[19] Zuxing Li, Tobias J Oechtering, and Deniz Gündüz. “Privacy against a hypothesis testing adversary”. In: IEEE Transactions on Information Forensics and Security 14.6 (2018), pp. 1567-1581.
[20] Benedetta Tondi, Mauro Barni, and Neri Merhav. "Detection games with a fully active attacker". In: 2015 IEEE International Workshop on Information Forensics and Security (WIFS). IEEE. 2015, pp. 1-6.
[21] Kamalika Chaudhuri, Jacob Imola, and Ashwin Machanavajjhala. "Capacity bounded differential privacy". In: Advances in Neural Information Processing Systems 32 (2019).
[22] Yuqing Zhu, Jinshuo Dong, and Yu-Xiang Wang. "Optimal accounting of differential privacy via characteristic function". In: International Conference on Artificial Intelligence and Statistics. PMLR. 2022, pp. 4782-4817.
[23] Sivakanth Gopi, Yin Tat Lee, and Lukas Wutschitz. "Numerical composition of differential privacy". In: Advances in Neural Information Processing Systems 34 (2021), pp. 11631-11642.
[24] Peter Kairouz, Sewoong Oh, and Pramod Viswanath. "The composition theorem for differential privacy". In: International conference on machine learning. PMLR. 2015, pp. 1376-1385.
[25] E.L. Lehmann and Joseph P. Romano. Testing Statistical Hypotheses. 4th ed. Singapore: Springer Nature, 2022. ISBN: 978-3-030-70578-7.
[26] Damien Desfontaines and Balázs Pejó. "Sok: differential privacies". In: Proceedings on privacy enhancing technologies 2020.2 (2020), pp. 288-313.
[27] Yucui Liu and Tomasz J Kozubowski. “A folded Laplace distribution”. In: Journal of Statistical Distributions and Applications 2.1 (2015), pp. 1-17.
[28] H. Urkowitz. "Energy detection of unknown deterministic signals". In: Proceedings of the IEEE 55.4 (1967), pp. 523-531.
[29] Zhiqi Bu et al. "Deep learning with gaussian differential privacy". In: Harvard data science review 2020.23 (2020), pp. 10-1162.
[30] Bradley Efron et al. "Least angle regression". In: The Annals of Statistics 32.2 (2004), pp. 407-499.
[31] Borja Balle, Giovanni Cherubin, and Jamie Hayes. "Reconstructing training data with informed adversaries". In: 2022 IEEE Symposium on Security and Privacy (SP). IEEE. 2022, pp. 1138-1156.
[32] Jamie Hayes, Saeed Mahloujifar, and Borja Balle. “Bounding Training Data Reconstruction in DP-SGD”. In: arXiv preprint arXiv:2302.07225 (2023).
[33] Georgios Kaissis et al. "Bounding data reconstruction attacks with the hypothesis testing interpretation of differential privacy". In: arXiv preprint arXiv:2307.03928 (2023).
[34] Samuel Karlin and Herman Rubin. "The theory of decision procedures for distributions with monotone likelihood ratio". In: The Annals of Mathematical Statistics (1956), pp. 272-299.
[35] Antonio De Maio, Steven M Kay, and Alfonso Farina. "On the invariance, coincidence, and statistical equivalence of the GLRT, Rao test, and Wald test". In: IEEE Transactions on Signal Processing 58.4 (2009), pp. 1967-1979.
[36] Jess Marcum. “A statistical theory of target detection by pulsed radar”. In: IRE Transactions on Information Theory 6.2 (1960), pp. 59–267.
[37] Helena Klause et al. "Differentially private training of residual networks with scale normalisation". In: arXiv preprint arXiv:2203.00324 (2022).
[38] Soham De et al. "Unlocking high-accuracy differentially private image classification through scale". In: arXiv preprint arXiv:2204.13650 (2022).
[39] Jacob Devlin et al. "Bert: Pre-training of deep bidirectional transformers for language understanding". In: arXiv preprint arXiv:1810.04805 (2018).
[40] Alexey Kurakin et al. "Toward training at imagenet scale with differential privacy". In: arXiv preprint arXiv:2201.12328 (2022).
[41] Qinqing Zheng et al. "Sharp composition bounds for Gaussian differential privacy via Edge-worth expansion". In: International Conference on Machine Learning. PMLR. 2020, pp. 11420-11435.
[42] Alexandre Lacoste et al. "Quantifying the Carbon Emissions of Machine Learning". In: arXiv preprint arXiv:1910.09700 (2019).