% Key papers for Membership inference and auditing (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{aaai2021_membership_976,
  title = {{Membership Privacy for Machine Learning Models Through Knowledge Transfer}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2021},
  url = {https://aaai.org/papers/09549-membership-privacy-for-machine-learning-models-through-knowledge-transfer/},
}

@inproceedings{iclr2022_label_31476,
  title = {{Label Leakage and Protection in Two-party Split Learning}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2022},
  url = {https://iclr.cc/virtual/2022/poster/6388},
}

@inproceedings{icml2022_deduplicating_40418,
  title = {{Deduplicating Training Data Mitigates Privacy Risks in Language Models}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2022},
  url = {https://icml.cc/virtual/2022/poster/17279},
}

@inproceedings{neurips2019_generalization_58322,
  title = {{Generalization in Generative Adversarial Networks: A Novel Perspective from Privacy Protection}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2019},
  url = {https://nips.cc/virtual/2019/poster/13271},
}

@inproceedings{cvpr2024_a_22660,
  title = {{A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2024},
  url = {https://cvpr.thecvf.com/virtual/2024/poster/31553},
}

@inproceedings{neurips2022_the_64371,
  title = {{The Privacy Onion Effect: Memorization is Relative}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2022},
  url = {https://nips.cc/virtual/2022/poster/53962},
}

@inproceedings{icml2021_when_40118,
  title = {{When Does Data Augmentation Help With Membership Inference Attacks?}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2021},
  url = {https://icml.cc/virtual/2021/poster/9601},
}

@inproceedings{aaai2023_xrand_4976,
  title = {{XRand: Differentially Private Defense against Explanation-Guided Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2023},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/26401},
}

@inproceedings{neurips2024_attack_73380,
  title = {{Attack-Aware Noise Calibration for Differential Privacy}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/94073},
}

@inproceedings{neurips2022_a_64191,
  title = {{A General Framework for Auditing Differentially Private Machine Learning}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2022},
  url = {https://nips.cc/virtual/2022/poster/53802},
}

@inproceedings{neurips2023_students_68629,
  title = {{Students Parrot Their Teachers: Membership Inference on Model Distillation}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2023},
  url = {https://nips.cc/virtual/2023/poster/71209},
}

@inproceedings{aaai2025_forget_9219,
  title = {{Forget to Flourish: Leveraging Machine-Unlearning on Pretrained Language Models for Privacy Leakage}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/34218},
}

@inproceedings{icml2022_bounding_40297,
  title = {{Bounding Training Data Reconstruction in Private (Deep) Learning}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2022},
  url = {https://icml.cc/virtual/2022/poster/16043},
}

@inproceedings{aaai2023_privacy_4412,
  title = {{Privacy Attacks on Schedule-Driven Data}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2023},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/26412},
}

@inproceedings{aaai2025_privacy_10357,
  title = {{Privacy-Preserving Low-Rank Adaptation Against Membership Inference Attacks for Latent Diffusion Models}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/32628},
}

@inproceedings{iclr2024_teach_35357,
  title = {{Teach LLMs to Phish: Stealing Private Information from Language Models}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/17716},
}

@inproceedings{icml2023_analyzing_41910,
  title = {{Analyzing Privacy Leakage in Machine Learning via Multiple Hypothesis Testing: A Lesson From Fano}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2023},
  url = {https://icml.cc/virtual/2023/poster/24919},
}

@inproceedings{iclr2024_be_33489,
  title = {{Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/19586},
}

@inproceedings{icml2020_alleviating_37929,
  title = {{Alleviating Privacy Attacks via Causal Learning}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2020},
  url = {https://icml.cc/virtual/2020/poster/6346},
}

@inproceedings{neurips2023_robust_68205,
  title = {{Robust and Actively Secure Serverless Collaborative Learning}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2023},
  url = {https://nips.cc/virtual/2023/poster/71588},
}

@inproceedings{neurips2024_auditing_70968,
  title = {{Auditing Privacy Mechanisms via Label Inference Attacks}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/96236},
}

@inproceedings{icml2025_textual_48338,
  title = {{Textual Unlearning Gives a False Sense of Unlearning}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2025},
  url = {https://icml.cc/virtual/2025/poster/44277},
}

@inproceedings{neurips2024_panoramia_70531,
  title = {{PANORAMIA: Privacy Auditing of Machine Learning Models without Retraining}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/96581},
}

@inproceedings{neurips2025_impact_77298,
  title = {{Impact of Dataset Properties on Membership Inference Vulnerability of Deep Transfer Learning}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=SR6ivhZCQK},
}

@inproceedings{aaai2026_infodecom_106860,
  title = {{InfoDecom: Decomposing Information for Defending Against Privacy Leakage in Split Inference}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/39212},
}

@inproceedings{aaai2025_privacy_10359,
  title = {{Privacy-and-Utility-Aware Publishing of Schedules}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/34844},
}

@inproceedings{icml2024_privacy_43590,
  title = {{Privacy Backdoors: Stealing Data with Corrupted Pretrained Models}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/34862},
}

@inproceedings{icml2025_egoprivacy_47796,
  title = {{EgoPrivacy: What Your First-Person Camera Says About You?}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2025},
  url = {https://icml.cc/virtual/2025/poster/44804},
}

@inproceedings{icml2026_on_49367,
  title = {{On the Fragility of Data Attribution When Learning Is Distributed}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=1sgrIzBaWD},
}

@inproceedings{neurips2025_deep_79845,
  title = {{Deep Learning with Plausible Deniability}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=tVpneDH5ov},
}

@inproceedings{iclr2026_curation_85231,
  title = {{Curation Leaks: Membership Inference Attacks against Data Curation for Machine Learning}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2026},
  url = {https://openreview.net/forum?id=BzNf90Csfa},
}

@inproceedings{iclr2026_learnability_85865,
  title = {{Learnability and Privacy Vulnerability are Entangled in a Few Critical Weights}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2026},
  url = {https://openreview.net/forum?id=J2gI585XDK},
}

@inproceedings{iclr2026_concept_87443,
  title = {{Concept-Aware Privacy Mechanisms for Defending Embedding Inversion Attacks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2026},
  url = {https://openreview.net/forum?id=bcOD0CLgBb},
}

@inproceedings{neurips2026_a_91684,
  title = {{A Unified Framework for Adversary-Aware Differential Privacy Bounds}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2026},
  url = {https://neurips.cc/virtual/2026/poster/153636},
}