[CSSWZ22] Y. Chen, C. Shen, Y. Shen, C. Wang, and Y. Zhang. "Amplifying Membership Exposure via Data Poisoning". In: Advances in Neural Information Processing Systems. Ed. by A. H. Oh, A. Agarwal, D. Belgrave, and K. Cho. 2022 (cit. on pp. 2, 8).
[CTWJHVLRBSE+21] N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson, et al. "Extracting training data from large language models". In: 30th USENIX Security Symposium (USENIX Security 21). 2021, pp. 2633-2650 (cit. on p. 2).
[DMNS06] C. Dwork, F. McSherry, K. Nissim, and A. Smith. “Calibrating noise to sensitivity in private data analysis”. In: Theory of cryptography conference. Springer. 2006, pp. 265–284 (cit. on pp. 1–3).
[FJR15] M. Fredrikson, S. Jha, and T. Ristenpart. "Model inversion attacks that exploit confidence information and basic countermeasures". In: Proceedings of the 22nd ACM SIGSAC conference on computer and communications security. 2015, pp. 1322-1333 (cit. on p. 2).
[FLTIA18] T. Furlanello, Z. Lipton, M. Tschannen, L. Itti, and A. Anandkumar. "Born again neural networks". In: International Conference on Machine Learning. PMLR. 2018, pp. 1607-1616 (cit. on p. 14).
[K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov. "Property inference attacks on fully connected neural networks using permutation invariant representations". In: Proceedings of the 2018 ACM SIGSAC conference on computer and communications security. 2018, pp. 619-633 (cit. on p. 2).]
[HVD+15] G. Hinton, O. Vinyals, J. Dean, et al. "Distilling the knowledge in a neural network". In: arXiv preprint arXiv:1503.02531 2.7 (2015) (cit. on pp. 1, 3, 8).
[JCBKP20] M. Jagielski, N. Carlini, D. Berthelot, A. Kurakin, and N. Papernot. "High accuracy and high fidelity extraction of neural networks". In: 29th USENIX security symposium (USENIX Security 20). 2020, pp. 1345-1362 (cit. on pp. 4, 10).
[QLJT19] T. Jain, C. Lennan, Z. John, and D. Tran. Imageededup. https://github.com/idealo/imagededup.2019 (cit. on p. 4).
[JWKGE20] B. Jayaraman, L. Wang, K. Knipmeyer, Q. Gu, and D. Evans. "Revisiting membership inference under realistic assumptions". In: arXiv preprint arXiv:2005.10881 (2020) (cit. on p. 2).
[KPK18] J. Kim, S. Park, and N. Kwak. "Paraphrasing complex network: Network compression via factor transfer". In: Advances in neural information processing systems 31 (2018) (cit. on p. 1).
[LBWBWTGC18] Y. Long, V. Bindschaedler, L. Wang, D. Bu, X. Wang, H. Tang, C. A. Gunter, and K. Chen. "Understanding membership inferences on well-generalized learning models". In: arXiv preprint arXiv:1802.04889 (2018) (cit. on p. 2).
[LZ21] Z. Li and Y. Zhang. "Membership leakage in label-only exposures". In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 2021, pp. 880-895 (cit. on p. 2).
[LZZHCZ22] C. Liang, S. Zuo, Q. Zhang, P. He, W. Chen, and T. Zhao. "Less is More: Task-aware Layer-wise Distillation for Language Model Compression". In: arXiv preprint arXiv:2210.01351 (2022) (cit. on p. 4).
[MBIWK22] F. Mireshghallah, A. Backurs, H. A. Inan, L. Wutschitz, and J. Kulkarni. "Differentially Private Model Compression". In: arXiv preprint arXiv:2206.01838 (2022) (cit. on p. 3).
[MHHVEHP22] F. Mazzone, L. van den Heuvel, M. Huber, C. Verdecchia, M. Everts, F. Hahn, and A. Peter. "Repeated Knowledge Distillation with Confidence Masking to Mitigate Membership Inference Attacks". In: Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security. AISec'22. Los Angeles, CA, USA: Association for Computing Machinery, 2022,