Jun 2026· Journal of Administrative and Economic Sciences· pp. 1-9· 0 citations· 14 references
TL;DR
It is demonstrated that L2 regularization provides comparable defence against membership inference attacks as DP-SGD, particularly for larger datasets, and that L2 regulation achieves precision, recall, and accuracy values within 2-4% of those achieved by DP-SGD across all experimental conditions.
Abstract
Differential privacy (DP) is a widely used technique for protecting sensitive information in machine learning. A membership inference attack (MIA) attempts to determine whether a specific data record was used to train a model, even when the attacker has no knowledge of the model’s internal structure.
This paper empirically investigates and compares the effectiveness of two mitigation techniques—differential privacy via stochastic gradient descent (DPSGD) and L2 regularisation—in defending deep learning models against such attacks. Using a black-box attack framework with shadow models on the CIFAR-10 dataset, we measure attack precision, recall, and accuracy across varying dataset sizes and output formats (probabilistic vs. digital).
Our results demonstrate that L2 regularization provides comparable defence against membership inference attacks as DP-SGD, particularly for larger datasets, Specifically, both methods reduce attack accuracy to the range of 0.05-0.06, with L2 regulation achieving precision, recall, and accuracy values within 2-4% of those achieved by DP-SGD across all experimental conditions. While DP-SGD offers formal privacy guarantees with a privacy budget of ε=1.12, it incurs a higher computational cost (approximately 3 times longer training time) and introduces noise into model predictions.
In contrast, L2 regularisation—a simple, low-cost method designed to reduce overfitting—emerges as an empirically effective and practical alternative for mitigating membership inference risks without sacrificing utility or performance.
High-quality data are essential for machine learning and data-driven research, yet data scarcity and privacy concerns remain major obstacles in many domains. Generative models have recently emerged as a promising approach to synthesize data that follow the same statistical distribution as real datasets. However, generative models are vulnerable to membership inference attacks, which threaten data confidentiality by exploiting model outputs to infer whether specific samples were used in training. Existing defense strategies struggle to simultaneously preserve data utility and provide robust privacy protection. To address this challenge, we propose our PPGM-GAN, a Privacy-Preserving GAN for synthetic data against membership inference attack to balance both data utility and data privacy. PPGM-GAN balances privacy and utility through a privacy-utility tradeoff function that quantifies and optimizes both aspects under different adversarial knowledge. To enhance data utility, we incorporate conditional generation and key-attribute screening to ensure sufficient representation of infrequent attribute values. Additionally, differential privacy is employed during training to prevent overfitting and reduce privacy leakage. Experimental results demonstrate that PPGM-GAN outperforms state-of-the-art privacy-preserving generative models, producing high-utility synthetic data under the same privacy constraints.
Guizhang Cui, Guowei Wu, Lin Yao et al.· ACM Transactions on Privacy...· 0 citations
: Membership Inference Attacks (MIAs) pose a significant privacy risk in machine learning by enabling adversaries to infer whether specific data samples were used during training, particularly in sensitive domains such as social media and mental health analytics. To address this challenge, this paper proposes HEbdMIA, a lightweight homomorphic encryption-based defense that operates at the post-inference stage by encrypting model output logits without requiring retraining or architectural modifications. The proposed approach preserves the relative ordering of predictions while obscuring confidence patterns exploited by MIAs. Experimental evaluation on DepInferAttack and BotInferAttack demonstrates that HEbdMIA achieves a reduction in MIA success rates of 31.0% and 27.3%, respectively, with an associated accuracy decrease of 29.3% and 26.4%, reflecting a controlled privacy and utility trade off. Additional analysis using precision, recall, F1-score, and ROC-AUC confirms a substantial decline in adversarial inference capability. These findings indicate that HEbdMIA provides an effective, scalable, and deployment-friendly solution for enhancing privacy in real-world machine learning systems.
Akash Shah, M. A. Wani, R. Chaturvedi et al.· Computers, Materials & C...· 0 citations
Amid the rapid proliferation of big data and machine learning technologies, concerns around data privacy breaches have grown increasingly acute. Differential privacy offers a mathematically rigorous framework for privacy preservation and has found broad adoption in a range of machine learning settings. Still, conventional approaches tend to rely on static, uniform noise injection strategies—failing to account for the fact that different features and stages of training may have vastly dissimilar privacy sensitivities. As a consequence, privacy budgets are often used inefficiently, and model utility suffers noticeably. In response to these limitations, we introduce an attention-driven dynamic differential privacy mechanism that enables adaptive allocation of privacy budgets. Our design aims to uphold strong protection without sacrificing model performance as much as before. Specifically, we build a lightweight multi-head attention component that dynamically evaluates each feature’s relevance and the current phase of training, adjusting the intensity of injected noise on the fly. This component is designed for easy integration into existing deep learning pipelines without major structural modifications. We evaluate our method on the MNIST benchmark, and results show clear improvements in classification accuracy under identical privacy constraints. Further, we provide visual evidence through attention heatmaps and noise variation trajectories, which together offer interpretable support for the adaptive mechanism's effectiveness.
Haining Shang· Frontiers in Computing and I...· 0 citations
This paper studies embedding-space privacy as a representation-level learning problem. Rather than altering raw records directly, the proposed framework applies embeddingspace transformation to full-record representations through Gaussian perturbation and adversarial representation sanitization. The method is evaluated through ablation across utility metrics, linkage attacks, attribute-inference attacks, and membership-inference tests. The primary empirical evaluation uses a synthetic fusion recommendation benchmark built from MovieLens [1], [2] 32M behavior and Adult-derived demographics [3], while a secondary synthetic medical benchmark is used to examine cross-domain transferability under more constrained conditions. The strongest results appear in the recommendation experiments. Under grouped demographic privacy evaluation, the combined condition preserves recommendation utility with $N D C G {@} K=0.6312$ while reducing exact and entity linkage from 0.7090/0.7204 to 0.0001/0.0000. Sensitive-target attacker performance remains near the majority baseline, supporting the claim of empirical privacy improvement without visible ranking degradation in that benchmark. The healthcare experiments also demonstrate meaningful embedding transformation and linkage reduction, though the current benchmark remains datalimited and therefore less conclusive for utility-focused evaluation. Overall, the findings support the conclusion that embeddingspace transformation can preserve downstream utility while substantially reducing linkage risk and sensitive-information recoverability under explicit attacker evaluation. The findings support embedding-space transformation as a practical privacypreserving strategy for embedding-driven AI systems under explicit attacker evaluation.
D. Panagoulias, Evangelia-Aikaterini Tsichrintzi, E. Sakkopoulos· International Conference on...· 0 citations
: The increasing deployment of deep learning models has raised important concerns regarding data privacy. In particular, Membership Inference Attacks (MIAs) aim to determine whether a specific data sample was used to train a model, potentially exposing sensitive information. To address this issue, we propose Risk Score guided Knowledge Distillation (RS-KD), a defense mechanism that dynamically adapts the distillation process according to a privacy risk score estimated from the output characteristics of a teacher model. This risk estimation enables the identification of samples that are more vulnerable to MIAs, allowing the framework to selectively regulate the uncertainty introduced during distillation. Experimental results on benchmark datasets demonstrate that RS-KD significantly reduces the effectiveness of black-box MIAs while preserving predictive performance, achieving a favorable privacy–utility trade-off.
R. Kassa, K. Adi, Abdelkamel Tari· Proceedings of the 23rd Inte...· 0 citations
This paper presents a systematic framework for membership inference attacks, in which an adversary with only black-box query access to a deployed classifier determines whether a specific individual's record was part of its training set.
Pramod Prakash· International Journal of Int...· 0 citations