[1] Nicholas Carlini et al. "The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks." In: USENIX Security Symposium. Vol. 267. 2019.
[2] Vitaly Feldman. "Does learning require memorization? a short tale about a long tail". In: Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing. 2020, pp. 954-959.
[3] Reza Shokri et al. "Membership inference attacks against machine learning models". In: 2017 IEEE symposium on security and privacy (S&P). IEEE. 2017, pp. 3-18.
[4] Saeed Mahloujifar et al. "Optimal Membership Inference Bounds for Adaptive Composition of Sampled Gaussian Mechanisms". In: arXiv preprint arXiv:2204.06106 (2022).
[5] Cynthia Dwork et al. "Calibrating noise to sensitivity in private data analysis". In: Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3. Springer. 2006, pp. 265-284.
[6] Larry Wasserman and Shuheng Zhou. “A statistical framework for differential privacy”. In: Journal of the American Statistical Association 105.489 (2010), pp. 375–389.
[7] Jinshuo Dong, Aaron Roth, and Weijie Su. "Gaussian Differential Privacy". In: Journal of the Royal Statistical Society (2021).
[8] Jerzy Neyman and Egon Sharpe Pearson. "IX. On the problem of the most efficient tests of statistical hypotheses". In: Philosophical Transactions of the Royal Society of London. Series A, Containing Papers of a Mathematical or Physical Character 231.694-706 (1933), pp. 289-337.
[9] Milad Nasr et al. "Adversary instantiation: Lower bounds for differentially private machine learning". In: 2021 IEEE Symposium on Security and Privacy (SP). IEEE. 2021, pp. 866-882.
[10] Matthew Jagielski, Jonathan Ullman, and Alina Oprea. "Auditing differentially private machine learning: How private is private SGD?" In: Advances in Neural Information Processing Systems 33 (2020), pp. 22205-22216.
[11] Milad Nasr et al. "Tight Auditing of Differentially Private Machine Learning". In: arXiv preprint arXiv:2302.07956 (2023).
[12] Nicholas Carlini et al. "Membership inference attacks from first principles". In: 2022 IEEE Symposium on Security and Privacy (SP). IEEE. 2022, pp. 1897-1914.
[13] Lauren Watson et al. "On the importance of difficulty calibration in membership inference attacks". In: arXiv preprint arXiv:2111.08440 (2021).
[14] Jiayuan Ye et al. "Enhanced membership inference attacks against machine learning models". In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 2022, pp. 3093-3106.
[15] Martin Abadi et al. "Deep learning with differential privacy". In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 2016, pp. 308-318.
[16] Samuel Maddock, Alexandre Sablayrolles, and Pierre Stock. "CANIFE: Crafting Canaries for Empirical Privacy Measurement in Federated Learning". In: arXiv preprint arXiv:2210.02912 (2022).
[17] Yugeng Liu et al. “{ML-Doctor}: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models”. In: 31st USENIX Security Symposium (USENIX Security 22). 2022, pp. 4525–4542.
[18] Alexandre Sablayrolles et al. "White-box vs black-box: Bayes optimal strategies for membership inference". In: International Conference on Machine Learning. PMLR. 2019, pp. 5558-5567.