\newpage

\onecolumn

\appendix


\section*{Supplementary Material}
%\maketitle



%\vspace{-2cm}
\section{Existing Comparable Defense Methods}
\label{sec:cmp_others}
\paragraph{Adversarial Regularization (\texttt{AdvReg})}
The adversarial regularization \cite{nasr2018advreg} method introduced an inference attack model to the training framework. With a part of the training data as a conference set, a target model is encouraged to learn the classification target and try to deceive the inference attack model. In contrast, the inference attack model tries to attack the target model. 
\emph{Compared with our methods}, it requires splitting the training set, leading to additional data costs. 
Another weakness is that the model is prone to collapse in the adversarial training process, leading to a significant decrease in accuracy or complete degeneration. Our experiment results also show this aspect.
%the adversarial training process is relatively unstable compared to other approaches, which is detrimental to the stability of model performance.

\paragraph{Distillation for Membership Privacy (\texttt{DMP)}} Distillation for membership privacy \cite{shejwalkar2021dmp} develops a meta-regularization technique based on knowledge transfer. The key difference between AdvReg and DMP is that DMP sets up an entropy-based criterion to produce the reference set via selecting decision-boundary-unimpactful samples. \emph{Compared with our methods}, CRL can achieve a similar effect directly by adjusting the prediction distribution of the model on the training set, avoiding the potential accuracy loss caused by distilling data. 


\paragraph{Relaxed Loss (\texttt{RelaxLoss})}
Relaxed loss \cite{chen2022relaxloss} tries to limit the loss of mini-batches to a fixed value near a fixed value $\alpha_{rce}$. It aims to solve cross-entropy's privacy problem that the model always overfits the training data set. Through the improvement of traditional cross-entropy (CE) loss, RelaxLoss is divided into three stages: (i) normal cross-entropy loss, (ii) keeping loss, and (iii) target dispersion. When a mini-batch's average loss is greater than $\alpha_{rce}$, it executes normal CE loss. When the loss is less than  $\alpha_{rce}$ and the index of the current epoch is even, the absolute value sign reverses the direction of the gradient. When the index is not even, hard labels are replaced with soft labels produced by predictions. According to the above method, RelaxLoss can limit the loss of the samples in the training set close to a preset value so as to mitigate the models' overconfidence.
\emph{For our method}, we additionally ensure that samples in each class share some common feature representations, which is beneficial to improve and keep the model's generalizability.

\paragraph{Early-Stopping}
The early-stopping method aims to end the training earlier to make the model fit training data less. However, relax policy in both \texttt{CRL} and \texttt{RelaxLoss} prevents samples that were first fitted from being further fitted and continues fitting the rest of the samples, always leading to better performance than early-stopping unless the model is heavily over-fitting.

\paragraph{DP-SGD}
\texttt{DP-SGD} mixes noise into the classiﬁer during training to provide a reliable privacy guarantee. However, keeping with both acceptable generalization ability loss and privacy guarantees is still challenging \cite{jayaraman2019evaluating}. Compared with \texttt{CRL}, \texttt{CRL} gives a more appropriate and specific solution based on the fitting degree of samples.

%\begin{table*}[t!]
%    \small
%  \centering
%  \resizebox{1.0\linewidth}{!}{
%  \begin{tabular}{l|lrr|rrrr}
%    \toprule
%    Model & Approach & Train Acc. (\%) $\uparrow$ & Test Acc. (\%) $\uparrow$ & Entropy (\%) $\downarrow$ & M-Entropy (\%) $\downarrow$ & Grad-x $\ell_2$ (\%) $\downarrow$ & Grad-w $\ell_2$ (\%) $\downarrow$ \\
%    \midrule
%    \multirow{4}{*}{VGG11}
%        & CE (no defense)  &100.00 & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 \\
%        & CRL (ours)       & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 \\
%        %& Early-Stopping   & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 \\
%        & AdvReg           & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 \\
%        & RelaxLoss        & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 \\
%        
%    \midrule
%     \multirow{4}{*}{ResNet18}   
%        & CE (no defense)  &100.00 & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 \\
%        & CRL (ours)       & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 \\
%        %& Early-Stopping   & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 \\
%        & AdvReg           & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 \\
%        & RelaxLoss        & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 & 00.00 \\
%    \bottomrule
%  \end{tabular}
%  }
%  \caption{Comparisons for trade-offs between privacy and utility on MINC Dataset. The MIAs evaluation results are reported in AUC Scores. Higher is better in test accuracy ($\uparrow$) while lower is better in AUC for all MIAs  ($\downarrow$).}
%  \label{tab:res_minc}
%\end{table*}

%\section{Experiments on MINC}
%\paragraph{Description}
%MINC \cite{bell15minc} includes $362 \times 362$ sized real-world images evenly sampled into 23 classes. In each class, $2,500$ images are included. To reduce the training cost, we resize the image size to $64 \times 64$. The data splitting way is the same as the other three datasets. We evaluate our approach, \texttt{AdvReg}, and \texttt{RelaxLoss} on ResNet18. We also apply \texttt{Entropy}, \texttt{M-Entropy}, \texttt{Grad-x $\ell_2$}, and \texttt{Grad-w $\ell_2$} MIAs for evaluation.
%
%\paragraph{Results}
%
%
%\begin{figure}
%    \centering
%    \includegraphics[width=1.\linewidth]{figs/acc_auc_minc.pdf}
%    \caption{Performance of defenses against adaptive attacks (ResNet18, MINC).}
%    \label{fig:acc_mia_minc}
%\end{figure}

\section{More details in experimental setting}
%\paragraph{Membership Inference Attacks}


\paragraph{Dataset}
CIFAR-10 and CIFAR-100 are popular image classification datasets, which consist of $60,000$ color images with the size of $32\times32$. SVHN, a digits classification dataset, with 10 classes for digits from $0$ to $9$ and $32\times32$ image size, includes over $600,000$ digit images in natural scenes.
As for both CIFAR datasets, we apply the commonly used data normalization to the original training and testing sets.
In CIFAR-100, data augmentation techniques, random cropping and random flipping, are applied to enhance the model's generalization ability. 
As for SVHN, we use the matrices of the original RGB image as inputs.
%UTK-Face, including over $20,000$ face images, has rich annotations such as age, gender, and ethnicity. In our experiment, we use UTK-Face for the age classification task. More specifically, we divide ages into 9 intervals: $[0, 10)$, $[10, 15)$, $[15, 20)$, $[20, 25)$, $[25, 30)$, $[30, 40)$, $[40, 50)$, $[50, 60)$, $[60, 120]$ and reshape the image size into $48\times48$. 