.** Figure 4: Mutual information estimation on LeNet (CIFAR-10). 12 [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]

**Figure 5.** Figure 5: Mutual information estimation on AlexNet (CIFAR-10). 13 [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

**Figure 6.** Figure 6: Mutual information estimation on CNN (CelebA-HQ). 14 [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]

**Figure 7.** Figure 7: Mutual information estimation on MLP (CelebA-HQ). 15 [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]

**Figure 8.** Figure 8: Mutual Information Differences Estimation on LeNet (CIFAR-10). (a) Autoencoder (b) Transformer [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]

**Figure 9.** Figure 9: Mutual Information Differences Estimation on AlexNet (CIFAR-10). (a) Autoencoder (b) Transformer [PITH_FULL_IMAGE:figures/full_fig_p016_9.png]

**Figure 10.** Figure 10: Mutual Information Differences Estimation on CNN (CelebA-HQ). 16 [PITH_FULL_IMAGE:figures/full_fig_p016_10.png]

**Figure 11.** Figure 11: Mutual Information Differences Estimation on MLP (CelebA-HQ). (a) Autoencoder (b) Transformer [PITH_FULL_IMAGE:figures/full_fig_p017_11.png]

**Figure 12.** Figure 12: Average Mutual Information Differences Trends on LeNet (CIFAR-10). (a) Autoencoder (b) Transformer [PITH_FULL_IMAGE:figures/full_fig_p017_12.png]

**Figure 13.** Figure 13: Average Mutual Information Differences Trends on AlexNet (CIFAR-10). 17 [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]

**Figure 14.** Figure 14: Average Mutual Information Differences Trends on CNN (CelebA-HQ). (a) Autoencoder (b) Transformer [PITH_FULL_IMAGE:figures/full_fig_p018_14.png]

**Figure 15.** Figure 15: Average Mutual Information Differences Trends on MLP (CelebA-HQ). C. Ablation Study The purpose of the ablation study is grounded in the hypothesis that varying batch sizes may influence model performance. The batch size during training significantly affects the model…

**Figure 16.** Figure 16: Relationship between Mutual Information Difference and Batch Size on LeNet (CIFAR-10). 19 [PITH_FULL_IMAGE:figures/full_fig_p019_16.png]

**Figure 17.** Figure 17: Relationship between Mutual Information Difference and Batch Size on AlexNet (CIFAR-10). (a) Autoencoder (b) Transformer [PITH_FULL_IMAGE:figures/full_fig_p020_17.png]

**Figure 18.** Figure 18: Relationship between Mutual Information Difference and Batch Size on CNN (CelebA-HQ). (a) Autoencoder (b) Transformer [PITH_FULL_IMAGE:figures/full_fig_p020_18.png]

**Figure 19.** Figure 19: Relationship between Mutual Information Difference and Batch Size on MLP (CelebA-HQ). 20 [PITH_FULL_IMAGE:figures/full_fig_p020_19.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

16 extracted references · 11 canonical work pages

[1]

B., Mironov, I., Talwar, K., and Zhang, L

Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308–318,

work page 2016
[9]

Comprehen- sive privacy analysis of deep learning

Nasr, M., Shokri, R., and Houmansadr, A. Comprehen- sive privacy analysis of deep learning. In Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), volume 2018, pp. 1–15,

work page 2019
[10]

Improving deep learning with dif- ferential privacy using gradient encoding and denoising

Nasr, M., Shokri, R., et al. Improving deep learning with dif- ferential privacy using gradient encoding and denoising. arXiv preprint arXiv:2007.11524,

arXiv 2007
[12]

Mem- bership inference attacks against machine learning mod- els

Shokri, R., Stronati, M., Song, C., and Shmatikov, V . Mem- bership inference attacks against machine learning mod- els. In 2017 IEEE symposium on security and privacy (SP), pp. 3–18. IEEE,

work page 2017
[14]

Variational model inversion attacks

Wang, K.-C., Fu, Y ., Li, K., Khisti, A., Zemel, R., and Makhzani, A. Variational model inversion attacks. Advances in Neural Information Processing Systems, 34: 9706–9719, 2021a. Wang, S., Li, Y ., Zhao, A., and Wang, Q. Privacy protection in federated learning based on differential privacy and mu- tual information. In 2021 3rd International Conference o...

work page 2021
[20]

Settings of MINE Network

The initial learning rate of the Adam optimizer is set to 1 × 10−4, which is reduced by a factor of 0.9 every 10 sub-epochs using the StepLR scheduler. Settings of MINE Network. For the original data, we utilize the outputs from the intermediate layers of the monitored model as its features, as detailed in Section 4.1. For the gradients, two feature extra...

work page
[2015]

Detecting adversarial examples on deep neural networks with mutual information neural esti- mation

Gao, S., Wang, R., Wang, X., Yu, S., Dong, Y ., Yao, S., and Zhou, W. Detecting adversarial examples on deep neural networks with mutual information neural esti- mation. IEEE Transactions on Dependable and Secure Computing, 20(6):5168–5181, 2023a. Gao, W., Zhang, X., Guo, S., Zhang, T., Xiang, T., Qiu, H., Wen, Y ., and Liu, Y . Automatic transformation s...

work page 1901
[2016]

I., Baratin, A., Rajeswar, S., Ozair, S., Bengio, Y ., Courville, A., and Hjelm, R

Belghazi, M. I., Baratin, A., Rajeswar, S., Ozair, S., Bengio, Y ., Courville, A., and Hjelm, R. D. Mine: mutual informa- tion neural estimation. arXiv preprint arXiv:1801.04062,

arXiv

Show all 16 references

[2017]

E., Yu, L., and Wei, W

Truex, S., Liu, L., Gursoy, M. E., Yu, L., and Wei, W. Demystifying membership inference attacks in machine learning as a service. IEEE transactions on services computing, 14(6):2073–2089,
[2018]

A., Tramer, F., Carlini, N., and Paper- not, N

Choquette-Choo, C. A., Tramer, F., Carlini, N., and Paper- not, N. Label-only membership inference attacks. In International conference on machine learning, pp. 1964–

1964
[2019]

Adversarial ma- chine learning at scale

Kurakin, A., Goodfellow, I., and Bengio, S. Adversarial ma- chine learning at scale. arXiv preprint arXiv:1611.01236,

arXiv
[2020]

V ., Krpalkova, L., Riordan, D., and Walsh, J

O’Mahony, N., Campbell, S., Carvalho, A., Harapanahalli, S., Hernandez, G. V ., Krpalkova, L., Riordan, D., and Walsh, J. Deep learning vs. traditional computer vision. In Advances in Computer Vision: Proceedings of the 2019 Computer Vision Conference (CVC), V olume1 1, pp. 12...

2019
[2021]

An image is worth 16x16 words: Trans- formers for image recognition at scale

Dosovitskiy, A. An image is worth 16x16 words: Trans- formers for image recognition at scale. arXiv preprint arXiv:2010.11929,

2010 arXiv
[2022]

Intermediate out- puts are more sensitive than you think

Huang, T., Huang, Q., and Meng, J. Intermediate out- puts are more sensitive than you think. arXiv preprint arXiv:2412.00696, 2024a. Huang, T., Meng, J., Chen, H., Zheng, G., Yang, X., Yi, X., and Wang, H. Gradient-guided conditional diffusion models for private image reconstr...

1912 arXiv
[2023]

and Kaafar, M

Farokhi, F. and Kaafar, M. A. Modelling and quantifying membership information leakage in machine learning. arXiv preprint arXiv:2001.10648,

2001 arXiv
[2024]

G., Zhao, C., Sun, Q., Tang, Y ., Qian, F., and Kurths, J

Zhang, C., Wang, J., Yen, G. G., Zhao, C., Sun, Q., Tang, Y ., Qian, F., and Kurths, J. When autonomous systems meet accuracy and transferability through ai: A survey. Patterns, 1(4), 2020a. Zhang, Y ., Jia, R., Pei, H., Wang, W., Li, B., and Song, D. The secret revealer: Gene...

2001 arXiv

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.

[1] [1]

B., Mironov, I., Talwar, K., and Zhang, L

Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308–318,

work page 2016

[2] [9]

Comprehen- sive privacy analysis of deep learning

Nasr, M., Shokri, R., and Houmansadr, A. Comprehen- sive privacy analysis of deep learning. In Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), volume 2018, pp. 1–15,

work page 2019

[3] [10]

Improving deep learning with dif- ferential privacy using gradient encoding and denoising

Nasr, M., Shokri, R., et al. Improving deep learning with dif- ferential privacy using gradient encoding and denoising. arXiv preprint arXiv:2007.11524,

arXiv 2007

[4] [12]

Mem- bership inference attacks against machine learning mod- els

Shokri, R., Stronati, M., Song, C., and Shmatikov, V . Mem- bership inference attacks against machine learning mod- els. In 2017 IEEE symposium on security and privacy (SP), pp. 3–18. IEEE,

work page 2017

[5] [14]

Variational model inversion attacks

Wang, K.-C., Fu, Y ., Li, K., Khisti, A., Zemel, R., and Makhzani, A. Variational model inversion attacks. Advances in Neural Information Processing Systems, 34: 9706–9719, 2021a. Wang, S., Li, Y ., Zhao, A., and Wang, Q. Privacy protection in federated learning based on differential privacy and mu- tual information. In 2021 3rd International Conference o...

work page 2021

[6] [20]

Settings of MINE Network

The initial learning rate of the Adam optimizer is set to 1 × 10−4, which is reduced by a factor of 0.9 every 10 sub-epochs using the StepLR scheduler. Settings of MINE Network. For the original data, we utilize the outputs from the intermediate layers of the monitored model as its features, as detailed in Section 4.1. For the gradients, two feature extra...

work page

[7] [2015]

Detecting adversarial examples on deep neural networks with mutual information neural esti- mation

Gao, S., Wang, R., Wang, X., Yu, S., Dong, Y ., Yao, S., and Zhou, W. Detecting adversarial examples on deep neural networks with mutual information neural esti- mation. IEEE Transactions on Dependable and Secure Computing, 20(6):5168–5181, 2023a. Gao, W., Zhang, X., Guo, S., Zhang, T., Xiang, T., Qiu, H., Wen, Y ., and Liu, Y . Automatic transformation s...

work page 1901

[8] [2016]

I., Baratin, A., Rajeswar, S., Ozair, S., Bengio, Y ., Courville, A., and Hjelm, R

Belghazi, M. I., Baratin, A., Rajeswar, S., Ozair, S., Bengio, Y ., Courville, A., and Hjelm, R. D. Mine: mutual informa- tion neural estimation. arXiv preprint arXiv:1801.04062,

arXiv