mlsanityData to 7 Oct 2026

Inf2Guard: An Information-Theoretic Framework for Learning Privacy-Preserving Representations against Inference Attacks

arXiv 2403.02116 ↗First posted 4 Mar 2024cs.LG cs.CRcited by 13

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Machine learning (ML) is vulnerable to inference (e.g., membership inference, property inference, and data reconstruction) attacks that aim to infer the private information of training data or dataset. Existing defenses are only designed for one specific type of attack and sacrifice significant utility or are soon broken by adaptive attacks. We address these limitations by proposing an information-theoretic defense framework, called Inf2Guard, against the three major types of inference attacks. Our framework, inspired by the success of representation learning, posits that learning shared representations not only saves time/costs but also benefits numerous downstream tasks. Generally, Inf2Guard involves two mutual information objectives, for privacy protection and utility preservation, respectively. Inf2Guard exhibits many merits: it facilitates the design of customized objectives against the specific inference attack; it provides a general defense framework which can treat certain existing defenses as special cases; and importantly, it aids in deriving theoretical results, e.g., inherent utility-privacy tradeoff and guaranteed privacy leakage. Extensive evaluations validate the effectiveness of Inf2Guard for learning privacy-preserving representations against inference attacks and demonstrate the superiority over the baselines.

Key facts. Cited by 13 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 57 of its 83 references that are in the map. First posted on arXiv 4 Mar 2024.

Builds on

57 of 83 references.

Closest ancestors · 8

Same direction, newest first

  1. 2022Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries19 Oct
  2. 2022NeuGuard: Lightweight Neuron-Guided Defense against Membership Inference Attacks11 Jun
  3. 2022Membership Inference Attacks and Defenses in Neural Network Pruning7 Feb
  4. 2021Membership Inference Attacks From First Principles7 Dec
  5. 2021Enhanced Membership Inference Attacks against Machine Learning Models18 Nov
  6. 2021Property Inference Attacks Against GANs15 Nov
  7. 2021Dataset Inference: Ownership Resolution in Machine Learning21 Apr
  8. 2021Practical Blind Membership Inference Attack via Differential Comparisons5 Jan

Other references · 49

  1. 2018Representation Learning with Contrastive Predictive Codingcited by 7,662
  2. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  3. 2016Deep Learning with Differential Privacycited by 2,682
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  5. 2018Learning deep representations by mutual information estimation and maximizationcited by 1,265
  6. 2019Deep Leakage from Gradientscited by 1,004
  7. 2016Deep Variational Information Bottleneckcited by 915
  8. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  9. 2018MINE: Mutual Information Neural Estimationcited by 680
  10. 2017Renyi Differential Privacycited by 643
  11. 2019On Variational Bounds of Mutual Informationcited by 550
  12. 2019Federated Learning with Differential Privacy: Algorithms and Performance Analysiscited by 528
37 more
  1. 2016f-GAN: Training Generative Neural Samplers using Variational Divergence Minimizationcited by 504
  2. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  3. 2020Label-Only Membership Inference Attackscited by 371
  4. 2020iDLG: Improved Deep Leakage from Gradientscited by 367
  5. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 326
  6. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  7. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
  8. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  9. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 242
  10. 2020CLUB: A Contrastive Log-ratio Upper Bound of Mutual Informationcited by 233
  11. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  12. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
  13. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  14. 2022Reconstructing Training Data with Informed Adversariescited by 143
  15. 2019Privacy Risks of Securing Machine Learning Models against Adversarial Examplescited by 136
  16. 2013Hacking Smart Machines with Smarter Ones: How to Extract Meaningful Data from Machine Learning Classifierscited by 128
  17. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
  18. 2018Variational Discriminator Bottleneck: Improving Imitation Learning, Inverse RL, and GANs by Constraining Information Flowcited by 103
  19. 2021Gradient Inversion with Generative Image Priorcited by 101
  20. 2020R-GAP: Recursive Gradient Attack on Privacycited by 95
  21. 2020Provable Defense against Privacy Leakage in Federated Learning from Representation Perspectivecited by 94
  22. 2019Differentially Private Model Publishing for Deep Learningcited by 69
  23. 2021Property Inference From Poisoningcited by 56
  24. 2022LAMP: Extracting Text from Gradients with Language Model Priorscited by 52
  25. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 47
  26. 2020Leakage of Dataset Properties in Multi-Party Machine Learningcited by 46
  27. 2021Formalizing and Estimating Distribution Inference Riskscited by 42
  28. 2021Bayesian Framework for Gradient Leakagecited by 34
  29. 2020Privacy-preserving Collaborative Learning with Automatic Transformation Searchcited by 31
  30. 2022SNAP: Efficient Extraction of Private Properties with Poisoningcited by 29
  31. 2021PRECODE - A Generic Model Extension to Prevent Deep Gradient Leakagecited by 28
  32. 2022Reconstructing Training Data from Model Gradient, Provablycited by 27
  33. 2022Group Property Inference Attacks Against Graph Neural Networkscited by 21
  34. 2022Distribution inference risks: Identifying and mitigating sources of leakagecited by 17
  35. 2016Learning Privately from Multiparty Datacited by 16
  36. 2023Task-Agnostic Privacy-Preserving Representation Learning for Federated Learning Against Attribute Inference Attackscited by 13
  37. 2020R2DP: A Universal and Automated Approach to Optimizing the Randomization Mechanisms of Differential Privacy for Utility Metrics with No Known Optimal Distributionscited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 3; 2025: 7; 2026: 3.

13 papers.

Sort:

By area:

  1. 2025Rectifying Privacy and Efficacy Measurements in Machine Unlearning: A New Inference Attack Perspectivecited by 8
  2. 2025Neural Mutual Information Estimation with Vector Copulascited by 4
  3. 2024Learning Robust and Privacy-Preserving Representations via Information Theorycited by 3
  4. 2025Measure-Theoretic Anti-Causal Representation Learningcited by 3
  5. 2025From Risk to Resilience: Towards Assessing and Mitigating the Risk of Data Reconstruction Attacks in Federated Learningcited by 3
  6. 2024Pre-trained Encoder Inference: Revealing Upstream Encoders In Downstream Machine Learning Servicescited by 0
  7. 2024Understanding Data Reconstruction Leakage in Federated Learning from a Theoretical Perspectivecited by 0
  8. 2025DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systemscited by 0
  9. 2025On the Inference (In-)Security of Vertical Federated Learning: Efficient Auditing against Inference Tampering Attackcited by 0
  10. 2025InfoDecom: Decomposing Information for Defending Against Privacy Leakage in Split Inferencecited by 0
  11. 2026Fair Finetuning Mitigates Distribution Inference Attackscited by 0
  12. 2026CausShield: Sample Reconstruction-Resilient Vertical FL via Causal Representation Learningcited by 0
1 more
  1. 2026Code-Poisoning Property Inference Attackscited by 0