# One Parameter Defense -- Defending against Data Inference Attacks via Differential Privacy arXiv: https://arxiv.org/abs/2203.06580 ยท HTML: https://mlsanity.com/paper/2203.06580/ ## Key facts - Cited by 27 papers in the map (data through 14 Oct 2026). - Placed in Membership inference attacks, one of 12 directions in LLM safety and security. - Builds on 24 of its 40 references that are in the map. - First posted on arXiv 13 Mar 2022. ## Placed in - LLM safety and security / [Membership inference attacks](https://mlsanity.com/safety/membership-inference-attacks/) ## Builds on (most cited first, 24 of 24) - [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014) - [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016) - [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016) - [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015) - [ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models](https://mlsanity.com/paper/1806.01246/) (2018) - [Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples](https://mlsanity.com/paper/1605.07277/) (2016) - [Label-Only Membership Inference Attacks](https://mlsanity.com/paper/2007.14321/) (2020) - [Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data](https://mlsanity.com/paper/1610.05755/) (2016) - [Scalable Private Learning with PATE](https://mlsanity.com/paper/1802.08908/) (2018) - [MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples](https://mlsanity.com/paper/1909.10594/) (2019) - [Machine Learning with Membership Privacy using Adversarial Regularization](https://mlsanity.com/paper/1807.05852/) (2018) - [Membership Leakage in Label-Only Exposures](https://mlsanity.com/paper/2007.15528/) (2020) - [Privacy-preserving Prediction](https://mlsanity.com/paper/1803.10266/) (2018) - [Federated Learning with Local Differential Privacy: Trade-offs between Privacy, Utility, and Communication](https://mlsanity.com/paper/2102.04737/) (2021) - [Defending Model Inversion and Membership Inference Attacks via Prediction Purification](https://mlsanity.com/paper/2005.03915/) (2020) - [Faster Differentially Private Samplers via R'enyi Divergence Analysis of Discretized Langevin MCMC](https://mlsanity.com/paper/2010.14658/) (2020) - [More Than Privacy: Applying Differential Privacy in Key Areas of Artificial Intelligence](https://mlsanity.com/paper/2008.01916/) (2020) - [Heterogeneous Gaussian Mechanism: Preserving Differential Privacy in Deep Learning with Provable Robustness](https://mlsanity.com/paper/1906.01444/) (2019) - [Differential Privacy for Eye Tracking with Temporal Correlations](https://mlsanity.com/paper/2002.08972/) (2020) - [Differentially Private Bayesian Learning on Distributed Data](https://mlsanity.com/paper/1703.01106/) (2017) - [LEASGD: an Efficient and Privacy-Preserving Decentralized Algorithm for Distributed Learning](https://mlsanity.com/paper/1811.11124/) (2018) - [Differential Advising in Multi-Agent Reinforcement Learning](https://mlsanity.com/paper/2011.03640/) (2020) - [A Differentially Private Game Theoretic Approach for Deceiving Cyber Adversaries](https://mlsanity.com/paper/2008.05629/) (2020) - [Differentially Private Multi-Agent Planning for Logistic-like Problems](https://mlsanity.com/paper/2008.06832/) (2020) ## Built on by (most cited first, 27 of 27) - [Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)](https://mlsanity.com/paper/2407.14937/) (2024) - [Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses](https://mlsanity.com/paper/2402.04013/) (2024) - [Recent Advances of Differential Privacy in Centralized Deep Learning: A Systematic Survey](https://mlsanity.com/paper/2309.16398/) (2023) - [Boosting Model Inversion Attacks with Adversarial Examples](https://mlsanity.com/paper/2306.13965/) (2023) - [A Secure Federated Learning Framework for Residential Short Term Load Forecasting](https://mlsanity.com/paper/2209.14547/) (2022) - [New Challenges in Reinforcement Learning: A Survey of Security and Privacy](https://mlsanity.com/paper/2301.00188/) (2022) - [SoK: Unintended Interactions among Machine Learning Defenses and Risks](https://mlsanity.com/paper/2312.04542/) (2023) - [MIBench: A Comprehensive Framework for Benchmarking Model Inversion Attack and Defense](https://mlsanity.com/paper/2410.05159/) (2024) - [Trustworthy AI Must Account for Interactions](https://mlsanity.com/paper/2504.07170/) (2025) - [Hiding in Plain Sight: Differential Privacy Noise Exploitation for Evasion-resilient Localized Poisoning Attacks in Multiagent Reinforcement Learning](https://mlsanity.com/paper/2307.00268/) (2023) - [Random Erasing vs. Model Inversion: A Promising Defense or a False Hope?](https://mlsanity.com/paper/2409.01062/) (2024) - [Towards Dataset Copyright Evasion Attack against Personalized Text-to-Image Diffusion Models](https://mlsanity.com/paper/2505.02824/) (2025) - [Managing Correlations in Data and Privacy Demand](https://mlsanity.com/paper/2509.02856/) (2025) - [LDL: A Defense for Label-Based Membership Inference Attacks](https://mlsanity.com/paper/2212.01688/) (2022) - [DP-DCAN: Differentially Private Deep Contrastive Autoencoder Network for Single-cell Clustering](https://mlsanity.com/paper/2311.03410/) (2023) - [Double-Dip: Thwarting Label-Only Membership Inference Attacks with Transfer Learning and Randomization](https://mlsanity.com/paper/2402.01114/) (2024) - [Zero-Trust Foundation Models: A New Paradigm for Secure and Collaborative Artificial Intelligence for Internet of Things](https://mlsanity.com/paper/2505.23792/) (2025) - [Explanations Leak: Membership Inference with Differential Privacy and Active Learning Defense](https://mlsanity.com/paper/2602.03611/) (2026) - [Privacy-Preserving and Trustworthy Deep Learning for Medical Imaging](https://mlsanity.com/paper/2407.00538/) (2024) - [Investigating Privacy Leakage in Dimensionality Reduction Methods via Reconstruction Attack](https://mlsanity.com/paper/2408.17151/) (2024) - [Defending Against Neural Network Model Inversion Attacks via Data Poisoning](https://mlsanity.com/paper/2412.07575/) (2024) - [Training Set Reconstruction from Differentially Private Forests: How Effective is DP?](https://mlsanity.com/paper/2502.05307/) (2025) - [Stabilization of Perturbed Loss Function: Differential Privacy without Gradient Noise](https://mlsanity.com/paper/2508.15523/) (2025) - [On Evaluating the Poisoning Robustness of Federated Learning under Local Differential Privacy](https://mlsanity.com/paper/2509.05265/) (2025) - [CoSIFL: Collaborative Secure and Incentivized Federated Learning with Differential Privacy](https://mlsanity.com/paper/2509.23190/) (2025) - [PRIVEE: Privacy-Preserving Vertical Federated Learning Against Feature Inference Attacks](https://mlsanity.com/paper/2512.12840/) (2025) - [Private and interpretable clinical prediction with quantum-inspired tensor train models](https://mlsanity.com/paper/2602.06110/) (2026) ## Abstract (arXiv) Machine learning models are vulnerable to data inference attacks, such as membership inference and model inversion attacks. In these types of breaches, an adversary attempts to infer a data record's membership in a dataset or even reconstruct this data record using a confidence score vector predicted by the target model. However, most existing defense methods only protect against membership inference attacks. Methods that can combat both types of attacks require a new model to be trained, which may not be time-efficient. In this paper, we propose a differentially private defense method that handles both types of attacks in a time-efficient manner by tuning only one parameter, the privacy budget. The central idea is to modify and normalize the confidence score vectors with a differential privacy mechanism which preserves privacy and obscures membership and reconstructed data. Moreover, this method can guarantee the order of scores in the vector to avoid any loss in classification accuracy. The experimental results show the method to be an effective and timely defense against both membership inference and model inversion attacks with no reduction in accuracy.