[OSF19]	T. Orekondy, B. Schiele, and M. Fritz. “Knockoff nets: Stealing functionality of black-box models”. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2019, pp. 4954–4963 (cit. on p. 4).
[PAEGT16]	N. Papernot, M. Abadi, U. Erlingsson, I. Goodfellow, and K. Talwar. “Semi-supervised knowledge transfer for deep learning from private training data”. In: arXiv preprint arXiv:1610.05755 (2016) (cit. on pp. 1, 3).
[PGSKSG20]	S. Pal, Y. Gupta, A. Shukla, A. Kanade, S. Shevade, and V. Ganapathy. “Activethief: Model extraction using active learning and unannotated public data”. In: Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 34. 2020, pp. 865–872 (cit. on p. 4).
[PPA18]	A. Polino, R. Pascanu, and D. Alistarh. “Model compression via distillation and quantization”. In: arXiv preprint arXiv:1802.05668 (2018) (cit. on p. 1).
[SCGL19]	S. Sun, Y. Cheng, Z. Gan, and J. Liu. “Patient knowledge distillation for bert model compression”. In: arXiv preprint arXiv:1908.09355 (2019) (cit. on p. 1).
[SDSOJ19]	A. Sablayrolles, M. Douze, C. Schmid, Y. Ollivier, and H. Jégou. “White-box vs black-box: Bayes optimal strategies for membership inference”. In: International Conference on Machine Learning. PMLR. 2019, pp. 5558–5567 (cit. on p. 2).
[SH21]	V. Shejwalkar and A. Houmansadr. “Membership privacy for machine learning models through knowledge transfer”. In: Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 35. 2021, pp. 9549–9557 (cit. on pp. 1, 3, 4, 9, 13).
[SSSS17]	R. Shokri, M. Stronati, C. Song, and V. Shmatikov. “Membership inference attacks against machine learning models”. In: 2017 IEEE symposium on security and privacy (SP). IEEE. 2017, pp. 3–18 (cit. on pp. 1, 2).
[TMSSNHM22]	X. Tang, S. Mahloujifar, L. Song, V. Shejwalkar, M. Nasr, A. Houmansadr, and P. Mittal. “Mitigating membership inference attacks by {Self-Distillation} through a novel ensemble architecture”. In: 31st USENIX Security Symposium (USENIX Security 22). 2022, pp. 1433–1450 (cit. on pp. 1, 3).
[TSSJLJHC22]	F. Tramér, R. Shokri, A. San Joaquin, H. Le, M. Jagielski, S. Hong, and N. Carlini. “Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets”. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. CCS '22. Los Angeles, CA, USA: Association for Computing Machinery, 2022, 2779–2792. ISBN: 9781450394505. URL: https://doi.org/10.1145/3548606.3560554 (cit. on p. 8).
[TZJRR16]	F. Tramér, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart. “Stealing machine learning models via prediction {APIs}”. In: 25th USENIX security symposium (USENIX Security 16). 2016, pp. 601–618 (cit. on pp. 2, 4, 10).
[WBKBGGG22]	Y. Wen, A. Bansal, H. Kazemi, E. Borgnia, M. Goldblum, J. Geiping, and T. Goldstein. “Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queries”. In: arXiv preprint arXiv:2210.10750 (2022) (cit. on p. 2).
[WGCS21]	L. Watson, C. Guo, G. Cormode, and A. Sablayrolles. “On the importance of difficulty calibration in membership inference attacks”. In: arXiv preprint arXiv:2111.08440 (2021) (cit. on p. 2).
[XLHL20]	Q. Xie, M.-T. Luong, E. Hovy, and Q. V. Le. “Self-training with noisy student improves imogenet classification”. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2020, pp. 10687–10698 (cit. on pp. 1, 14).