Before revision:  Our evaluation of defenses against MI attacks , such as regularization and differential privacy , shows that they can mitigate the effectiveness of the MI attackbut simultaneously degrade ensemble accuracy.
After revision:  Our evaluation of defenses against MI attacks , such as regularization and differential privacy . We show that while these defenses can mitigate the effectiveness of the MI attackbut simultaneously degrade ensemble accuracy.