% Bibliography for TS-RaMIA paper

% ==== Membership Inference Attacks ====
@inproceedings{shokri2017membership,
  title={Membership inference attacks against machine learning models},
  author={Shokri, Reza and Stronati, Marco and Song, Congzheng and Shmatikov, Vitaly},
  booktitle={IEEE Symposium on Security and Privacy (SP)},
  pages={3--18},
  year={2017},
  organization={IEEE}
}

@inproceedings{yeom2018privacy,
  title={Privacy risk in machine learning: Analyzing the connection to overfitting},
  author={Yeom, Samuel and Giacomelli, Irene and Fredrikson, Matt and Jha, Somesh},
  booktitle={IEEE Computer Security Foundations Symposium (CSF)},
  pages={268--282},
  year={2018},
  organization={IEEE}
}

@inproceedings{carlini2021extracting,
  title={Extracting training data from large language models},
  author={Carlini, Nicholas and Tramer, Florian and Wallace, Eric and Jagielski, Matthew and Herbert-Voss, Ariel and Lee, Katherine and Roberts, Adam and Brown, Tom and Song, Dawn and Erlingsson, {\'U}lfar and others},
  booktitle={USENIX Security Symposium},
  pages={2633--2650},
  year={2021}
}

@inproceedings{carlini2023quantifying,
  title={Quantifying memorization across neural language models},
  author={Carlini, Nicholas and Ippolito, Daphne and Jagielski, Matthew and Lee, Katherine and Tramer, Florian and Zhang, Chiyuan},
  booktitle={International Conference on Learning Representations (ICLR)},
  year={2023}
}

@inproceedings{watson2021de,
  title={De-anonymizing text by fingerprinting language generation},
  author={Watson, Christopher and Hoque, Enamul},
  booktitle={Findings of the Association for Computational Linguistics: EMNLP 2021},
  pages={1311--1323},
  year={2021}
}

% ==== Symbolic Music & Models ====
@inproceedings{huang2018musictransformer,
  title={Music transformer},
  author={Huang, Cheng-Zhi Anna and Vaswani, Ashish and Uszkoreit, Jakob and Simon, Ian and Hawthorne, Curtis and Shazeer, Noam and Dai, Andrew M and Hoffman, Matthew D and Dinculescu, Monica and Eck, Douglas},
  booktitle={International Society for Music Information Retrieval Conference (ISMIR)},
  year={2018}
}

@inproceedings{huang2020remi,
  title={Pop music transformer: Beat-based modeling and generation of expressive pop piano compositions},
  author={Huang, Yu-Siang and Yang, Yi-Hsuan},
  booktitle={ACM International Conference on Multimedia},
  pages={1180--1188},
  year={2020}
}

@inproceedings{hawthorne2019maestro,
  title={Enabling factorized piano music modeling and generation with the {MAESTRO} dataset},
  author={Hawthorne, Curtis and Stasyuk, Andriy and Roberts, Adam and Simon, Ian and Huang, Cheng-Zhi Anna and Dieleman, Sander and Elsen, Erich and Engel, Jesse and Eck, Douglas},
  booktitle={International Conference on Learning Representations (ICLR)},
  year={2019}
}

@misc{abcnotation,
  title={{ABC} notation standard},
  author={{ABC Notation Community}},
  howpublished={\url{http://abcnotation.com/}},
  year={2023}
}

@misc{notagen,
  title={{NotaGen}: Symbolic music generation with transformer-based models},
  author={{NotaGen Team}},
  howpublished={\url{https://huggingface.co/NotaGen}},
  year={2023},
  note={Accessed: 2025-10-21}
}

% ==== Tools ====
@misc{miditok,
  title={{MIDITok}: A Python library for {MIDI} tokenization},
  author={Nathan Fradet},
  howpublished={\url{https://github.com/Natooz/MidiTok}},
  year={2021}
}

@inproceedings{music21,
  title={Music21: A toolkit for computer-aided musicology and symbolic music data},
  author={Cuthbert, Michael Scott and Ariza, Christopher},
  booktitle={International Society for Music Information Retrieval Conference (ISMIR)},
  pages={637--642},
  year={2010}
}

% ==== Statistical Methods ====
@article{delong1988comparing,
  title={Comparing the areas under two or more correlated receiver operating characteristic curves: A nonparametric approach},
  author={DeLong, Elizabeth R and DeLong, David M and Clarke-Pearson, Daniel L},
  journal={Biometrics},
  volume={44},
  number={3},
  pages={837--845},
  year={1988},
  publisher={JSTOR}
}

% ==== Language Models ====
@inproceedings{vaswani2017attention,
  title={Attention is all you need},
  author={Vaswani, Ashish and Shazeer, Noam and Parmar, Niki and Uszkoreit, Jakob and Jones, Llion and Gomez, Aidan N and Kaiser, {\L}ukasz and Polosukhin, Illia},
  booktitle={Advances in Neural Information Processing Systems (NeurIPS)},
  volume={30},
  year={2017}
}

@article{merity2017pointer,
  title={Pointer sentinel mixture models},
  author={Merity, Stephen and Xiong, Caiming and Bradbury, James and Socher, Richard},
  journal={arXiv preprint arXiv:1609.07843},
  year={2017}
}

% ==== Additional entries can be added as needed ====

@inproceedings{von2024notagen,
  title={NotaGen: A Generative Music Transformer for ABC Notation},
  author={Von Rubel, Luca and Simonetta, Federico and Cherla, Stavros and Liu, Zhu and Widmer, Gerhard},
  booktitle={Proceedings of the International Conference on Music Information Retrieval (ISMIR)},
  year={2024}
}

@inproceedings{mireshghallah2022quantifying,
  title={Quantifying privacy risks of masked language models using membership inference attacks},
  author={Mireshghallah, Fatemehsadat and Goyal, Kartik and Uniyal, Archit and Berg-Kirkpatrick, Taylor and Shokri, Reza},
  booktitle={EMNLP},
  pages={8332--8347},
  year={2022}
}

@article{abadi2016deep,
  title={Deep learning with differential privacy},
  author={Abadi, Martin and Chu, Andy and Goodfellow, Ian and McMahan, H Brendan and Mironov, Ilya and Talwar, Kunal and Zhang, Li},
  journal={ACM Conference on Computer and Communications Security},
  pages={308--318},
  year={2016}
}

@inproceedings{hildt2023privacy,
  title={Privacy risks in music generation models},
  author={Hildt, Emily and others},
  booktitle={Workshop on AI and Music},
  year={2023},
  note={Preliminary work}
}

@inproceedings{carlini2019secret,
  author = {Nicholas Carlini and Chang Liu and {\'U}lfar Erlingsson and Jernej Kos and Dawn Song},
  title = {The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks},
  booktitle = {28th {USENIX} Security Symposium ({USENIX} Security 19)},
  year = {2019},
  isbn = {978-1-939133-06-9},
  address = {Santa Clara, CA},
  pages = {267--284},
  url = {https://www.usenix.org/conference/usenixsecurity19/presentation/carlini},
  publisher = {{USENIX} Association},
  month = aug,
}

@inproceedings{zeng2021musicbert,
  title={Musicbert: Symbolic music understanding with large-scale pre-training},
  author={Zeng, Ming and Tan, Xu and Wang, Rui and Ju, Zeqian and Qin, Tao and Liu, Tie-Yan},
  booktitle={Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021},
  pages={3861--3872},
  year={2021}
}

@inproceedings{rezaei2021difficulty,
  author={Rezaei, Morteza and Liu, Xin},
  title={On the Difficulty of Membership Inference Attacks},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  pages={13434--13443},
  year={2021}
}

@inproceedings{choquette2021labelonly,
  title={Label-Only Membership Inference Attacks},
  author={Choquette-Choo, Christopher A. and Tramer, Florian and Carlini, Nicholas and Papernot, Nicolas},
  booktitle={Proceedings of the 38th International Conference on Machine Learning},
  pages={1964--1974},
  year={2021},
  editor={Meila, Marina and Zhang, Tong},
  volume={139},
  series={Proceedings of Machine Learning Research},
  month={18--24 Jul},
  publisher={PMLR},
  pdf={https://proceedings.mlr.press/v139/choquette-choo21a/choquette-choo21a.pdf},
  url={https://proceedings.mlr.press/v139/choquette-choo21a.html}
}

@unpublished{jalalzai2022membership,
    title = {{Membership Inference Attacks via Adversarial Examples}},
    author = {Jalalzai, Hamid and Kadoche, Elie and Leluc, R{\'e}mi and Plassier, Vincent},
    note = {Trustworthy and Socially Responsible Machine Learning (TSRML 2022) co-located with NeurIPS 2022},
    year = {2022},
    url = {https://hal.science/hal-03910286}
}

@article{xue2025imia,
    title={Privacy Leaks by Adversaries: Adversarial Iterations for Membership Inference Attack},
    author={Xue, Jing and Sun, Zhishen and Ye, Haishan and Luo, Luo and Chang, Xiangyu and Tsang, Ivor and Dai, Guang},
    journal={arXiv preprint arXiv:2506.02711},
    year={2025}
}

@article{dealcala2025mint,
    title={Is my Data in your AI Model? Membership Inference Test with Application to Face Images},
    author={DeAlcala, Daniel and Morales, Aythami and Fierrez, Julian and Mancera, Gonzalo and Tolosana, Ruben and Ortega-Garciaa, Javier},
    journal={arXiv preprint arXiv:2402.09225},
    year={2025}
}


@inproceedings{das2025blind,
    author = {Das, Debeshee and Zhang, Jie and Tram{\`e}r, Florian},
    title = {Blind Baselines Beat Membership Inference Attacks for Foundation Models},
    booktitle = {ICLR 2025 Workshop on Data Problems},
    year = {2025},
    note = {Published as a paper at 2nd DATA-FM workshop @ ICLR 2025, Singapore}
}

@inproceedings{duan2023diffusion,
  title={Are Diffusion Models Vulnerable to Membership Inference Attacks?},
  author={Duan, Jinhao and Kong, Fei and Wang, Shiqi and Shi, Xiaoshuang and Xu, Kaidi},
  booktitle={Proceedings of the 40th International Conference on Machine Learning},
  pages={8867--8883},
  year={2023},
  editor={Krause, Andreas and Brunskill, Emma and Cho, Kyunghyun and Engelhardt, Barbara and Sra, Suvrit and Wilson, Andrew},
  volume={202},
  series={Proceedings of Machine Learning Research},
  month={23--29 Jul},
  publisher={PMLR}
}

@article{matsumoto2023diffusion,
    title={Membership Inference Attacks against Diffusion Models},
    author={Matsumoto, Tomoya and Miura, Takayuki and Yanai, Naoto},
    journal={arXiv preprint arXiv:2302.03262},
    year={2023}
}

@inproceedings{li2024vlm,
    author = {Li, Zhan and Wu, Yongtao and Chen, Yihang and Tonin, Francesco and Rocamora, Elias Abad and Cevher, Volkan},
    title = {Membership Inference Attacks against Large Vision-Language Models},
    booktitle = {38th Conference on Neural Information Processing Systems (NeurIPS 2024)},
    year = {2024}
}

@inproceedings{liu2025rag,
    author = {Liu, Mingrui and Zhang, Sixiao and Long, Cheng},
    title = {Mask-based Membership Inference Attacks for Retrieval-Augmented Generation},
    booktitle = {Proceedings of the ACM Web Conference 2025 (WWW '25)},
    year = {2025},
    month = {April},
    address = {Sydney, NSW, Australia},
    doi = {10.1145/3696410.3714771}
}

