arXiv:2608. 13773v1 Announce Type: cross Abstract: Neural networks are increasingly deployed in high-stakes applications with growing privacy leakage concerns.
Split learning enables collaborative model training by partitioning neural networks across clients and servers. However, improper split placement can lead to severe privacy leakage through intermediate representations.
arXiv:2607. 24556v1 Announce Type: cross Abstract: Split learning enables collaborative model training by partitioning neural networks across clients and servers.
arXiv:2410. 06814v2 Announce Type: replace Abstract: Over-parameterized models are typically vulnerable to membership inference attacks, which aim to determine whether a specific sample is included in the training of a given model.
arXiv:2607. 19580v1 Announce Type: new Abstract: Differentially private machine learning enables model training on sensitive data while ensuring that individual data is unlikely to be recoverable from the parameters of the resulting model.
The paper "Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses" provides a comprehensive review of model inversion (MI) attacks that exploit trained deep neural networks to reconstruct private training data. It traces the evolution of MI from early machine‑learning contexts to recent DNN‑based attacks across various modalities and learning tasks, offering a detailed taxonomy and comparative analysis of both attacks and defenses. The authors also present an open‑source toolbox on GitHub to support further research in this area.
arXiv:2506. 01396v2 Announce Type: replace Abstract: Differential privacy (DP) has become an essential framework for privacy-preserving machine learning.
The paper investigates whether inexpensive spectral metrics from the heavy‑tailed self‑regularisation framework can predict membership inference attack (MIA) vulnerability, offering a scalable alternative to costly shadow‑model attacks. Experiments on image and tabular classification tasks show that stable rank correlates positively with overall MIA success, while Log alpha‑Norm correlates negatively with MIA risk in low false‑positive regimes, outperforming conventional generalisation gap measures. These findings suggest that neural network spectra contain privacy leakage signals not captured by traditional overfitting metrics, pointing to spectral analysis as a promising direction for privacy auditing.
arXiv:2412. 12640v2 Announce Type: replace Abstract: The increasing demand for data privacy, alongside the benefits of aggregating data from networked devices, has catalyzed the emergence of federated learning (FL).
arXiv:2608.28934v1 Announce Type: new Abstract: Differential privacy (DP) has traditionally been used to provide theoretical upper bounds on an algorithm's stability to changing its training data. In...
The paper investigates provable privacy attacks on trained 2‑layer ReLU neural networks, specifically membership inference and data reconstruction. It demonstrates that the implicit bias of such networks can be leveraged to identify, with high probability, whether a given point was part of the training set in high‑dimensional, nearly orthogonal settings, and to construct a finite set containing a constant fraction of training points in a univariate setting. This work claims to be the first to reveal provable vulnerabilities arising from implicit bias in shallow neural networks.
arXiv:2407. 08233v3 Announce Type: replace Abstract: Current differentially private learning paradigms face a severe utility bottleneck: DP-SGD degrades performance through noise accumulation over training steps, while aggregation-based approaches such as PATE suffer from data inefficiency due to disjoint data partitioning.
The paper introduces PrivaTree, a differentially‑private decision tree algorithm that uses private histograms to select splits while preserving a small privacy budget. PrivaTree supports mixed numerical and categorical data without leaking information about numerical features and achieves a superior privacy‑utility trade‑off compared to existing methods. Additionally, the authors provide theoretical bounds on the expected accuracy and success rates of backdoor attacks, showing that PrivaTree-trained trees are more robust against data poisoning than standard decision trees.