ed. To investigate the leakage of private information in users' data, the performance of mali- cious servers was studied in [201]. A GAN-based framework with a multi-task discriminator capable of discriminating category, reality, and client identity included in input samples simultaneously was introduced. It was shown that the generator could easily recover the specific private data of users, particularly client identity. An efficient and robust protocol for high-dimensional data secure aggregation was pro- posed in [18] that can be used in FL. Using this protocol, a server was able to compute the sum of large user-held data vectors from mobile devices to aggregate user-provided model 11.3 Summary updates for a DNN model without distinguishing individual user's contributions. In addi- tion, the effectiveness and efficiency of the proposed protocol were verified. A GAN-based privacy-preserving method was proposed in [155] to obfuscate users' sensitive information. The proposed method employed a generator to produce an optimal obfuscation method for data protection. At the same time, a classifier was used to deobfus- cate the data. These two nets continued to play against each other until they achieved an equilibrium. This process can raise the level of protection. By investigating location privacy protection on the Gowalla dataset and synthetic data, it was shown that the proposed approach could achieve privacy protection and deal with the Bayes error. To alleviate the threat of black-box inference attacks against ML models, a mechanism to train models with membership privacy was introduced in [137]. By formulating a min-max game, an adversarial training algorithm was designed to minimize the prediction loss of the model and the maximum gain of the inference attacks. The effectiveness of the min-max strategy on defending membership inference attacks was verified without significantly downgrading the model's prediction accuracy. To defend against the attribute inference attacks, a countermeasure named AttriGuard wa