
\begin{table*}[t!]
    \small
  \centering
  \caption{Trade-offs between privacy and utility. The MIAs evaluation results are reported in AUC Scores. Higher is better in train/test accuracy ($\uparrow$) while lower is better in AUC for all MIAs  ($\downarrow$).}
    \begin{subtable}[t]{1.0\textwidth}
    \centering
  \caption{On CIFAR-10
  %Higher testing accuracy and lower MIAs accuracy (NN-Based and AdvDist) are better in performance.
  }
  \resizebox{1.0\linewidth}{!}{
  \begin{tabular}{l|lnn|nnnn}
    \toprule \rowcolor{white} 
    \bfseries Model & \bfseries Approach & \bfseries Train Acc. (\%) $\uparrow$ & \bfseries Test Acc. (\%) $\uparrow$ & \bfseries NN-Based (\%) $\downarrow$ & \bfseries Entropy (\%) $\downarrow$ & \bfseries M-Entropy (\%) $\downarrow$ & \bfseries Grad-x $\ell_2$ (\%) $\downarrow$ \\
    \midrule
     %\multirow{4}{*}{VGG11} 
     \rowcolor{white}        & CE (no defense)  &100.00(±0.00) & 76.46(±0.30) & 76.31(±0.24) & 74.16(±0.26) & 74.90(±0.25) & 75.33(±0.26) \\ 
     \rowcolor{white}        & AdvReg           & 99.29(±0.31) & 69.52(±0.64) & 72.44(±0.96) & 64.96(±1.12) & 69.23(±1.19) & 69.84(±1.61) \\
     \rowcolor{white}        & RelaxLoss        & 73.00(±3.71) & 64.15(±3.02) & 64.54(±0.77) & 56.89(±0.90) & 60.78(±0.68) & 66.22(±0.67) \\ 
     \multirow{-4}{*}{VGG11} & CRL (ours)       & 89.37(±0.26) & 73.69(±0.36) & 61.33(±0.18) & 61.95(±0.42) & 62.48(±0.40) & 61.95(±0.42) \\ 
        
    \midrule
     %\multirow{4}{*}{ResNet18}
     \rowcolor{white}           & CE (no defense)  &100.00(±0.00) & 70.31(±0.33) & 88.09(±0.23) & 85.91(±0.32) & 86.44(±0.31) & 86.32(±0.31) \\
     \rowcolor{white}           & AdvReg           & 97.57(±2.00) & 54.97(±5.27) & 77.54(±2.12) & 71.10(±1.07) & 79.28(±1.45) & 70.70(±5.11) \\
     \rowcolor{white}           & RelaxLoss        & 91.56(±1.91) & 69.25(±0.40) & 77.32(±1.33) & 71.51(±2.37) & 72.25(±1.93) & 73.51(±1.69) \\
     \multirow{-4}{*}{ResNet18} & CRL (ours)       & 86.73(±1.25) & 71.53(±0.50) & 60.21(±1.35) & 63.70(±1.87) & 65.15(±1.90) & 65.34(±1.66) \\

    \midrule
     %\multirow{4}{*}{DenseNet121}
     \rowcolor{white}               & CE (no defense)  &100.00(±0.00) & 84.73(±0.33) & 59.00(±0.30) & 65.78(±0.25) & 66.38(±0.23) & N/A\\
     \rowcolor{white}               & AdvReg           & 99.98(±0.02) & 81.72(±0.75) & 55.96(±1.75) & 63.69(±2.81) & 64.94(±2.43) & N/A\\
     \rowcolor{white}               & RelaxLoss        & 92.70(±1.45) & 80.22(±0.94) & 54.38(±0.29) & 57.42(±0.43) & 59.12(±0.34) & N/A\\
     \multirow{-4}{*}{DenseNet121}  & CRL (ours)       & 91.82(±0.39) & 83.03(±0.35) & 51.49(±0.06) & 53.28(±0.11) & 55.23(±0.11) & N/A\\
    \bottomrule
  \end{tabular}
  }
  \label{tab:res_cifar10}
  \end{subtable}
\begin{subtable}[t]{1.0\textwidth}
\small
  \centering
  \caption{On CIFAR-100, data augmentations applied}
  \resizebox{1.0\linewidth}{!}{
  \begin{tabular}{l|lnn|nnnn}
    \toprule \rowcolor{white} 
     \bfseries Model & \bfseries Approach & \bfseries Train Acc. (\%) $\uparrow$ & \bfseries Test Acc. (\%) $\uparrow$ & \bfseries NN-Based (\%) $\downarrow$ & \bfseries Entropy (\%) $\downarrow$ & \bfseries M-Entropy (\%) $\downarrow$ & \bfseries Grad-x $\ell_2$ (\%) $\downarrow$ \\
    \midrule
    %\multirow{4}{*}{GoogLeNet}
        \rowcolor{white}            & CE (no defense)  & 99.78(±0.06) & 58.59(±0.32) & 82.70(±0.33) & 77.40(±0.46) & 79.56(±0.38) & 79.78(±0.39) \\
        \rowcolor{white}            & AdvReg           & 99.22(±0.23) & 52.45(±1.22) & 84.02(±1.19) & 76.20(±2.12) & 81.42(±1.29) & 80.07(±1.12) \\
        \rowcolor{white}            & RelaxLoss        & 90.98(±0.76) & 57.90(±0.81) & 65.29(±0.58) & 70.13(±0.73) & 73.79(±0.81) & 74.54(±0.71) \\
        \multirow{-4}{*}{GoogLeNet} & CRL (ours)       & 87.39(±0.92) & 58.16(±0.23) & 64.72(±0.61) & 67.10(±0.68) & 70.08(±0.57) & 70.94(±0.47) \\
    \midrule
     %\multirow{4}{*}{ResNet18}
        \rowcolor{white}            & CE (no defense)  &100.00(±0.00) & 58.06(±0.62) & 86.88(±0.64) & 82.96(±0.49) & 84.04(±0.45) & 84.20(±0.42) \\
        \rowcolor{white}            & AdvReg           & 99.43(±0.47) & 48.98(±1.21) & 86.99(±1.43) & 79.87(±2.04) & 85.35(±1.59) & 80.03(±0.89) \\
        \rowcolor{white}            & RelaxLoss        & 77.46(±0.33) & 55.28(±0.47) & 69.87(±0.16) & 63.52(±0.16) & 66.60(±0.20) & 69.05(±0.23) \\
        \multirow{-4}{*}{ResNet18}  & CRL (ours)       & 79.74(±0.56) & 57.53(±0.29) & 66.48(±0.31) & 63.80(±0.19) & 65.09(±0.25) & 66.07(±0.25) \\
        
    \midrule
     %\multirow{4}{*}{DenseNet121}
        \rowcolor{white}                & CE (no defense)  & 99.01(±0.20) & 62.76(±0.40) & 58.92(±0.36) & 71.34(±0.48) & 74.46(±0.33) & N/A\\
        \rowcolor{white}                & AdvReg           & 99.16(±1.21) & 59.51(±0.80) & 59.90(±2.59) & 73.52(±4.44) & 77.10(±2.13) & N/A\\
        \rowcolor{white}                & RelaxLoss        & 73.46(±0.56) & 58.06(±0.15) & 55.12(±0.25) & 57.03(±0.25) & 61.05(±0.20) & N/A\\
        \multirow{-4}{*}{DenseNet121}   & CRL (ours)       & 77.39(±0.59) & 60.32(±0.50) & 50.23(±0.23) & 59.98(±0.27) & 61.58(±0.25) & N/A\\
    \bottomrule
  \end{tabular}
  }
  \label{tab:res_cifar100}
\end{subtable}
\begin{subtable}[t]{1.0\textwidth}
\small
  \centering
  \caption{On SVHN}
  \resizebox{1.0\linewidth}{!}{
  \begin{tabular}{l|lnn|nnnn}
    \toprule \rowcolor{white} 
     \bfseries Model & \bfseries Approach & \bfseries Train Acc. (\%) $\uparrow$ & \bfseries Test Acc. (\%) $\uparrow$ & \bfseries NN-Based (\%) $\downarrow$ & \bfseries Entropy (\%) $\downarrow$ & \bfseries M-Entropy (\%) $\downarrow$ & \bfseries Grad-x $\ell_2$ (\%) $\downarrow$ \\
    \midrule
     %\multirow{4}{*}{VGG11}   
        \rowcolor{white}        & CE (no defense)  & 99.98(±0.00) & 92.66(±0.04) & 53.09(±0.02) & 54.14(±0.06) & 54.63(±0.07) & 54.51(±0.06)  \\
        \rowcolor{white}        & AdvReg           & 98.72(±1.25) & 90.72(±1.63) & 52.40(±0.94) & 54.53(±1.38) & 55.31(±1.49) & 54.54(±0.87) \\
        \rowcolor{white}        & RelaxLoss        & 95.42(±0.15) & 91.65(±0.04) & 51.67(±0.09) & 52.02(±0.11) & 52.34(±0.10) & 52.36(±0.10)  \\
        \multirow{-4}{*}{VGG11} & CRL (ours)       & 94.70(±0.53) & 91.50(±0.55) & 50.15(±0.15) & 52.32(±0.16) & 52.48(±0.20) & 52.38(±0.18) \\
    \midrule
     %\multirow{4}{*}{ResNet18}
        \rowcolor{white}           & CE (no defense)  &100.00(±0.00) & 93.04(±0.07) & 52.93(±0.14) & 54.74(±0.10) & 55.07(±0.09) & 54.79(±0.09) \\
        \rowcolor{white}           & AdvReg           & 99.90(±0.17) & 90.47(±1.37) & 52.18(±0.51) & 55.14(±0.37) & 55.79(±0.47) & 55.07(±0.13)\\
        \rowcolor{white}           & RelaxLoss        & 95.39(±0.21) & 93.07(±0.25) & 51.80(±0.06) & 52.12(±0.05) & 52.23(±0.08) & 52.08(±0.05) \\
        \multirow{-4}{*}{ResNet18} & CRL (ours)       & 95.82(±0.24) & 93.13(±0.27) & 50.04(±0.04) & 51.92(±0.06) & 52.02(±0.07) & 51.89(±0.07) \\
    \midrule
  \end{tabular}
  }
  \label{tab:res_svhn}
  \end{subtable}
\end{table*}






% \begin{table*}[t!]
%     \small
%   \centering
%   \resizebox{0.9\linewidth}{!}{
%   \begin{tabular}{llrrrrrr}
%     \toprule
%     Model & Approach & Train Acc. (\%) & Test Acc. (\%) & NN-Based (\%) & Entropy (\%) & M-Entropy (\%) & Grad-x $\ell_2$ (\%) \\
%     \midrule
%     \multirow{4}{*}{VGG11}
%         & CE (no defense)  &100.00 & 76.46 & 76.31 & 74.16 & 74.90 & 75.33 \\
%         & CRL (ours)       & 89.37 & 73.69 & 61.33 & 61.95 & 62.48 & 61.95 \\
%         & AdvReg           & 99.29 & 69.52 & 72.44 & 64.96 & 69.23 & 69.84 \\
%         & RelaxLoss        & 73.00 & 64.15 & 64.54 & 56.89 & 60.78 & 66.22 \\
        
%     \midrule
%      \multirow{4}{*}{ResNet18}   
%         & CE (no defense)  &100.00 & 70.31 & 88.09 & 85.91 & 86.44 & 86.32 \\
%         & CRL (ours)       & 86.73 & 71.53 & 60.21 & 63.70 & 65.15 & 65.34 \\
%         & AdvReg           & 97.57 & 54.97 & 77.54 & 71.10 & 79.28 & 70.70 \\
%         & RelaxLoss        & 91.56 & 69.25 & 77.32 & 71.51 & 72.25 & 73.51 \\

%     \midrule
%      \multirow{4}{*}{DenseNet121}   
%         & CE (no defense)  &100.00 & 84.73 & 59.00 & 65.78 & 66.38 & N/A\\
%         & CRL (ours)       & 91.82 & 83.03 & 51.49 & 53.28 & 55.23 & N/A\\
%         & AdvReg           & 99.98 & 81.72 & 55.96 & 63.69 & 64.94 & N/A\\
%         & RelaxLoss        & 92.70 & 80.22 & 54.38 & 57.42 & 59.12 & N/A\\
%     \bottomrule
%   \end{tabular}
%   }
%   \caption{Comparisons on CIFAR-10 for trade-offs between privacy and utility. The MIAs evaluation results are reported in AUC Scores. Higher is better in test accuracy while lower is better in all MIAs
%   %Higher testing accuracy and lower MIAs accuracy (NN-Based and AdvDist) are better in performance.
%   }
%   \label{tab:res_cifar10}
% \end{table*}





\section{Experiments}
\subsection{Experimental Settings}
\paragraph{Attack and Defense Methods}
We mainly evaluate our methods and two state-of-the-art defense methods, \texttt{AdvReg} \cite{nasr2018advreg} and \texttt{RelaxLoss} \cite{chen2022relaxloss}. Also, we evaluate the following common defense methods:
%shown in Table.~\ref{tab:defence_method}.
%\texttt{Label-Smoothing} \cite{guo2017labelsmoothing, Rafael2019labelsmoothing}, \texttt{Early-Stopping}  and \texttt{Confidence-Penalty} \cite{pereyra2017confidencepenalty}.

\begin{itemize}
    \item Label-Smoothing: \cite{guo2017labelsmoothing, Rafael2019labelsmoothing}
    \item Early-Stopping 
    \item   Confidence-Penalty: \cite{pereyra2017confidencepenalty} 
    %\item AdvReg: \cite{nasr2018advreg} 
    \item DMP: \cite{shejwalkar2021dmp} 
    %\item RelaxLoss: \cite{chen2022relaxloss} 
\end{itemize}


% \begin{table}[!h]
%     \centering
%     \caption{Applied Defence Techniques.} 
%     \label{tab:defence_method}
%     \resizebox{1.0\linewidth}{!}{
%     \begin{tabular}{ll}
%         \toprule % from booktabs package
%         \bfseries Approach & \bfseries Reference \\
%         \midrule % from booktabs package
%         Label-Smoothing & \cite{guo2017labelsmoothing, Rafael2019labelsmoothing} \\
%         Early-Stopping & -\\
%         Confidence-Penalty & \cite{pereyra2017confidencepenalty} \\
%         AdvReg & \cite{nasr2018advreg} \\
%         DMP & \cite{shejwalkar2021dmp} \\
%         RelaxLoss & \cite{chen2022relaxloss} \\
%         \bottomrule % from booktabs package
%     \end{tabular}
%     }
% \end{table}






\begin{figure*}
    \centering
    \includegraphics[width=1.0\linewidth]{figs/acc_auc_c10.pdf}
    \caption{Performance of defenses against adaptive attacks (ResNet18, CIFAR-10).}
    \label{fig:acc_mia_c10}
\end{figure*}
\begin{figure*}
    \centering
    \includegraphics[width=1.0\linewidth]{figs/acc_auc_c100.pdf}
    \caption{Performance of defenses against adaptive attacks (ResNet18, CIFAR-100, data augmentation applied).}
    \label{fig:acc_mia_c100}
\end{figure*}


A baseline cross-entropy approach with no defense mechanism, \texttt{CE}, is also employed against several MIAs: 
\begin{itemize}
    \item Black-Box Attacks: NN-based MIAs (denoted as \texttt{NN-Based}) \cite{nasr2018advreg}, Entropy-based MIAs (denoted as \texttt{Entropy}) \cite{shokri2017membership}, Modified Entropy-based MIAs (denoted as \texttt{M-Entropy}) \cite{song2021systematic}
    \item White-Box Attacks: Inputs' Gradient-based MIAs (denoted as \texttt{Grad-x $\ell_2$}) \cite{rezaei2021difficulty}
\end{itemize}
For all threshold-based MIAs, we set a threshold for each class to enhance MIAs' successful rate. All these methods require shadow models to mimic the behavior of the target model. 
%The common MIAs without adaptive attack policy are difficult to apply for evaluating some recent works since many methods are claimed to be effective against common MIAs. 
%\texttt{NN-Based}, \texttt{Entropy}, and \texttt{M-Entropy} are \textbf{black-box attacks} that merely need prediction probabilities produced by the target model. On the other hand, \texttt{Grad-x $\ell_2$} is a \textbf{white-box attack} using inputs' gradient as a metric to determine the discrepancy between member and non-member data.
When comparing with other defense mechanisms, we use AUC score as an evaluation metric of MIAs to minimize the evaluation biases caused by the different training stability of different approaches.
To accommodate the advancement of recent defense approaches, an adaptive attack policy is employed to evaluate defense mechanisms. By an adaptive attack policy, the attacker knows how we train the target model and so applies the same way to the shadow models. In \texttt{NN-based} MIAs, we train five shadow models to train an attack model. The other MIAs, which are threshold-based, do not require shadow models since the AUC score is to evaluate the target model and its training and testing datasets directly use corresponding metrics. %In \texttt{AdvDist}, one shadow model is trained to compute a threshold to determine if a sample is in or out of the training set. 


\paragraph{Datasets} 
We evaluate our methods on CIFAR-10, CIFAR-100 \cite{krizhevsky2009cifar100}, SVHN \cite{yuval2017svhn}, and ArXiv-10 (NLP classification dataset) \cite{farhangi2022protoformer}. 
Their settings are introduced in detail in the Appendix. In particular, in CIFAR-100, common \textbf{data augmentation} techniques are applied.
To guarantee that target models and shadow models are trained in datasets without intersections, we split the whole dataset into target set and shadow set, with the ratio $0.5:0.5$. Then, we evenly split dataset into training and testing sets. To utilize limited data, we use increasing random seeds to ensure that shadow models are trained on different training sets. For reproducibility, we set the default random seed to $0$. 

\paragraph{Models}
In CIFAR-10, we evaluate our approach and other related methods with VGG11 \cite{simonyan2015vgg} with batch normalization layers, ResNet18 \cite{he2016resnet}, and DenseNet121 \cite{huang2017densenet}. 
In CIFAR-100, their performances are evaluated by GoogLeNet \cite{szegedy2015googlenet}, Resnet18, and DenseNet121. 
%In UTK-Face, we apply ResNet18, LeNet \cite{lecun1998lenet} and \textcolor{red}{[need to insert more text here]}
In SVHN, we apply VGG11 and ResNet18. In \texttt{AdvReg}, we follow their settings to produce the inference attack model.
In ArXiv-10, hierarchical attention network (HAN) \cite{yang2016han} is used for evaluation.
For the attack model in \texttt{NN} MIAs, we use a 4-layer fully connected neural network with hidden layer sizes [128, 64]. 
We also apply ReLU \cite{agarap2018relu} and dropout \cite{srivastava2014dropout} to it.
Because the cost of the white-box attack on DenseNet is too high, we only report the results of other models under the white-box attack in this paper.

\paragraph{Configurations}
We apply stochastic gradient descent (SGD) optimizer to train all models except the inference attack models in \texttt{AdvReg} approach (the Adam optimizer \cite{kingma2014adam} employed). To extract deep features, we generally choose the last global average pooling layer or the 2nd last fully connected layer. The learning rate of the class centers is constantly set at $0.001$. To keep a consistent mini-batch size across all GPUs used for training, we set the mini-batch size at $32$ when we train DenseNet121, and $256$ for the other neural networks. For training attack models in \texttt{NN} MIAs, we always set the mini-batch size at $256$. 
Unless otherwise stated, all experiments in the experiments section are repeated in five independent runs. The variance of our method's results is insignificant as the maximum variance is under $3.5\%$.

%\paragraph{Platforms}
%All models are trained in a GPU cluster with either of A100, A6000 and RTX 2080. When testing, we evaluate all models on a desktop equipped with Intel Core i7-12700k, RTX 3080, and Ubuntu operating system.






% \begin{table*}
% \small
%   \centering
%   \resizebox{0.9\linewidth}{!}{
%   \begin{tabular}{llrrrrrr}
%     \toprule
%     Model & Approach & Train Acc. (\%) & Test Acc. (\%) & NN-Based (\%) & Entropy (\%) & M-Entropy (\%) & Grad-x $\ell_2$ (\%) \\
%     \midrule
%     \multirow{4}{*}{GoogLeNet}
%         & CE (no defense)  & 99.78 & 58.59 & 82.70 & 77.40 & 79.56 & 79.78 \\
%         & CRL (ours)       & 87.39 & 58.16 & 64.72 & 67.10 & 70.08 & 70.94 \\
%         & AdvReg           & 99.22 & 52.45 & 84.02 & 76.20 & 81.42 & 80.07 \\
%         & RelaxLoss        & 90.98 & 57.90 & 65.29 & 70.13 & 73.79 & 74.54 \\
%     \midrule
%      \multirow{4}{*}{ResNet18}
%         & CE (no defense)  &100.00 & 58.06 & 86.88 & 82.96 & 84.04 & 84.20 \\
%         & CRL (ours)       & 79.74 & 57.53 & 66.48 & 63.80 & 65.09 & 66.07 \\
%         & AdvReg           & 99.43 & 48.98 & 86.99 & 79.87 & 85.35 & 80.03 \\
%         & RelaxLoss        & 77.46 & 55.28 & 69.87 & 63.52 & 66.60 & 69.05 \\
        
%     \midrule
%      \multirow{4}{*}{DenseNet121}
%         & CE (no defense)  & 99.01 & 62.76 & 58.92 & 71.34 & 74.46 & N/A\\
%         & CRL (ours)       & 77.39 & 60.32 & 50.23 & 59.98 & 61.58 & N/A\\
%         & AdvReg           & 99.16 & 59.51 & 59.90 & 73.52 & 77.10& N/A\\
%         & RelaxLoss        & 73.46 & 58.06 & 55.12 & 57.03 & 61.05 & N/A\\
%     \bottomrule
%   \end{tabular}
%   }
%   \caption{Comparisons on CIFAR-100 for trade-offs between privacy and utility. The MIAs evaluation results are reported in AUC Scores. Higher is better in test accuracy while lower is better in all MIAs.}
%   \label{tab:res_cifar100}
% \end{table*}


% \begin{table*}
% \small
%   \centering
%   \resizebox{0.9\linewidth}{!}{
%   \begin{tabular}{llrrrrrr}
%     \toprule
%     Model & Approach & Train Acc. (\%) & Test Acc. (\%) & NN-Based (\%) & Entropy (\%) & M-Entropy (\%) & Grad-x $\ell_2$ (\%) \\
%     \midrule
%      \multirow{4}{*}{VGG11}   
%         & CE (no defense)  & 99.98 & 92.66 & 53.09 & 54.14 & 54.63 & 54.51 \\
%         & CRL (ours)       & 94.70 & 91.50 & 50.15 & 52.32 & 52.48 & 52.38\\
%         & AdvReg           & 98.72 & 90.72 & 52.40 & 54.53 & 55.31 & 54.54\\
%         & RelaxLoss        & 95.42 & 91.65 & 51.67 & 52.02 & 52.34 & 52.36 \\
%     \midrule
%      \multirow{4}{*}{ResNet18}
%         & CE (no defense)  &100.00 & 93.04 & 52.93 & 54.74 & 55.07 & 54.79 \\
%         & CRL (ours)       & 95.82 & 93.13 & 50.04 & 51.92 & 52.02 & 51.89 \\
%         & AdvReg           & 99.90 & 90.47 & 52.18 & 55.14 & 55.79 & 55.07\\
%         & RelaxLoss        & 95.39 & 93.07 & 51.80 & 52.12 & 52.23 & 52.08 \\
%     \midrule
%   \end{tabular}
%   }
%   \caption{Comparisons on SVHN for trade-offs between privacy and utility. The MIAs evaluation results are reported in AUC Scores. Higher is better in test accuracy while lower is better in all MIAs}
%   \label{tab:res_svhn}
% \end{table*}


%\begin{figure*}
%    \centering
%    \includegraphics[width=1.\linewidth]{figs/acc_auc_c100.pdf}
%    \caption{Performance of defenses against adaptive attacks (ResNet18, XXX, placeholder).}
%    \label{fig:acc_mia}
%\end{figure*}



\subsection{Comparison and Analysis}
\paragraph{On CIFAR-10}
As shown in Table~\ref{tab:res_cifar10}, our approach performs better in terms of trade-offs of testing accuracy and privacy-preserving across all three neural networks. An expected result is that different models have different generalization capabilities, leading to gaps in their natural privacy-preserving abilities. Another discovery is that the model has the upper limit of representation ability since computation capacity, which depends on the depth, width, and computation functions, is positively correlated with privacy protection capability. 

We further evaluate more approaches on CIFAR-10 shown in Fig.~\ref{fig:acc_mia_c10}. We validate that our method can better mitigate privacy leakage without losing generalizability. In the figure, although \texttt{Label-Smoothing} is a bit better at testing accuracy, it cannot help privacy preservation.
\texttt{Earlystopping} is not as good as our method and \texttt{Relaxloss} because it cannot determine which samples should be relaxed or further learned. \texttt{DMP} does not perform satisfactorily through both splitting and synthesized data. This is because splitting the training set can hurt accuracy, and it is impossible to establish a strong GAN with non-excessive data. Besides, knowledge distillation can still leak the original model's privacy via non-training or even OOD data enquires \cite{nayak2021effectiveness}.
The noteworthy point is that our method and \texttt{RelaxLoss} are more effective on models with more computational capacity. This exhibits more significant results on CIFAR-100.


%\begin{figure}[t]
%     \centering
%     \begin{subfigure}[b]{0.155\textwidth}
%         \centering
%         \includegraphics[width=\textwidth]{figs/dist_density_vanilla.pdf}
%         \caption{CE (No defense)}
%         \label{fig:dist_density_vanilla}
%     \end{subfigure}
%     \hfill
%     \begin{subfigure}[b]{0.155\textwidth}
%         \centering
%         \includegraphics[width=\textwidth]{figs/dist_density_advreg_1.pdf}
%         \caption{AdvReg ($1.0$)}%($\lambda_{adv}=1.0$)}
%         \label{fig:dist_density_advreg_1}
%     \end{subfigure}
%     \hfill
%     \begin{subfigure}[b]{0.155\textwidth}
%         \centering
%         \includegraphics[width=\textwidth]{figs/dist_density_advreg_2.pdf}
%         \caption{AdvReg ($5.0$)}%($\lambda_{adv}=5.0$)}
%         \label{fig:dist_density_advreg_2}
%     \end{subfigure}
%     \\
%     \begin{subfigure}[b]{0.155\textwidth}
%         \centering
%         \includegraphics[width=\textwidth]{figs/dist_density_relaxloss_1.pdf}
%         \caption{RelaxLoss ($1.0$)}%($\alpha_{rce}=1.0$)}
%         \label{fig:dist_density_rl_1}
%     \end{subfigure}
%     \hfill
%     \begin{subfigure}[b]{0.155\textwidth}
%         \centering
%         \includegraphics[width=\textwidth]{figs/dist_density_relaxloss_2.pdf}
%         \caption{RelaxLoss ($1.75$)}%($\alpha_{rce}=1.75$)}
%         \label{fig:dist_density_rl_2}
%     \end{subfigure}
%     \hfill
%     \begin{subfigure}[b]{0.155\textwidth}
%         \centering
%         \includegraphics[width=\textwidth]{figs/dist_density_relaxloss_3.pdf}
%         \caption{RelaxLoss ($2.5$)}%($\alpha_{rce}=2.5$)}
%         \label{fig:dist_density_rl_3}
%     \end{subfigure}
%     \\
%     \begin{subfigure}[b]{0.155\textwidth}
%         \centering
%         \includegraphics[width=\textwidth]{figs/dist_density_crl_1.pdf}
%         \caption{CRL (Ours, $1.0$)}%($\alpha_{rce}=1.0$)}
%         \label{fig:dist_density_crl_1}
%     \end{subfigure}
%     \hfill
%     \begin{subfigure}[b]{0.155\textwidth}
%         \centering
%         \includegraphics[width=\textwidth]{figs/dist_density_crl_2.pdf}
%         \caption{CRL (Ours, $1.75$)}%($\alpha_{rce}=1.75$)}
%         \label{fig:dist_density_crl_2}
%     \end{subfigure}
%     \hfill
%     \begin{subfigure}[b]{0.155\textwidth}
%         \centering
%         \includegraphics[width=\textwidth]{figs/dist_density_crl_3.pdf}
%         \caption{CRL (Ours, $2.5$)}%($\alpha_{rce}=2.5$)}
%         \label{fig:dist_density_crl_3}
%     \end{subfigure}
%\caption{Histograms of distance to decision boundary on CIFAR-100 with ResNet18 trained and tested in \texttt{CE} (no defense), \texttt{AdvReg}, \texttt{RelaxLoss} and our approach with various hyper-parameter settings. The \textbf{value} in captions of sub-figures are hyper-parameter settings. These values denote $\lambda_{adv}$ when AdvReg is applied, while they denote $\alpha_{rce}$ when the other two approaches are applied.)}
%\label{fig:dist_density}
%\end{figure}


\begin{figure*}
    \centering
    \includegraphics[width=0.6\linewidth]{figs/dist_density_all.pdf}
    \caption{Histograms of distance to decision boundary on CIFAR-100 with ResNet18 trained and tested in \texttt{CE} (no defense), \texttt{AdvReg}, \texttt{RelaxLoss} and our approach with various hyper-parameter settings.}
    \label{fig:dist_density}
\end{figure*}



\paragraph{On CIFAR-100}
In Table~\ref{tab:res_cifar100}, a trend that our approach can alleviate the predictions overconfidence on the training set more while keeping prediction confidence on the testing set more significant.
Among all, our approach shows the most superior privacy-protection capacity in \texttt{NN}, \texttt{Entropy}, \texttt{M-Entropy} and \texttt{Grad-x $\ell_2$} MIAs.
We empirically found that \texttt{AdvReg} is unsuitable for simultaneous deployment with data augmentation to train models. Under data augmentation, it becomes more difficult for the model to maintain accuracy in adversarial regularization training. 
In particular, on ResNet18, \texttt{AdvReg} respectively exhibits even $0.11\%$ and $1.29\%$ increase in \texttt{NN-Based} and \texttt{M-Entropy} MIAs while there is about $10\%$ decrease in test accuracy. Also, it has a little impact on \texttt{Entropy} and \texttt{Grad-x $\ell_2$} MIAs. 
Through experiments in the data augmentation scenario, we found that the \texttt{AdvReg} model could gradually gain privacy protection capabilities only after the loss of test accuracy reaches a certain magnitude.

We further explore how the testing accuracy and MIAs accuracy change when we enhance the privacy-related hyper-parameter settings. In Fig.~\ref{fig:acc_mia_c100}, we explored the trends between testing accuracy and MIAs AUC scores in more defense approaches and settings.
Our approach always achieves more privacy preservation with less testing accuracy loss. 
Under a more challenging situation (fewer samples per class and harder task difficulty), \texttt{DMP} performs poorer than when it is in CIFAR10.
\texttt{RelaxLoss} also shows a stable trend of trade-offs between testing accuracy and privacy-preserving.
In our method and the other two defense methods, \texttt{AdvReg} shows the lowest testing accuracy when the three defenses are at the same privacy level. One of the main reasons for this phenomenon is that \texttt{AdvReg} requires separating a part of the training set as a conference set, resulting in additional data cost and the model's generalizability pays for that.
Besides \texttt{AdvReg}, \texttt{Confidence-Penalty} approach also shows the effectiveness on \texttt{Grad-x $\ell_2$}. This is because both methods reduce the true class prediction probability, which effectively combats the cross-entropy loss function.

As shown in Fig.~\ref{fig:dist_density}, 
we experimented on ResNet18 using three approaches with different levels of privacy settings. We found that the prediction distribution of the model without privacy-preserving measures on the training set is significantly different from that on testing. Also, the three defense approaches show distinctive differences. \texttt{AdvReg}'s testing prediction distribution shifts to the decision boundary farthest among all nine charts, lending to more losses of the model's utilities. 
However, there is still a clear distribution gap between the training and testing sets, which makes it not as effective as \texttt{RelaxLoss} and our approach. As for \texttt{RelaxLoss}, the area of overlap between the two distributions has been significantly improved. 

Compared to \texttt{RelaxLoss}, \texttt{CRL} shows two advantages: (i) it enhances testing confidence while alleviating training overconfidence. (ii) it maintains the testing confidence distribution better. 
The first advantage helps the model achieve better testing accuracy. The second helps training and testing distributions overlap at an earlier stage.
All three charts of \texttt{CRL} show better testing confidence than the others. 
Even with a large overlap such as Fig.~\ref{fig:dist_density}i, our method is still more confident in the testing set than the model with no defense.


\paragraph{On SVHN}
Shown in Table.~\ref{tab:res_svhn}, different from CIFAR datasets, both VGG11 and ResNet18 show over $90\%$ testing accuracy, which means a smaller distribution gap between testing predictions and training predictions than the other two datasets. 
Overall, we evaluate our method on datasets of different difficulties. In ResNet18, our approach outperforms in \texttt{NN-Based} MIAs defense and exhibits comparable results in other MIAs. 
%However, although it shows less testing accuracy, \texttt{AdvReg} achieves samil defense in \texttt{AdvDist}. 
However, although the data in this dataset is sufficient to achieve excellent testing accuracy, \texttt{AdvReg} suffers from a significant testing accuracy decrease without enhancement of privacy.
This also reflects that methods requiring additional data can lead a model to data starvation.
%It is because we only used a single shadow model when training the AdvDist attacker, and the model trained by \texttt{AdvReg} has a large variance in performance, which weakens the effect of the attacker. 
On both VGG11 and ResNet18, our method performs similarly to \texttt{RelaxLoss}, further suggesting that large models have more potential for privacy protection.


\begin{figure}[t]
    \centering
\includegraphics[width=.85\linewidth]{figs/acc_crl.pdf}
     \caption{Ablation study of defenses with different components (ResNet18, CIFAR-100).}
    \label{fig:ablation}
\end{figure}


\begin{table}
    %\singlespacing
    \small
  \centering
  \caption{Ablation components.}
  \resizebox{\linewidth}{!}{
  \begin{tabular}{cccc}
    \toprule
    Approach & Relaxed Policy & Centers & Normalization \\
    \midrule
    ImpRelaxLoss & \Checkmark & \XSolidBrush & \Checkmark\\
    Relaxed Center Loss & \Checkmark & \Checkmark & \XSolidBrush\\
    CRL & \Checkmark & \Checkmark & \Checkmark\\
    \bottomrule
  \end{tabular}
  }
  \label{tab:ablation}
\end{table}

\paragraph{ArXiv-10} Shown in Table~\ref{tab:res_arxiv}, CRL has a better defense effect against the three kinds of MIAs. With such privacy preservation, RelaxLoss and CRL are able to maintain more comparable testing accuracy, as validated in Fig.~\ref{fig:acc_arxiv10}.

\begin{table}[t]
\small
  \centering
  \caption{Trade-offs between privacy and utility for ArXiv-10 on HAN. The MIAs evaluation results are reported in AUC Scores.}
  \resizebox{1.0\linewidth}{!}{
  \begin{tabular}{l|cccc}
    \toprule \rowcolor{white} 
     \bfseries Approach & \bfseries NN-Based (\%) $\downarrow$ & \bfseries Entropy (\%) $\downarrow$ & \bfseries M-Entropy (\%) $\downarrow$ \\
    \midrule 
        \rowcolor{white}{CE (no defense)}  & 54.66(±0.16) & 51.24(±0.11) & 54.94(±0.24)  \\
        \rowcolor{white}{AdvReg}           & 54.83(±0.14) & 51.08(±0.18) & 54.88(±0.29)  \\
        \rowcolor{white}{RelaxLoss}        & 50.38(±0.05) & 51.13(±0.14) & 54.80(±0.16)  \\
        CRL (ours)                         & 50.46(±0.07) & 51.07(±0.13) & 53.60(±0.15)  \\
    \bottomrule
  \end{tabular}
  }
  \label{tab:res_arxiv}
\end{table}

\begin{figure}[t]
    \centering
    \includegraphics[width=.8\linewidth]{figs/arxiv10_acc.pdf}
     \caption{Performance of different approaches on ArXiv-10.}
    \label{fig:acc_arxiv10}
\end{figure}

\subsection{Ablation Study}
Here, we evaluate how the main components affect our approach. We evaluate the importance of two components that compose \texttt{CRL}: (i) \texttt{ImpRelaxLoss} and (ii) Relaxed center loss. The details of the components are described in Table~\ref{tab:ablation}. Here, we do not apply normalization when experimenting with Relaxed center loss to avoid the impact of normalization. As shown in Fig.~\ref{fig:ablation}, we apply all three approaches to train ResNet18 on CIFAR-100.
Pure Relaxed center loss can help Resnet18 achieve the highest testing accuracy. However, as hyper-parameters $\alpha_{rce}$ and $\alpha_{rcl}$ increase, which means more privacy protection, it gradually degenerates to a level comparable to \texttt{RelaxLoss}.
\texttt{ImpRelaxLoss} looks quite different. Overall, it is slightly but more effective than relaxed center loss, especially when they defend the MIAs completely. However, it falls short compared to Relaxed center loss in the highest testing accuracy. Finally, \texttt{CRL}, combining all components, can achieve the best performance in most situations. Normalization further enhances the relaxed center loss, allowing the model to resist MIAs with about $6\%$ higher testing accuracy. One of the main reasons is that normalization increases the loss with insufficient confidence, making the model pay more attention to those samples.

