A Membership Exposure Evaluated by a Stronger Attack In this section, we evaluate the membership exposure effect with a stronger membership inference attack proposed by [

Our experiment is conducted on the CIFAR-10 dataset. B.1 Case Study 1: Membership Exposure Across Different Feature Extractors We plot h across clean CIFAR-10 classifiers in Figure 6 . This is consistent with our results in Table 1 . We compute h for each target class and plot the average CDF. DP-SGD prevents models from learning from the poisoning samples.