{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2020:ITBOXBB75VIKINXHLUHTPV3Y5G","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b45107f13c9b11993374872304dec8cf066b2498c2a23f0e40f2bbbf868f77d7","cross_cats_sorted":["stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2020-07-21T02:21:10Z","title_canon_sha256":"0edeb447e2c07fac2c52f85a07535acb8f8fe949c9bde413d5a9fdc9dae2150d"},"schema_version":"1.0","source":{"id":"2007.10567","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2007.10567","created_at":"2026-07-05T02:18:29Z"},{"alias_kind":"arxiv_version","alias_value":"2007.10567v3","created_at":"2026-07-05T02:18:29Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2007.10567","created_at":"2026-07-05T02:18:29Z"},{"alias_kind":"pith_short_12","alias_value":"ITBOXBB75VIK","created_at":"2026-07-05T02:18:29Z"},{"alias_kind":"pith_short_16","alias_value":"ITBOXBB75VIKINXH","created_at":"2026-07-05T02:18:29Z"},{"alias_kind":"pith_short_8","alias_value":"ITBOXBB7","created_at":"2026-07-05T02:18:29Z"}],"graph_snapshots":[{"event_id":"sha256:046dd13f70b09fa84e25a4d57a1ea0bd3c66e72d486ada4ae9cfe60058c196f1","target":"graph","created_at":"2026-07-05T02:18:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2007.10567/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"It is observed in the literature that data augmentation can significantly mitigate membership inference (MI) attack. However, in this work, we challenge this observation by proposing new MI attacks to utilize the information of augmented data. MI attack is widely used to measure the model's information leakage of the training set. We establish the optimal membership inference when the model is trained with augmented data, which inspires us to formulate the MI attack as a set classification problem, i.e., classifying a set of augmented instances instead of a single data point, and design input ","authors_text":"Da Yu, Huishuai Zhang, Jian Yin, Tie-Yan Liu, Wei Chen","cross_cats":["stat.ML"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2020-07-21T02:21:10Z","title":"How Does Data Augmentation Affect Privacy in Machine Learning?"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2007.10567","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:cbaba5d0539a52fc60b0b8acb3ad07922634627700f32b09c137880f0d8923f4","target":"record","created_at":"2026-07-05T02:18:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b45107f13c9b11993374872304dec8cf066b2498c2a23f0e40f2bbbf868f77d7","cross_cats_sorted":["stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2020-07-21T02:21:10Z","title_canon_sha256":"0edeb447e2c07fac2c52f85a07535acb8f8fe949c9bde413d5a9fdc9dae2150d"},"schema_version":"1.0","source":{"id":"2007.10567","kind":"arxiv","version":3}},"canonical_sha256":"44c2eb843fed50a436e75d0f37d778e9a429dbd14d5d0af2dfeba1c980299d59","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"44c2eb843fed50a436e75d0f37d778e9a429dbd14d5d0af2dfeba1c980299d59","first_computed_at":"2026-07-05T02:18:29.799184Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:18:29.799184Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"91bJW+R3dARH/yTXjWT9SjJWFJNdSpAKT0/2VqoSKxzce/cfgRIL/FspJkVxlx5+IJblzoUi/+ZKU9hqj44XBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T02:18:29.799628Z","signed_message":"canonical_sha256_bytes"},"source_id":"2007.10567","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:cbaba5d0539a52fc60b0b8acb3ad07922634627700f32b09c137880f0d8923f4","sha256:046dd13f70b09fa84e25a4d57a1ea0bd3c66e72d486ada4ae9cfe60058c196f1"],"state_sha256":"a7104f0add6e7c35c0f83d62362a2ae8b9c47a20e2548d5dce193e45adc2b7d3"}