Fig. 5
From: Publishing neural networks in drug discovery might compromise training data privacy
Chemical structures identified using the likelihood ratio attack (LiRA) against a neural network model trained to predict whether molecules pass the blood-brain barrier. Molecules were represented using ECFP4s in this model. Structures that are from the minority class have the label 0 and are surrounded by a solid line. These structures correspond to molecules that cannot pass the blood-brain barrier. It was possible to identify 23 of the 859 training structures at an FPR of 0