mlsanityData to 7 Oct 2026

Accuracy-Privacy Trade-off in Deep Ensemble: A Membership Inference Perspective

arXiv 2105.05381 ↗First posted 12 May 2021cs.LG cs.AI cs.CRcited by 10

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Deep ensemble learning has been shown to improve accuracy by training multiple neural networks and averaging their outputs. Ensemble learning has also been suggested to defend against membership inference attacks that undermine privacy. In this paper, we empirically demonstrate a trade-off between these two goals, namely accuracy and privacy (in terms of membership inference attacks), in deep ensembles. Using a wide range of datasets and model architectures, we show that the effectiveness of membership inference attacks increases when ensembling improves accuracy. We analyze the impact of various factors in deep ensembles and demonstrate the root cause of the trade-off. Then, we evaluate common defenses against membership inference attacks based on regularization and differential privacy. We show that while these defenses can mitigate the effectiveness of membership inference attacks, they simultaneously degrade ensemble accuracy. We illustrate similar trade-off in more advanced and state-of-the-art ensembling techniques, such as snapshot ensembles and diversified ensemble networks. Finally, we propose a simple yet effective defense for deep ensembles to break the trade-off and, consequently, improve the accuracy and privacy, simultaneously.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 31 of its 71 references that are in the map. First posted on arXiv 12 May 2021.

Builds on

31 of 71 references.

References · 31

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  3. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  4. 2014Going Deeper with Convolutionscited by 4,231
  5. 2016Simple and Scalable Predictive Uncertainty Estimation using Deep Ensemblescited by 3,888
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  7. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  8. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  9. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 452
  10. 2019Deep Ensembles: A Loss Landscape Perspectivecited by 438
  11. 2020Label-Only Membership Inference Attackscited by 371
  12. 2017Snapshot Ensembles: Train 1, get M for freecited by 349
19 more
  1. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  2. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  3. 2020Differentially Private Learning Needs Better Features (or Much More Data)cited by 233
  4. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  5. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
  6. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  7. 2015Why M Heads are Better than One: Training a Diverse Ensemble of Deep Networkscited by 138
  8. 2019Privacy Risks of Securing Machine Learning Models against Adversarial Examplescited by 136
  9. 2013Hacking Smart Machines with Smarter Ones: How to Extract Meaningful Data from Machine Learning Classifierscited by 128
  10. 2018Understanding Membership Inferences on Well-Generalized Learning Modelscited by 83
  11. 2018Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learningcited by 75
  12. 2020Defending Model Inversion and Membership Inference Attacks via Prediction Purificationcited by 32
  13. 2017Towards Measuring Membership Privacycited by 27
  14. 2020On Power Laws in Deep Ensemblescited by 26
  15. 2020When Ensembling Smaller Models is More Efficient than Single Large Modelscited by 19
  16. 2020Privacy Analysis of Deep Learning in the Wild: Membership Inference Attacks against Transfer Learningcited by 19
  17. 2020Sampling Attacks: Amplification of Membership Inference Attacks by Repeated Queriescited by 15
  18. 2020DAMIA: Leveraging Domain Adaptation as a Defense against Membership Inference Attackscited by 9
  19. 2020Towards Robust Deep Learning with Ensemble Networks and Noisy Layerscited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 3; 2023: 1; 2024: 2; 2025: 2; 2026: 2.

10 papers.

  1. 2022Parameters or Privacy: A Provable Tradeoff Between Overparameterization and Membership Inferencecited by 14
  2. 2025Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemblecited by 11
  3. 2022An Efficient Subpopulation-based Membership Inference Attackcited by 4
  4. 2022On the Discredibility of Membership Inference Attackscited by 3
  5. 2025In-Context Probing for Membership Inference in Fine-Tuned Language Modelscited by 3
  6. 2026Toward Efficient Membership Inference Attacks against Federated Large Language Models: A Projection Residual Approachcited by 3
  7. 2023Membership Inference Attacks on DNNs using Adversarial Perturbationscited by 1
  8. 2024Accuracy-Privacy Trade-off in the Mitigation of Membership Inference Attack in Federated Learningcited by 1
  9. 2024Privacy Drift: Evolving Privacy Concerns in Incremental Learningcited by 0
  10. 2026ReproMIA: A Comprehensive Analysis of Model Reprogramming for Proactive Membership Inference Attackscited by 0