Rasmus Torp

Reducing information dependency does not cause training data privacy. Adversarially non-robust features do.

In this paper, we show that the prevailing view that information dependency (including rote memorization) drives training data exposure to image reconstruction attacks is incomplete. We find that extensive exposure can persist without rote memorization, driven instead by a tunable connection to adve…