Pith. sign in

REVIEW 4 major objections 5 minor 57 references

Privacy-Utility Trade-off in Data Publication: A Bilevel Optimization Framework with Curvature-Guided Perturbation

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A bilevel optimization framework uses the extrinsic curvature of a learned data manifold to decide where to perturb samples, yielding published datasets that resist membership inference attacks while keeping high classification accuracy and

desk verdict New combination worth a second look, but the curvature-to-MIA link is asserted more than shown; conditional accept with a serious request for controls and seeds. read the letter →

arxiv 2509.02048 v1 pith:CVNH6P4K submitted 2025-09-02 cs.LG cs.AIcs.CR

Yi Yin , Guangquan Zhang , Hua Zuo , Jie Lu This is my paper
classification cs.LGcs.AIcs.CR
keywords dataprivacymembershipinferenceattackspublicationbileveloptimizationmanifoldcurvaturegeodesicperturbationRiemannianvariationalautoencoderprivacy-utilitytrade-off
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the enduring trade-off between privacy and utility in publishing sensitive datasets can be brokered by a bilevel optimization framework. The upper level, a discriminator-guided Riemannian variational autoencoder, preserves image fidelity and diversity for unknown downstream tasks; the lower level treats the extrinsic curvature of the learned data manifold as a per-sample measure of membership-inference vulnerability and pushes those samples along geodesics toward low-curvature regions, eroding the distinctive feature combinations that attackers exploit. If the claim is right, publishers could release datasets that resist membership inference at near-baseline rates without the quality collapse that noise-based methods such as differential privacy typically incur. Across ten datasets the authors report the best average balance among the compared methods: 53.11% attack success versus 60.65% for the original data, classification accuracy of 88.15%, and the lowest FID among privacy-preserving baselines.

What carries the argument

The load-bearing object is the pullback Riemannian metric of the RVAE, G(z) = Jμ(z)ᵀJμ(z) + Jσ(z)ᵀJσ(z), which makes the latent space a curved manifold. Extrinsic curvature is approximated by finite differences of the metric's eigenvalues, K(z) = ‖∇λ(G(z))‖, computed by a trainable regression estimator rather than expensive Hessians. The geodesic obfuscator interpolates along a cubic-spline geodesic from each latent sample toward its dominant radial-basis center, choosing the lowest-curvature point before the first high-curvature region, which keeps the sample's label intact. Alternating optimization closes the loop: the discriminator's decoder updates alter the pullback metric, changing the

What would settle it

A direct test: on a fresh dataset, compute each sample's extrinsic curvature, run a loss-based membership-inference attack, and measure the rank correlation between curvature and per-sample attack vulnerability; near-zero correlation would sever the lower-level objective from privacy. A sharper test randomizes the geodesic direction while keeping perturbation magnitude equal — if attack success stays as low as with low-curvature targeting, the privacy gain comes from interpolation regularization, not from curvature guidance itself.

Watch

Extended reading notes

Core claim

The paper's central claim is that local extrinsic curvature of the latent data manifold is a quantitative proxy for how exposed a sample is to membership inference, and that perturbing samples toward low-curvature regions along geodesics suppresses the distinctive feature combinations that make leakage possible. The framework couples two objectives: a discriminator-guided RVAE preserves fidelity and diversity, while a trainable curvature estimator feeds a geodesic obfuscator that selects, along the path from a sample to its main radial-basis center, the lowest-curvature point before reaching a high-curvature region. Because decoder updates change the pullback metric that defines curvature, t

Load-bearing premise

The load-bearing premise is that high extrinsic curvature of the learned data manifold reliably marks which samples a membership-inference attack would single out; the paper's own measurement of that link is a correlation of roughly 0.16, and the appendix derivation assumes rather than proves the connection.

Editorial extensions

If this is right

  • Data publishers could release datasets on which membership-inference success falls from 60.65% (original data) to a 53.11% average, while downstream classifiers keep about 88% accuracy.
  • Per-sample curvature acts as a risk map: the samples most likely to be memorized — rare, minority-class, or unusually styled ones — are the ones the perturbation moves.
  • The privacy gain holds precisely on a high-variance medical dataset (OCTMNIST) where differential-privacy baselines suffer severe utility loss, suggesting the geometry-based defense transfers better than noise-based ones.
  • Direction matters: interpolating toward low-curvature regions yields both lower MIA success (52.95%) and higher accuracy (96.57%) than linear interpolation or interpolation toward high-curvature regions, indicating geodesic guidance rather than generic interpolation drives the trade-off.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's own evidence for the curvature-vulnerability link is a correlation of 0.1636, so part of the privacy gain may come from geodesic interpolation's general regularizing effect rather than from heading toward low-curvature regions; an ablation with random-direction perturbations of matched magnitude would separate these explanations.
  • If curvature guidance is the operative mechanism, the framework implies a per-sample privacy risk score that could be layered onto differential privacy budgets — spending more noise on high-curvature points instead of injecting uniform noise.
  • The bilevel geometry template generalizes beyond RVAEs: any generative model exposing a tractable latent metric — normalizing flows or score-based models, for example — could host the same curvature estimator, provided the metric is cheap enough to evaluate at scale.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a bilevel optimization framework for privacy-preserving data publication. The upper-level objective trains an RVAE-GAN to maintain data utility, while the lower-level objective trains a curvature estimator that guides geodesic perturbations of latent variables toward low-curvature regions of the learned data manifold, under the premise that high-curvature samples are more vulnerable to membership inference attacks. Experiments on ten datasets compare the method with pixelation, blurring, k-anonymity, VAEGAN-DP, and DPDM, reporting the lowest average MIA success rate (53.11%), the highest average test accuracy among privacy-preserving baselines (88.15%), and the best average FID and IS. Appendix A provides a theoretical argument that large decoder-Hessian curvature amplifies loss variation and hence MIA vulnerability.

Significance. If the empirical claims hold, the work is a useful contribution to privacy-preserving data publishing: it demonstrates that manifold-geometry-guided perturbation can reduce MIA success while retaining downstream utility, and the comparison across ten datasets is broad. The paper also includes a helpful interpolation-strategy ablation (Table 2) and visualizations of geodesics. However, the central mechanistic claim is not yet supported by the internal evidence: the implemented curvature estimator is not the quantity analyzed in the appendix, and the only direct correlation reported (0.1636) is weak and uses a different proxy. The absence of multiple runs or error bars further limits the strength of the headline 'most stable / best trade-off' conclusions. The conceptual contribution of a bilevel privacy-utility formulation is also weakened by a mismatch between the formal problem and the implemented algorithm.

major comments (4)
  1. [Appendix A vs. §4.3.1, Eqs. (12)–(13)] The theoretical justification connects MIA vulnerability to the decoder Hessian H_decoder(z): Eqs. (23)–(27) conclude that loss variation scales with ||H_decoder(z)||^2. However, the implemented curvature estimate K(z) in Eqs. (12)–(13) is the norm of the finite-difference gradient of the eigenvalues of the pullback metric G(z)=J_mu^T J_mu + J_sigma^T J_sigma. This is a first-order variation of the Jacobian-derived metric, not the decoder second derivative. No derivation shows that ||∇λ(G(z))|| is monotonically related to ||H_decoder(z)|| or to standard extrinsic curvature. Since the geodesic selection rule in Eq. (15) minimizes K(z_i), the actual lower-level objective is not the quantity that Appendix A proves to be privacy-relevant. This is a load-bearing gap: if the proxy is unfaithful, the privacy gain could come from the geodesic interpolation itself rather than from curvature targe
  2. [§5.6] The only empirical evidence linking curvature to MIA vulnerability is a correlation of 0.1636 between an ISOMAP/local-covariance curvature proxy and MIA success, with average curvature values 0.0629 vs. 0.0554. This is a weak association, and the proxy is not the K(z) from Eq. (12) used in the method. The paper does not report how well the trained curvature estimator K̂(z) predicts per-sample vulnerability, nor does it show that the points selected by Eq. (15) are actually in low-leakage regions. Table 2 compares low- vs. high-curvature selection, which is helpful, but it does not control for other aspects of the perturbation (e.g., endpoint choice, geodesic distance). I recommend adding a control with random points along the geodesic or an untrained curvature estimator, and reporting the correlation between the implemented K(z) and per-sample attack success.
  3. [Table 1 and §5.1.3] All headline metrics appear to come from single runs with no reported variance or number of seeds. The paper claims the 'most stable privacy protection' (§5.3.1) and the best privacy-utility trade-off (§5.3.3), but the average MIA advantage over K-anonymity is only 1.53 percentage points (53.11% vs. 54.64%) and over DPDM 3.29 points. Given the stochasticity of GAN/VAE training and of MIA evaluation, these differences may not be significant. Please report means and standard deviations across multiple runs, and ideally paired significance tests, for at least the main comparison in Table 1.
  4. [§4.4, Eqs. (16)–(17)] The formal bilevel problem does not match the definition in Eq. (1). In Eqs. (16)–(17), the lower-level variable K̂ minimizes a regression loss L_curv for estimating the curvature, while the actual privacy perturbation δ(K̂) is a hand-designed selection rule (Eq. 15). This is not a lower-level optimization problem whose minimizer determines the perturbation; it is an alternating training scheme for a VAE-GAN and a regression network with a heuristic selection step. The authors should either reformulate the problem to make δ an explicit lower-level variable with a privacy objective, or soften the claim that the method is a bilevel optimization framework. The current formulation overstates the theoretical grounding.
minor comments (5)
  1. [§5.5] Typo: 'perfomances' should be 'performances'. Also, the notation 'VAE-GAN' and 'VAEGAN-DP' is used inconsistently across the text and Table 1.
  2. [§5.1.3 and §5.2.1] Several experimental details are missing: the number of RBF centers, the latent dimension for each dataset, the architecture and training protocol of the MIA attack model, and how the downstream classifier is trained for each baseline. These are needed for reproducibility.
  3. [§5.2.2] Using an ImageNet-pretrained Inception V3 to compute FID/IS on grayscale MNIST-style datasets after resizing and normalization is known to be unreliable for such out-of-distribution inputs. The paper should at least acknowledge this and, if possible, report an additional utility metric on the original image space.
  4. [Appendix A] The derivation relies on the conditions ∇L(x)≈0 and second-order term dominance, but these are not checked empirically and are not stated as assumptions in the main text. Also, Eq. (27) claims ΔL∝ε^4·||H_decoder||^2·||H_classifier||, but the transition from Eq. (26) to Eq. (27) should be justified more carefully, especially the power of ε and the role of the unit-perturbation assumption.
  5. [§4.1] The assumption that 'curvature does not vary significantly within the relevant domain' is stated but never validated. Since the curvature estimator is trained on finite-difference labels and then used to select points along geodesics, this assumption is important; please provide evidence or at least a sensitivity check.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the curvature objective is defined independently of MIA and the privacy evaluation is held-out; Appendix A / Section 5.6 weaknesses are evidentiary gaps, not definitional reductions.

full rationale

The paper's central claim is not circular. The lower-level objective (Eqs. 12-14) is a curvature estimate K(z)=||∇λ(G(z))|| computed from the RVAE pullback metric; this quantity is defined independently of MIA, and the curvature estimator is trained by MSE against this finite-difference target, not against attack outcomes or membership labels. The privacy evaluation (Section 5.2.1) uses a held-out black-box loss-based MIA from the adversarial-robustness-toolbox on a downstream classifier trained on the released data; no MIA signal enters the training objectives (Eqs. 5-11, 14, 16-17). The method is therefore self-contained against external benchmarks, and the privacy gain is not a fitted input renamed as a prediction. There are no load-bearing self-citations: RVAE, geodesic, DP, and MIA references are all external prior work, and no uniqueness theorem is imported from the authors. The curvature-vulnerability link is the weakest step: Appendix A derives ΔL ∝ ε^4 ||H_decoder||^2 ||H_classifier|| under assumptions (vanishing gradient, dominant second-order term) and identifies ||H_decoder|| with extrinsic curvature, while the implemented K(z) is a first-order variation of the pullback metric eigenvalues; and Section 5.6 reports only a 0.1636 correlation using a different ISOMAP/covariance proxy, not the actual K(z). This is an evidentiary gap, not a definitional reduction. The paper also lacks variance bars and multiple seeds, which is a significance concern, but does not make the derivation circular. Hence score 0.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several unproven or weakly supported assumptions: that the pullback metric of the RVAE approximates true manifold geometry, that finite-difference eigenvalue gradients approximate extrinsic curvature, and most importantly that high curvature marks MIA-vulnerable samples. The free parameters beta, lambda, epsilon, RBF count, and n are chosen without reported sensitivity analysis. No new physical entities are introduced.

free parameters (6)
  • beta (KL weight) = not reported
    KL divergence weight in sigma loss (Eq. 6); chosen by hand, no sweep reported.
  • lambda (gradient penalty weight) = not reported
    Gradient penalty weight in discriminator loss (Eq. 10).
  • epsilon (finite-difference step) = not reported
    Step size for curvature estimation via finite differences (Eq. 13).
  • Number of RBF centers = not reported
    Number of radial basis functions in RVAE sigma network; determines endpoints for geodesic perturbation.
  • n (geodesic sample count) = 20
    Number of sampled points along the geodesic (Sec. 5.1.3); an explicit hyperparameter.
  • Latent dimension = 10 (MNIST), 2 for visualization
    Latent dimensionality of RVAE; not specified for other datasets.
assumptions (5)
  • domain assumption RVAE's pullback metric faithfully captures the data manifold's geometry.
    Invoked in Sec. 3.2 and used to compute curvature; inherited from RVAE literature [3, 8, 21] without verification on these datasets.
  • ad hoc to paper Extrinsic curvature approximated by finite differences of eigenvalue gradients is a valid measure of MIA vulnerability.
    Central premise of Sec. 4.3 and Appendix A; the paper's own correlation is only 0.1636 (Sec. 5.6).
  • domain assumption Discriminator-guided RVAE-GAN training yields high-quality reconstructions under geodesic perturbation.
    Assumed in upper-level task (Sec. 4.2) and supported only by empirical results without theoretical guarantees.
  • domain assumption Alternating optimization converges to a meaningful bilevel optimum.
    Sec. 4.4 describes alternating updates but provides no convergence analysis; the bilevel objective (Eqs. 16-17) is not directly optimized.
  • ad hoc to paper Curvature does not vary significantly within the relevant domain, so a trained estimator suffices.
    Stated explicitly in Sec. 4.1; used to justify regressing curvature with a trained network rather than recomputing it at each point.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Privacy-Utility Trade-off in Data Publication: A Bilevel Optimization Framework with Curvature-Guided Perturbation." pith.science (2026). https://pith.science/paper/CVNH6P4K

@misc{pith2026250902048,
  author       = {Pith},
  title        = {Pith review of: Privacy-Utility Trade-off in Data Publication: A Bilevel Optimization Framework with Curvature-Guided Perturbation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CVNH6P4K}},
  note         = {Machine review of arXiv:2509.02048}
}
read the original abstract

Machine learning models require datasets for effective training, but directly sharing raw data poses significant privacy risk such as membership inference attacks (MIA). To mitigate the risk, privacy-preserving techniques such as data perturbation, generalization, and synthetic data generation are commonly utilized. However, these methods often degrade data accuracy, specificity, and diversity, limiting the performance of downstream tasks and thus reducing data utility. Therefore, striking an optimal balance between privacy preservation and data utility remains a critical challenge. To address this issue, we introduce a novel bilevel optimization framework for the publication of private datasets, where the upper-level task focuses on data utility and the lower-level task focuses on data privacy. In the upper-level task, a discriminator guides the generation process to ensure that perturbed latent variables are mapped to high-quality samples, maintaining fidelity for downstream tasks. In the lower-level task, our framework employs local extrinsic curvature on the data manifold as a quantitative measure of individual vulnerability to MIA, providing a geometric foundation for targeted privacy protection. By perturbing samples toward low-curvature regions, our method effectively suppresses distinctive feature combinations that are vulnerable to MIA. Through alternating optimization of both objectives, we achieve a synergistic balance between privacy and utility. Extensive experimental evaluations demonstrate that our method not only enhances resistance to MIA in downstream tasks but also surpasses existing methods in terms of sample quality and diversity.

Figures

Figures reproduced from arXiv: 2509.02048 by the authors.

Figure 1
Figure 1. Overview of the Framework: Experimental Pipeline and Our Proposed Model [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Coupling Process in Bilevel Optimization [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. Comparison of samples for different models and datasets(Left: MNIST, KMNIST, FMNIST, notMNIST, [PITH_FULL_IMAGE:figures/full_fig_p017_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Latent space and geodesic visualization (latent dim=2). [PITH_FULL_IMAGE:figures/full_fig_p018_4.png]
Figure 5
Figure 5. Figure 5: Visualization of geodesic and sample distributions. [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]
Figure 6
Figure 6. Figure 6: Comparison of samples for different interpolation strategies for MNIST. [PITH_FULL_IMAGE:figures/full_fig_p020_6.png]
Figure 7
Figure 7. Figure 7: Distribution of extrinsic curvature for successful and failed MIA samples [PITH_FULL_IMAGE:figures/full_fig_p021_7.png]
Figure 8
Figure 8. Figure 8: Vulnerable and Invulnerable MNIST Samples [PITH_FULL_IMAGE:figures/full_fig_p021_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

57 extracted references · 41 canonical work pages

  1. [1]

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 308–318

    2016

  2. [2]

    Amit Amola. 2020. Mathematics Symbols Data. Online. https://www.kaggle.com/datasets/amitamola/mathematics- symbols-data Accessed: Oct. 22, 2024

    work page 2020

  3. [3]

    Georgios Arvanitidis, Lars Kai Hansen, and Søren Hauberg. 2017. Latent space oddity: on the curvature of deep generative models. arXiv preprint arXiv:1710.11379 (2017)

    arXiv 2017

  4. [4]

    James Bennett and Stan Lanning. 2007. The netflix prize. (2007)

    work page 2007

  5. [5]

    Jason W Bentley, Daniel Gibney, Gary Hoppenworth, and Sumit Kumar Jha. 2020. Quantifying membership inference vulnerability via generalization gap and other model metrics. arXiv preprint arXiv:2009.05669 (2020)

    arXiv 2020

  6. [6]

    Yaroslav Bulatov. [n. d.]. notMNIST dataset. Online. http://yaroslavvb.com/upload/notMNIST/ Accessed: Oct. 14, 2024

    work page 2024

  7. [7]

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. 2022. Membership inference attacks from first principles. In 2022 IEEE symposium on security and privacy (SP) . IEEE, 1897–1914

    work page 2022

  8. [8]

    Clément Chadebec and Stéphanie Allassonnière. 2022. A geometric perspective on variational autoencoders. Advances in Neural Information Processing Systems 35 (2022), 19618–19630

    work page 2022

Show all 57 references
  1. [9]

    Dingfan Chen, Tribhuvanesh Orekondy, and Mario Fritz. 2020. Gs-wgan: A gradient-sanitized approach for learning differentially private generators. Advances in Neural Information Processing Systems 33 (2020), 12673–12684

    2020

  2. [10]

    Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. 2021. Label-only membership inference attacks. In International conference on machine learning . PMLR, 1964–1974

    2021

  3. [11]

    Tarin Clanuwat, Mateusz Bober-Irizar, Asanobu Kitamoto, Alex Lamb, Kazuaki Yamamoto, and David Ha. 2018. Deep Learning for Classical Japanese Literature. arXiv abs/1812.01718 (2018). https://arxiv.org/abs/1812.01718 Accessed: Oct. 10, 2024

    2018 arXiv

  4. [12]

    Tim Dockhorn, Tianshi Cao, Arash Vahdat, and Karsten Kreis. 2022. Differentially private diffusion models. arXiv preprint arXiv:2210.09929 (2022)

    2022 arXiv

  5. [13]

    Vasisht Duddu, Sebastian Szyller, and N Asokan. 2021. SHAPr: An efficient and versatile membership privacy risk metric for machine learning. arXiv preprint arXiv:2112.02230 (2021)

    2021 arXiv

  6. [14]

    Alhussein Fawzi, Seyed-Mohsen Moosavi-Dezfooli, Pascal Frossard, and Stefano Soatto. 2018. Empirical study of the topology and geometry of deep networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 3762–3770

    2018

  7. [15]

    Chelsea Finn, Pieter Abbeel, and Sergey Levine. 2017. Model-agnostic meta-learning for fast adaptation of deep networks. In International conference on machine learning . PMLR, 1126–1135

    2017

  8. [16]

    Benedikt Groß and Gerhard Wunder. 2023. Differentially private synthetic data generation via lipschitz-regularised variational autoencoders. In 2023 IEEE Smart World Congress (SWC) . IEEE, 1–8

    2023

  9. [17]

    Ralph Gross, Latanya Sweeney, Jeffrey Cohn, Fernando De la Torre, and Simon Baker. 2009. Face de-identification. Protecting privacy in video surveillance (2009), 129–146

    2009

  10. [18]

    Yuzheng Hu, Fan Wu, Qinbin Li, Yunhui Long, Gonzalo Munilla Garrido, Chang Ge, Bolin Ding, David Forsyth, Bo Li, and Dawn Song. 2024. Sok: Privacy-preserving data synthesis. In 2024 IEEE Symposium on Security and Privacy (SP) . IEEE, 4696–4713

    2024

  11. [19]

    Bo Hui, Yuchen Yang, Haolin Yuan, Philippe Burlina, Neil Zhenqiang Gong, and Yinzhi Cao. 2021. Practical blind membership inference attack via differential comparisons. arXiv preprint arXiv:2101.01341 (2021)

    2021 arXiv

  12. [20]

    James Jordon, Jinsung Yoon, and Mihaela Van Der Schaar. 2018. PATE-GAN: Generating synthetic data with differential privacy guarantees. In International conference on learning representations

    2018

  13. [21]

    Dimitris Kalatzis, David Eklund, Georgios Arvanitidis, and Søren Hauberg. 2020. Variational autoencoders with riemannian brownian motion priors. arXiv preprint arXiv:2002.05227 (2020). , Vol. 1, No. 1, Article . Publication date: September 2025. Privacy-Utility Trade-off in Da...

    2020 arXiv

  14. [22]

    Ilya Kaufman and Omri Azencot. 2023. Data representations’ study of latent image manifolds. In International Conference on Machine Learning . PMLR, 15928–15945

    2023

  15. [23]

    Piyush Kaul and Brejesh Lall. 2019. Riemannian curvature of deep neural networks. IEEE transactions on neural networks and learning systems 31, 4 (2019), 1410–1416

    2019

  16. [24]

    Diederik P Kingma, Max Welling, et al. 2013. Auto-encoding variational bayes

    2013

  17. [25]

    Neeraj Kumar. 2021. ADNI_Extracted_Axial. Online. https://www.kaggle.com/ds/1830702 DOI: 10.34740/KAG- GLE/DS/1830702

    2021

  18. [26]

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. 1998. Gradient-based learning applied to document recognition. Proc. IEEE 86, 11 (1998), 2278–2324

    1998

  19. [27]

    Jiacheng Li, Ninghui Li, and Bruno Ribeiro. 2021. Membership inference attacks and defenses in classification models. In Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy . 5–16

    2021

  20. [28]

    Ninghui Li, Tiancheng Li, and Suresh Venkatasubramanian. 2006. t-closeness: Privacy beyond k-anonymity and l-diversity. In 2007 IEEE 23rd international conference on data engineering . IEEE, 106–115

    2006

  21. [29]

    Ashwin Machanavajjhala, Daniel Kifer, Johannes Gehrke, and Muthuramakrishnan Venkitasubramaniam. 2007. l- diversity: Privacy beyond k-anonymity. Acm transactions on knowledge discovery from data (tkdd) 1, 1 (2007), 3–es

    2007

  22. [30]

    Laurent Matthey, Irina Higgins, Demis Hassabis, and Alexander Lerchner. 2017. dSprites: Disentanglement testing Sprites dataset. Online. https://github.com/deepmind/dsprites-dataset/

    2017

  23. [31]

    Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP). IEEE, 739–753

    2019

  24. [32]

    Mihai-Iulian Nicolae, Matthias Sinn, Minh-Nhut Tran, Beat Buesser, Anupam Rawat, Martin Wistuba, Valerio Zant- edeschi, Nathalie Baracaldo, Bryan Chen, Hans Ludwig, Ian Molloy, and Benjamin Edwards. 2018. Adversarial Robustness Toolbox v1.2.0. CoRR abs/1807.01069 (2018). arXiv...

    2018 arXiv

  25. [33]

    Opacus. [n. d.]. Opacus Privacy Engine. Online. https://opacus.ai/api/privacy_engine.html Accessed: Oct. 22, 2024

    2024

  26. [34]

    V. U. Prabhu. 2019. Kannada-MNIST: A new handwritten digits dataset for the Kannada language. arXiv preprint (2019). arXiv:1908.01242 [cs.CV]

    2019 arXiv

  27. [35]

    Deepak Ravikumar, Efstathia Soufleri, and Kaushik Roy. 2024. Curvature clues: Decoding deep learning privacy with input loss curvature. arXiv preprint arXiv:2407.02747 (2024)

    2024 arXiv

  28. [36]

    Travers Rhodes, Tapomayukh Bhattacharjee, and Daniel D Lee. 2022. Learning from Demonstration using a Curvature Regularized Variational Auto-Encoder (CurvVAE). In2022 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE, 10795–10800

    2022

  29. [37]

    Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2018. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246 (2018)

    2018 arXiv

  30. [38]

    Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. 2016. Improved techniques for training gans. Advances in neural information processing systems 29 (2016)

    2016

  31. [39]

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP) . IEEE, 3–18

    2017

  32. [40]

    Congzheng Song and Reza Shokri. 2020. Membership encoding for deep learning. In Proceedings of the 15th ACM Asia Conference on Computer and Communications Security . 344–356

    2020

  33. [41]

    Liwei Song and Prateek Mittal. 2021. Systematic evaluation of privacy risks of machine learning models. In 30th USENIX Security Symposium (USENIX Security 21) . 2615–2632

    2021

  34. [42]

    Liwei Song, Reza Shokri, and Prateek Mittal. 2019. Privacy risks of securing machine learning models against adversarial examples. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security . 241–257

    2019

  35. [43]

    Łukasz Struski, Michał Sadowski, Tomasz Danel, Jacek Tabor, and Igor T Podolak. 2023. Feature-based interpolation and geodesics in the latent spaces of generative models. IEEE Transactions on Neural Networks and Learning Systems (2023)

    2023

  36. [44]

    Latanya Sweeney. 2002. k-anonymity: A model for protecting privacy. International journal of uncertainty, fuzziness and knowledge-based systems 10, 05 (2002), 557–570

    2002

  37. [45]

    Stas Syrota, Pablo Moreno-Munoz, and Søren Hauberg. 2024. Decoder ensembling for learned latent geometries. arXiv preprint arXiv:2408.07507 (2024)

    2024 arXiv

  38. [46]

    Stacey Truex, Ling Liu, Mehmet Emre Gursoy, Wenqi Wei, and Lei Yu. 2019. Effects of differential privacy and data skewness on membership inference vulnerability. In 2019 First IEEE international conference on trust, privacy and security in intelligent systems and applications ...

    2019

  39. [47]

    Vikas Verma, Alex Lamb, Christopher Beckham, Amir Najafi, Ioannis Mitliagkas, David Lopez-Paz, and Yoshua Bengio

  40. [48]

    Nishant Vishwamitra, Bart Knijnenburg, Hongxin Hu, Yifang P Kelly Caine, et al. 2017. Blur vs. block: Investigating the effectiveness of privacy-enhancing obfuscation for images. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops . 39–47

    2017

  41. [49]

    Sonja Wogrin, Salvador Pineda, and Diego A Tejada-Arango. 2020. Applications of bilevel optimization in energy and electricity markets. In Bilevel Optimization: Advances and Next Challenges . Springer, 139–168

    2020

  42. [50]

    D. J. Wu, A. C. Yang, and V. U. Prabhu. 2020. Afro-MNIST: Synthetic generation of MNIST-style datasets for low-resource languages. arXiv preprint (2020). arXiv:2009.13509 [cs.CV]

    2020 arXiv

  43. [51]

    Han Xiao, Kashif Rasul, and Roland Vollgraf. 2017. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747 (2017)

    2017 arXiv

  44. [52]

    Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. 2018. Differentially private generative adversarial network. arXiv preprint arXiv:1802.06739 (2018)

    2018 arXiv

  45. [53]

    Jiancheng Yang, Rui Shi, Donglai Wei, Ziyue He, Guangrui Mu, Yifan Bian, Jiancheng Wu, Lin Sun, Xiaoping Kong, Guangrui Xie, et al . 2023. MedMNIST v2: A Large-Scale Lightweight Benchmark for 2D and 3D Medical Image Classification. Scientific Data 10, 1 (2023), 249

    2023

  46. [54]

    Jinsung Yoon, Lydia N Drumright, and Mihaela Van Der Schaar. 2020. Anonymization through data synthesis using generative adversarial networks (ADS-GAN). IEEE journal of biomedical and health informatics 24, 8 (2020), 2378–2388

    2020

  47. [55]

    Tao Yu, Huan Long, and John E Hopcroft. 2018. Curvature-based comparison of two neural networks. In 2018 24th International Conference on Pattern Recognition (ICPR) . IEEE, 441–447

    2018

  48. [56]

    Jun Zhang, Graham Cormode, Cecilia M Procopiuc, Divesh Srivastava, and Xiaokui Xiao. 2017. Privbayes: Private data release via bayesian networks. ACM Transactions on Database Systems (TODS) 42, 4 (2017), 1–41. Appendix A Mathematical Analysis of High-Curvature Data Manifold Re...

    2017

  49. [2019]

    In International conference on machine learning

    Manifold mixup: Better representations by interpolating hidden states. In International conference on machine learning. PMLR, 6438–6447. , Vol. 1, No. 1, Article . Publication date: September 2025. 24 Yi Yin, Guangquan Zhang, Hua Zuo, and Jie Lu

    2025

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.