mlsanityData to 7 Oct 2026

One Parameter Defense -- Defending against Data Inference Attacks via Differential Privacy

arXiv 2203.06580 ↗First posted 13 Mar 2022cs.CR cs.AIcited by 26

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Machine learning models are vulnerable to data inference attacks, such as membership inference and model inversion attacks. In these types of breaches, an adversary attempts to infer a data record's membership in a dataset or even reconstruct this data record using a confidence score vector predicted by the target model. However, most existing defense methods only protect against membership inference attacks. Methods that can combat both types of attacks require a new model to be trained, which may not be time-efficient. In this paper, we propose a differentially private defense method that handles both types of attacks in a time-efficient manner by tuning only one parameter, the privacy budget. The central idea is to modify and normalize the confidence score vectors with a differential privacy mechanism which preserves privacy and obscures membership and reconstructed data. Moreover, this method can guarantee the order of scores in the vector to avoid any loss in classification accuracy. The experimental results show the method to be an effective and timely defense against both membership inference and model inversion attacks with no reduction in accuracy.

Key facts. Cited by 26 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 24 of its 40 references that are in the map. First posted on arXiv 13 Mar 2022.

Builds on

24 of 40 references.

References · 24

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2016Deep Learning with Differential Privacycited by 2,682
  3. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  4. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  5. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  6. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  7. 2020Label-Only Membership Inference Attackscited by 371
  8. 2016Semi-supervised Knowledge Transfer for Deep Learning from Private Training Datacited by 347
  9. 2018Scalable Private Learning with PATEcited by 266
  10. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  11. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
  12. 2020Membership Leakage in Label-Only Exposurescited by 156
12 more
  1. 2018Privacy-preserving Predictioncited by 48
  2. 2021Federated Learning with Local Differential Privacy: Trade-offs between Privacy, Utility, and Communicationcited by 38
  3. 2020Defending Model Inversion and Membership Inference Attacks via Prediction Purificationcited by 32
  4. 2020Faster Differentially Private Samplers via R'enyi Divergence Analysis of Discretized Langevin MCMCcited by 27
  5. 2020More Than Privacy: Applying Differential Privacy in Key Areas of Artificial Intelligencecited by 22
  6. 2019Heterogeneous Gaussian Mechanism: Preserving Differential Privacy in Deep Learning with Provable Robustnesscited by 15
  7. 2020Differential Privacy for Eye Tracking with Temporal Correlationscited by 11
  8. 2017Differentially Private Bayesian Learning on Distributed Datacited by 10
  9. 2018LEASGD: an Efficient and Privacy-Preserving Decentralized Algorithm for Distributed Learningcited by 6
  10. 2020Differential Advising in Multi-Agent Reinforcement Learningcited by 6
  11. 2020A Differentially Private Game Theoretic Approach for Deceiving Cyber Adversariescited by 4
  12. 2020Differentially Private Multi-Agent Planning for Logistic-like Problemscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 3; 2023: 5; 2024: 7; 2025: 9; 2026: 2.

26 papers.

Sort:

By area:

  1. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  2. 2024Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defensescited by 30
  3. 2023Recent Advances of Differential Privacy in Centralized Deep Learning: A Systematic Surveycited by 12
  4. 2022A Secure Federated Learning Framework for Residential Short Term Load Forecastingcited by 7
  5. 2022New Challenges in Reinforcement Learning: A Survey of Security and Privacycited by 7
  6. 2023Boosting Model Inversion Attacks with Adversarial Examplescited by 7
  7. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  8. 2024MIBench: A Comprehensive Framework for Benchmarking Model Inversion Attack and Defensecited by 5
  9. 2025Trustworthy AI Must Account for Interactionscited by 4
  10. 2023Hiding in Plain Sight: Differential Privacy Noise Exploitation for Evasion-resilient Localized Poisoning Attacks in Multiagent Reinforcement Learningcited by 2
  11. 2024Random Erasing vs. Model Inversion: A Promising Defense or a False Hope?cited by 2
  12. 2025Towards Dataset Copyright Evasion Attack against Personalized Text-to-Image Diffusion Modelscited by 2
14 more
  1. 2025Managing Correlations in Data and Privacy Demandcited by 2
  2. 2022LDL: A Defense for Label-Based Membership Inference Attackscited by 1
  3. 2023DP-DCAN: Differentially Private Deep Contrastive Autoencoder Network for Single-cell Clusteringcited by 1
  4. 2024Double-Dip: Thwarting Label-Only Membership Inference Attacks with Transfer Learning and Randomizationcited by 1
  5. 2025Zero-Trust Foundation Models: A New Paradigm for Secure and Collaborative Artificial Intelligence for Internet of Thingscited by 1
  6. 2026Explanations Leak: Membership Inference with Differential Privacy and Active Learning Defensecited by 1
  7. 2024Privacy-Preserving and Trustworthy Deep Learning for Medical Imagingcited by 0
  8. 2024Investigating Privacy Leakage in Dimensionality Reduction Methods via Reconstruction Attackcited by 0
  9. 2025Training Set Reconstruction from Differentially Private Forests: How Effective is DP?cited by 0
  10. 2025Stabilization of Perturbed Loss Function: Differential Privacy without Gradient Noisecited by 0
  11. 2025On Evaluating the Poisoning Robustness of Federated Learning under Local Differential Privacycited by 0
  12. 2025CoSIFL: Collaborative Secure and Incentivized Federated Learning with Differential Privacycited by 0
  13. 2025PRIVEE: Privacy-Preserving Vertical Federated Learning Against Feature Inference Attackscited by 0
  14. 2026Private and interpretable clinical prediction with quantum-inspired tensor train modelscited by 0