\section{Related Work}
\subsection{Membership Inference Attacks and Defenses}
MIAs usually attack the target model through a black box model \cite{shokri2017membership}.
Label-only MIAs \cite{choquette2021labelonlymia} can defeat some confidence obfuscation-based methods without confidence score.
FAR \cite{rezaei2021difficulty} was introduced as a MIAs evaluation metric. 
\citet{song2021systematic} derived a privacy risk score metric for fine-grained privacy analysis and 
evaluated a series of metric-based attacks.
SAMIA \cite{yuan2022samia} tried to use Gaussian random noise to interfere with the model's reaction.
\citet{li2022lleaks} designed a MIAs approach that applies knowledge distillation technology to train shadow models.
Adversarial distance MIAs \cite{del2022leveraging} use Auto attack \cite{croce2020autoattack} to grab the reaction differences of models.

On the other hand, some studies to defend against MIAs are also proposed. 
\citet{nasr2018advreg} proposed a training framework with an inference model to let the target and inference models conduct adversarial regularization. 
MemGuard \cite{jia2019memguard} interferes with the prediction distribution of the model by additional noise.
Distillation approach for membership privacy (DMP) \cite{shejwalkar2021dmp} trains a protected model via selected data and labels from an unprotected model.
\citet{kaya2021augmia} explored when and how data augmentation helps MIAs or defenses while they proposed loss-rank-correlation (LRC) metric to measure the similarity of different augmentation mechanisms' effects on privacy leakage. 
Exploring how pruning affects neural networks' privacy protection ability, contradictory conclusions were obtained in \cite{yuan2022samia, wang2021pruning}.  
RelaxLoss \cite{chen2022relaxloss} defends the MIAs by relaxing the model's prediction distribution via loss.
SELENA \cite{tang2022selena} aggregates multiple networks with different training samples for imitating the distribution of the testing set. 
\citet{yang2023purifier} designed a reformer to `purify' the confidence scores.
\citet{tan2023blessing} found there exist trade-offs between parameter size and privacy–utility.

\subsection{Metric Learning}
\citet{wen2016centerloss} proposed a distance metric approach, Center Loss, to learn common features within a class through a learnable class center. 
Some following studies \cite{he2018triplet, li2019atcl, zhao2020tclfusion, rajoli2023tclsampling} improved its performance in the face recognition task. 
\citet{wang2019multi} combined multiple similarity loss functions to achieve better performance.
\citet{chen2020simclr} designed a label-free learning mechanism based on metric learning.
SimSiam \cite{chen2021simsiam} achieved better accuracy through representation alignment learning under an asymmetric neural network structure while Barlow Twins \cite{zbontar2021barlow} provided a simpler learning paradigm via cross-correlation matrix.
VICReg \cite{bardes2022vicreg} incorporated the invariance of augmented data, the covariance of the dimensions, and the variance of different samples into the training objectives. And further added the local criterion in \cite{bardes2022vicregl} .
\citet{garrido2023sie} extended the two-branch learning paradigm to four-branch learning paradigm via deploying a hypernetwork-based predictor.
\citet{fini2023semiself} combined metric learning techniques in self- and semi-supervised learning to make the model perform better.
