Before revision:  In this paper, we show that these two goals of ensemble learning, namely improving accuracy and privacy , directly conflict with each other . Using a wide range of datasets and model architectures, we empirically demonstrate the trade-off between privacy and accuracy in deep ensemble learning. We find that ensembling can improve either privacy or accuracy, but not both simultaneously -- when ensembling improves the classification accuracy, the effectiveness of the MI attack also increases.
After revision:  In this paper, we show that these two goals of ensemble learning, namely improving accuracy and privacy , directly conflict with each other . Using a wide range of datasets and model architectures, we show that the effectiveness of membership inference attacks also increases when ensembling improves the classification accuracy, the effectiveness of the MI attack also increases.