{"id":"https://openalex.org/W4396243913","doi":"https://doi.org/10.1145/3658644.3690194","title":"Evaluations of Machine Learning Privacy Defenses are Misleading","display_name":"Evaluations of Machine Learning Privacy Defenses are Misleading","publication_year":2024,"publication_date":"2024-12-02","ids":{"openalex":"https://openalex.org/W4396243913","doi":"https://doi.org/10.1145/3658644.3690194"},"language":"en","primary_location":{"id":"doi:10.1145/3658644.3690194","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3690194","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690194","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690194","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5072556612","display_name":"Michael Aerni","orcid":"https://orcid.org/0000-0003-3276-2678"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Michael Aerni","raw_affiliation_strings":["ETH Zurich, Z\u00fcrich, Switzerland"],"raw_orcid":"https://orcid.org/0000-0003-3276-2678","affiliations":[{"raw_affiliation_string":"ETH Zurich, Z\u00fcrich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Jie Zhang","orcid":"https://orcid.org/0009-0008-4670-9038"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Jie Zhang","raw_affiliation_strings":["ETH Zurich, Z\u00fcrich, Switzerland"],"raw_orcid":"https://orcid.org/0009-0008-4670-9038","affiliations":[{"raw_affiliation_string":"ETH Zurich, Z\u00fcrich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5006851333","display_name":"Florian Tram\u00e8r","orcid":"https://orcid.org/0000-0001-8703-8762"},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Florian Tram\u00e8r","raw_affiliation_strings":["ETH Zurich, Z\u00fcrich, Switzerland"],"raw_orcid":"https://orcid.org/0000-0001-8703-8762","affiliations":[{"raw_affiliation_string":"ETH Zurich, Z\u00fcrich, Switzerland","institution_ids":["https://openalex.org/I35440088"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I35440088"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":14,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1271","last_page":"1284"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9093000292778015,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9093000292778015,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.5047200918197632},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.48923516273498535},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4160812199115753},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.37577179074287415},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.3555663824081421},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3265446424484253}],"concepts":[{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.5047200918197632},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.48923516273498535},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4160812199115753},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.37577179074287415},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.3555663824081421},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3265446424484253}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3658644.3690194","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3690194","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690194","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2404.17399","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2404.17399","pdf_url":"https://arxiv.org/pdf/2404.17399","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"doi:10.1145/3658644.3690194","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3690194","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690194","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.4000000059604645}],"awards":[{"id":"https://openalex.org/G4626338959","display_name":null,"funder_award_id":"214838","funder_id":"https://openalex.org/F4320323817","funder_display_name":"Universitas Brawijaya"},{"id":"https://openalex.org/G49752938","display_name":"The Security and Privacy of Real Machine Learning Systems","funder_award_id":"214838","funder_id":"https://openalex.org/F4320320924","funder_display_name":"Schweizerischer Nationalfonds zur F\u00f6rderung der Wissenschaftlichen Forschung"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320309949","display_name":"Canadian Institute for Advanced Research","ror":"https://ror.org/01sdtdd95"},{"id":"https://openalex.org/F4320320924","display_name":"Schweizerischer Nationalfonds zur F\u00f6rderung der Wissenschaftlichen Forschung","ror":"https://ror.org/00yjd3n13"},{"id":"https://openalex.org/F4320323817","display_name":"Universitas Brawijaya","ror":"https://ror.org/01wk3d929"}],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4396243913.pdf"},"referenced_works_count":30,"referenced_works":["https://openalex.org/W1873763122","https://openalex.org/W2051267297","https://openalex.org/W2535690855","https://openalex.org/W2784763694","https://openalex.org/W2807096445","https://openalex.org/W2884943453","https://openalex.org/W2930926105","https://openalex.org/W2964137095","https://openalex.org/W2982802130","https://openalex.org/W2983140679","https://openalex.org/W3034957837","https://openalex.org/W3035168593","https://openalex.org/W3035261884","https://openalex.org/W3035524453","https://openalex.org/W3096692244","https://openalex.org/W3154109599","https://openalex.org/W3205825741","https://openalex.org/W3211574353","https://openalex.org/W3212600502","https://openalex.org/W4283816018","https://openalex.org/W4288057780","https://openalex.org/W4308410483","https://openalex.org/W4308643663","https://openalex.org/W4320167258","https://openalex.org/W4387857649","https://openalex.org/W4390872063","https://openalex.org/W4391725330","https://openalex.org/W4393140557","https://openalex.org/W4396790444","https://openalex.org/W6810565495"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2748952813","https://openalex.org/W2931662336","https://openalex.org/W2077865380","https://openalex.org/W2765597752","https://openalex.org/W2134894512","https://openalex.org/W2083375246","https://openalex.org/W2067108088","https://openalex.org/W2085372204","https://openalex.org/W4391301621"],"abstract_inverted_index":{"Empirical":[0],"defenses":[1,101],"for":[2],"machine":[3],"learning":[4],"privacy":[5,12,31,54,70,78,86],"forgo":[6],"the":[7,14,53,57,99],"provable":[8,115],"guarantees":[9],"of":[10,16,56,76,91,98],"differential":[11,69],"in":[13,28,40],"hope":[15],"achieving":[17],"higher":[18],"utility":[19],"while":[20],"resisting":[21],"realistic":[22],"adversaries.":[23],"We":[24],"identify":[25],"severe":[26],"pitfalls":[27],"existing":[29],"empirical":[30,77,100],"evaluations":[32,49,84],"(based":[33],"on":[34],"membership":[35],"inference":[36],"attacks)":[37],"that":[38,47,82],"result":[39],"misleading":[41],"conclusions.":[42],"In":[43,72],"particular,":[44],"we":[45,80,102],"show":[46],"prior":[48,83],"fail":[50],"to":[51],"characterize":[52],"leakage":[55,87],"most":[58],"vulnerable":[59],"samples,":[60],"use":[61],"weak":[62],"attacks,":[63],"and":[64],"avoid":[65],"comparisons":[66],"with":[67,106],"practical":[68],"baselines.":[71],"5":[73],"case":[74],"studies":[75],"defenses,":[79],"find":[81],"underestimate":[85],"by":[88],"an":[89],"order":[90],"magnitude.":[92],"Under":[93],"our":[94],"stronger":[95],"evaluation,":[96],"none":[97],"study":[103],"are":[104],"competitive":[105],"a":[107],"properly":[108],"tuned,":[109],"high-utility":[110],"DP-SGD":[111],"baseline":[112],"(with":[113],"vacuous":[114],"guarantees).":[116]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":12}],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2025-10-10T00:00:00"}