Research map / Federated learning and privacy / Privacy attacks and secure learning
Membership inference and auditing
Attack and audit models for privacy leakage with membership inference and statistical tests.
47 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2019–2026) · an approach in Privacy attacks and secure learning, keyword cluster “attack · defense · backdoor”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
15 papers in 2023–24 and 21 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 11.5% to 14.8%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2019 · Generalization in Generative Adversarial Networks: A Novel Perspective from Privacy Protection (NeurIPS 2019 · 33 citations)
- 2020 · Alleviating Privacy Attacks via Causal Learning (ICML 2020 · 2 citations)
- 2021 · Membership Privacy for Machine Learning Models Through Knowledge Transfer (AAAI 2021 · 74 citations)
- 2022 · Label Leakage and Protection in Two-party Split Learning (ICLR 2022 · 63 citations)
- 2023 · XRand: Differentially Private Defense against Explanation-Guided Attacks (AAAI 2023 · 12 citations)
- 2024 · A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning (CVPR 2024 · 21 citations)
- 2025 · Forget to Flourish: Leveraging Machine-Unlearning on Pretrained Language Models for Privacy Leakage (AAAI 2025 · 5 citations)
- 2026 · InfoDecom: Decomposing Information for Defending Against Privacy Leakage in Split Inference (AAAI 2026 · 1 citation)
Earliest papers here
- Generalization in Generative Adversarial Networks: A Novel Perspective from Privacy Protection (NeurIPS 2019 · 33 citations)
- Alleviating Privacy Attacks via Causal Learning (ICML 2020 · 2 citations)
- Membership Privacy for Machine Learning Models Through Knowledge Transfer (AAAI 2021 · 74 citations)
What has been tried
31 papers here report 306 measured changes (a component added, removed or swapped, compared with a baseline): helped 58%, no clear effect 7%, hurt 25%, mixed 9%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add DCOR | CIFAR-10 layer 2 · SSIM | 0.830 -> 0.692; 0.830 -> 0.628; 0.830 -> 0.563 | Hurt | A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning (CVPR 2024 · 21 citations) |
| Increase known prefix length from 10% to 50% | MIND · NSR | 95 -> 326 | Helped | Forget to Flourish: Leveraging Machine-Unlearning on Pretrained Language Models for Privacy Leakage (AAAI 2025 · 5 citations) |
| Decrease λ from 1.00 to 0.01 | Pokemon · FID | 1.633 -> 0.214 | Helped | Privacy-Preserving Low-Rank Adaptation Against Membership Inference Attacks for Latent Diffusion Models (AAAI 2025 · 3 citations) |
| Append “not” before the poison digits | 12-digit secret extraction · secret extraction rate | Helped | Teach LLMs to Phish: Stealing Private Information from Language Models (ICLR 2024 · 3 citations) | |
| increase positive smoothing from α=0.0 to α=0.1 | FaceScrub · Acc@1 | 94.32% -> 95.20% ± 2.9 | Helped | Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks (ICLR 2024 · 2 citations) |
| Replace cosine distance with Euclidean distance | SynthPAI-age and SynthPAI-inc · ROUGE-1 | 66.66 -> 0; 29.76 -> 0 | Hurt | Textual Unlearning Gives a False Sense of Unlearning (ICML 2025 · 1 citation) |
| Predict log(TPR−FPR) rather than log(TPR) | Empirical vulnerability prediction · prediction quality | Helped | Impact of Dataset Properties on Membership Inference Vulnerability of Deep Transfer Learning (NeurIPS 2025 · 1 citation) | |
| Use a helper model trained on synthetic data rather than no helper | CIFAR10 · c_lb | +1.19 | Helped | PANORAMIA: Privacy Auditing of Machine Learning Models without Retraining (NeurIPS 2024 · 1 citation) |
| Add moving jobs and feature perturbation (MP) rather than using job swaps alone (S) | Synthetic MAKE schedules, z = Cmax · PUP success rate | 53.1-55.2% -> 83.8-87.9% | Helped | Privacy-and-Utility-Aware Publishing of Schedules (AAAI 2025 · 0 citations) |
| Use hard voting instead of direct ego prediction | Charades-Ego (OOD), gender · accuracy | 73.15 -> 78.32 | Helped | EgoPrivacy: What Your First-Person Camera Says About You? (ICML 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 13 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Baselines
- LiRA · 2 of 13 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 36 papers; from OpenAlex and the papers' affiliations).
- Google · 4 papers
- ETHZ - ETH Zurich · 3 papers
- York University · 2 papers
- Humboldt-Universit ¨at zu Berlin · 2 papers
- University of Toronto · 2 papers
- University of Florida · 2 papers
- Princeton University · 2 papers
- Google DeepMind · 2 papers
- Meta · 2 papers
- Qualcomm · 2 papers
Use it
Download BibTeX of 34 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Defending federated learning against poisoning (76 papers)
- Gradient inversion attacks (47 papers)
Elsewhere in the topic
- Encryption-based private learning (105 papers)
- Private federated aggregation (50 papers)
- Visual privacy and face de-identification (39 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).