mlsanityData to 7 Oct 2026

Double-Dip: Thwarting Label-Only Membership Inference Attacks with Transfer Learning and Randomization

arXiv 2402.01114 ↗First posted 2 Feb 2024cs.LG cs.AI cs.CRcited by 1

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Transfer learning (TL) has been demonstrated to improve DNN model performance when faced with a scarcity of training samples. However, the suitability of TL as a solution to reduce vulnerability of overfitted DNNs to privacy attacks is unexplored. A class of privacy attacks called membership inference attacks (MIAs) aim to determine whether a given sample belongs to the training dataset (member) or not (nonmember). We introduce Double-Dip, a systematic empirical study investigating the use of TL (Stage-1) combined with randomization (Stage-2) to thwart MIAs on overfitted DNNs without degrading classification accuracy. Our study examines the roles of shared feature space and parameter values between source and target models, number of frozen layers, and complexity of pretrained models. We evaluate Double-Dip on three (Target, Source) dataset paris: (i) (CIFAR-10, ImageNet), (ii) (GTSRB, ImageNet), (iii) (CelebA, VGGFace2). We consider four publicly available pretrained DNNs: (a) VGG-19, (b) ResNet-18, (c) Swin-T, and (d) FaceNet. Our experiments demonstrate that Stage-1 reduces adversary success while also significantly increasing classification accuracy of nonmembers against an adversary with either white-box or black-box DNN model access, attempting to carry out SOTA label-only MIAs. After Stage-2, success of an adversary carrying out a label-only MIA is further reduced to near 50%, bringing it closer to a random guess and showing the effectiveness of Double-Dip. Stage-2 of Double-Dip also achieves lower ASR and higher classification accuracy than regularization and differential privacy-based methods.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 28 of its 48 references that are in the map. First posted on arXiv 2 Feb 2024.

Builds on

28 of 48 references.

Closest ancestors · 4

Same direction, newest first

  1. 2022LDL: A Defense for Label-Based Membership Inference Attacks3 Dec
  2. 2022One Parameter Defense -- Defending against Data Inference Attacks via Differential Privacy13 Mar
  3. 2021Enhanced Membership Inference Attacks against Machine Learning Models18 Nov
  4. 2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture15 Oct

Other references · 24

  1. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  2. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  5. 2016Deep Learning with Differential Privacycited by 2,682
  6. 2016Adversarial examples in the physical worldcited by 1,762
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  8. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  9. 2017A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasetscited by 374
  10. 2020Label-Only Membership Inference Attackscited by 371
  11. 2016Unsupervised Domain Adaptation with Residual Transfer Networkscited by 340
  12. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
12 more
  1. 2020Pretrained Transformers Improve Out-of-Distribution Robustnesscited by 293
  2. 2020Large image datasets: A pyrrhic win for computer vision?cited by 237
  3. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  4. 2018Not-so-supervised: a survey of semi-supervised, multi-instance, and transfer learning in medical image analysiscited by 178
  5. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
  6. 2020Membership Leakage in Label-Only Exposurescited by 156
  7. 2020An Empirical Study on Robustness to Spurious Correlations using Pre-trained Language Modelscited by 133
  8. 2020Revisiting Membership Inference Under Realistic Assumptionscited by 108
  9. 2020When Machine Learning Meets Privacy: A Survey and Outlookcited by 67
  10. 2018AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learningcited by 58
  11. 2020Privacy Analysis of Deep Learning in the Wild: Membership Inference Attacks against Transfer Learningcited by 19
  12. 2020DAMIA: Leveraging Domain Adaptation as a Defense against Membership Inference Attackscited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Revisiting the LiRA Membership Inference Attack Under Realistic Assumptionscited by 3