## 2 Related Work
### Machine Learning Privacy Attacks  
Table 1 covers the different types of privacy attacks that can be performed against ML models, as well as the references that address these attacks. The work [16], in particular, studies ways to reduce MIAs, with an emphasis on detecting records in the set of model training. The study by [17] investigates the evaluation of MIAs in ML models, which helps to improve the understanding of privacy issues [33]. Another study by [18] emphasizes the vulnerability of ML models to MIAs, and attempts to determine whether a data record was used to train a target model. The work in [19] explores MIAs against generative models, where the adversary aims to identify whether a specific data point was used to train the model. Another work by [20] addresses the effect of data provenance on membership inference, addressing privacy concerns related to the origin and history of data. Another study by [21] investigates larger privacy problems in ML models, with a particular emphasis on tackling MIAs. The groundwork for understanding MIAs and their consequences for privacy in ML is investigated by [22]. The first row in Table 1 investigates several studies on membership inference attacks, and is aimed at determining whether specific data points were used in model training. The second row in Table 1 investigates various aspects of model inversion attacks, including their impact on privacy, methods to measure model inversion risks, and strategies to mitigate these attacks. The work in [23] focuses on the impact of confidence values on increasing the level of complexity of these attacks. The work in [24] develops an evaluation approach for DP learning against model inversion attacks in the context of neural network models. The work in [25] investigates updates leak attacks, highlighting the possibility of \begin{table}
\begin{tabular}{l l l l} \hline \hline
**No.** & **Study** & **Attacks** & **Category** \\ \hline  & [16] & Membership Inference & MIA: These methods are used by attackers to determine whether a data point was used to train an ML model. The attackers do not have direct access to ML model parameters but observe its output, and their intention is to access sensitive information of individuals. \\ \hline  & [23] & MIA w/ Confidence Values & Model Inversion Attacks: These methods are used first to understand the structure of the model and then to reconstruct the original data using optimization techniques on input data to produce the same output. \\ \hline  & [27] & The Secret Sharer & Property Inference Attacks: These attacks uncover sensitive properties of a model. They are not related to training tasks. \\ \hline
4 & [30] & Cache Telepathy & Inference attacks of parameters: steals \\  & [31] & Stealing hyperparameters & model parameters. \\ \hline
5 & [32] & Stealing ML Models & Hyperparameter Inference Attacks: steals the hyperparameters used to train the model. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Machine learning privacy attacks. information leakage during model updates and the implications for privacy. Collaborative inference attacks and proposed solutions to mitigate membership inference vulnerabilities in collaborative ML systems are addressed by [26]. The third row in Table 1 investigates several aspects of property inference attacks, such as their influence on privacy, methods to measure property inference risks, and mitigation solutions. Specifically, the work in [27] investigates property inference attacks, with an emphasis on the confidentiality of shared information in ML models. The work of [28] investigates property inference attacks on fully connected neural networks, emphasizing model property extraction. Emphasizing their potential exploitation and compromise of smart machine security, property inference attacks are investigated by [29]. The fourth row in Table 1 investigates various aspects of parameter inference attacks. The work in [30] investigates parameter inference attacks, focusing on cache telepathy as a method of retrieving critical model parameters.