Diffusion-aided Task-oriented Semantic Communications with Model Inversion Attack

Xuesong Wang; Mo Li; Xingyan Shi; Zhaoqian Liu; Shenghao Yang

cs.CRJun 24, 2025

Diffusion-aided Task-oriented Semantic Communications with Model Inversion Attack

Authors: Xuesong Wang, Mo Li, Xingyan Shi, Zhaoqian Liu, Shenghao Yang

Organizations: School of Science and Engineering, The Chinese University of Hong Kong, Shenzhen, Guangdong 518172, China

Abstract

Semantic communication enhances transmission efficiency by conveying semantic information rather than raw input symbol sequences. Task-oriented semantic communication further aims to retain only task-specific information, thereby achieving greater bandwidth savings. However, these neural-network-based communication systems are vulnerable to model inversion attacks, in which adversaries attempt to recover sensitive input information from intercepted semantic features. The key challenge is therefore to preserve privacy while maintaining task accuracy and robustness. We consider a task-confidential setting in which the adversary attempts to reconstruct the original input from intercepted features without knowing the legitimate receiver's task or model. Although PSNR and SSIM are commonly used to assess reconstruction quality, we find that an external classifier can still perform the legitimate receiver's task with nontrivial accuracy on reconstructions with low PSNR or SSIM, indicating that these reconstructions still contain task-level semantic leakage. We therefore propose DiffSem, which splits the diffusion process between controlled transmitter-side self-noising and matched receiver-side reverse denoising. Experiments on the MNIST, CIFAR-10, and CelebA datasets show that DiffSem improves the legitimate receiver's task accuracy without increasing either the transmitted feature size or information leakage.

Figures & tables

Fig. 1 : System models. (a) Task-oriented transmission system, where the transmitter encodes the input into semantic features, applies self-noising before transmission, and the receiver performs diffusion-based denoising followed by task inference. (b) Model inversion attack, where the adversary eavesdrops on a separate channel and attempts to reconstruct the source input from the intercepted transmitted features.

Fig. 2 : Adversary-side data preparation and evaluation. The adversary constructs surrogate inputs $\dot{x}$ , repeatedly queries the transmitter to obtain post-channel observations $\hat{\dot{z}}$ , and trains the inversion model $A_{a}$ to reconstruct $\hat{\dot{x}}$ . The strong classifier $\bar{\Theta}_{\bar{\theta}}$ is not part of the adversary; it is a separate third-party evaluator used only to assess whether the reconstructed images still preserve task-relevant semantics. Green dashed lines indicate the datasets used to train the strong classifier.

Fig. 3 : Changes of $\sqrt{\bar{\alpha}_{t}}$ , $\sqrt{1-\bar{\alpha}_{t}}$ and $p$ with $t$ .

Fig. 4 : Simplified asymptotic separation between task recovery and exact source recovery under transmitter-side self-noising.

Dataset	Image $\rightarrow$ Latent	Encoder $\Phi$	Receiver Classifier $\Theta$	Third-party Classifier $\bar{\Theta}$	Adversary $\mathcal{A}$
MNIST	$1\times 28\times 28$ $\rightarrow 1\times 8\times 8$	Conv2d $(1,16)$ , stride 2 + LReLU Conv2d $(16,32)$ , stride 2 + LReLU Conv2d $(32,1)$ + LayerNorm	Concat $(\hat{z},\hat{f},t)$ Linear + ReLU Linear ( $10$ classes)	Linear + Tanh Linear + Tanh Linear + Sigmoid	Flatten Linear + Tanh Linear Reshape to $1\times 28\times 28$
CIFAR-10	$3\times 32\times 32$ $\rightarrow 3\times 8\times 8$	Conv2d $(3,16)$ + LReLU Conv2d $(16,32)$ , stride 2 + LReLU Residual Block Conv2d $(32,3)$ , stride 2 + LReLU + LayerNorm	Concat $(\hat{z},\hat{f},t)$ Conv + Tanh Strided Conv + Tanh Residual Block Global Pool + Linear ( $10$ classes)	Strided Conv + ReLU Strided Conv + ReLU Residual Block Global Pool Linear + ReLU Linear ( $10$ classes)	Conv + Tanh Deconv + Tanh Residual Block Deconv + Tanh Residual Block Conv + Tanh
CelebA	$3\times 128\times 128$ $\rightarrow 3\times 32\times 32$	Conv2d $(3,32)$ + BN + ReLU Conv2d $(32,32)$ + BN + ReLU Conv2d $(32,64)$ , stride 2 + BN + ReLU Conv2d $(64,96)$ , stride 2 + BN + ReLU Conv2d $(96,64)$ + BN + ReLU Conv2d $(64,3)$ + LayerNorm	MobileNetV2 Input $3\times 32\times 32$ latent Linear head ( $3$ logits)	ResNet-18 Input $3\times 128\times 128$ image Linear head ( $3$ logits)	Conv2d $(3,128)$ + BN + ReLU Residual Block Upsample + Conv2d $(128,192)$ + BN + ReLU Residual Block Upsample + Conv2d $(192,160)$ + BN + ReLU Conv2d $(160,96)$ + ReLU Conv2d $(96,3)$ + Tanh

TABLE I: Summary of Non-diffusion Modules

Component	MNIST	CIFAR-10	CelebA
Latent Domain	$1\times 8\times 8$	$3\times 8\times 8$	$3\times 32\times 32$
DiffSem U-Net	Time EmbedFC ( $2\times$ ) ResidualConvBlock $(128)$ UnetDown $(128)$ UnetDown $(256)$ AvgPool2d + GELU ConvTranspose2d + GN + ReLU $(256)$ UnetUp $(128)$ UnetUp $(128)$ Conv2d + GroupNorm + ReLU + Conv2d	Time EmbedFC ( $2\times$ ) ResidualConvBlock $(3,128)$ UnetDown $(128)$ UnetDown $(256)$ AvgPool2d + GELU ConvTranspose2d + GN + ReLU $(256)$ UnetUp $(128)$ UnetUp $(128)$ Conv2d + GroupNorm + ReLU + Conv2d $(128,3)$	Time embedding (sinusoidal + MLP) Conv2d $(3,96)$ ResBlock $\times 2$ Downsample $(96,128)$ + ResBlock $\times 2$ Downsample $(128,192)$ + ResBlock $\times 2$ Mid ResBlock + Self-Attention + ResBlock Upsample $(192,128)$ + ResBlock $\times 2$ Upsample $(128,96)$ + ResBlock $\times 2$ GroupNorm + SiLU + Conv2d $(96,3)$
E-DiffSem U-Net	Same U-Net backbone as DiffSem Time EmbedFC ( $2\times$ ) Context EmbedFC ( $2\times$ )	Same U-Net backbone as DiffSem Time EmbedFC ( $2\times$ ) Context EmbedFC ( $2\times$ )	Same U-Net backbone as DiffSem Time embedding (sinusoidal + MLP) Attribute embedding MLP ( $3\rightarrow 64\rightarrow 256$ ) Time and condition fused in every ResBlock

TABLE II: Summary of Dataset-specific U-Nets

Fig. 5 : System performances and baselines using MNIST dataset.

Fig. 6 : Plot of accuracy versus SSIM and PSNR using MNIST dataset.

Panel of Figure 9 — Fig. 7 : Adversary’s output images with different SNR or $t$ under MNIST dataset. 1st row: $-10$ dB; $t=344$ . 2nd row: $0$ dB; $t=184$ . 3rd row: $10$ dB; $t=67$ . (a)(b)(c) Original images. (d)(e)(f) IBAL system. (g)(h)(i) IBAL-D system. (j)(k)(l) Our system.

Panel of Figure 10 — Fig. 8 : (a)(b)(c) Direct mode and (d)(e)(f) permutation mode, with channel noise $-10$ dB, $0$ dB, $10$ dB. Original images are as (a)(b)(c) in Fig. 7 .

Fig. 9 : System performances on MNIST dataset under AWGN channel with different channel SNRs.

Fig. 10 : System performances using CIFAR-10 dataset.

Fig. 11 : Plot of accuracy versus SSIM and PSNR using CIFAR-10 dataset.

Panel of Figure 14 — Fig. 12 : Adversary’s output images with different $t$ under CIFAR-10 dataset. (a) Original image. (b)(c)(d) Adversary’s recovery when $t=60$ , $150$ and $300$ .

Fig. 13 : Robustness of DiffSem to imperfect SNR estimation on CIFAR-10 dataset.

Panel of Figure 16 — Fig. 14 : CelebA performance under different self-noising levels $t$ .

Explore similar work

Jun 30, 2026cs.NI

Semantic Leakage and Privacy Preservation in Relay-Assisted Semantic Communications

Semantic communication (SemCom) has emerged as a promising paradigm in which the transmission of task-relevant information is prioritized over raw data, enabling efficient and robust communication under resource and channel constraints. In this paper, the privacy implications of relay-assisted SemCom systems are studied, where the intermediate relay node operates directly on learned latent representations. It is shown that the relay, even without access to source data, can reliably infer semantic meaning and reconstruct signals with performance comparable to that of the legitimate receiver, revealing a fundamental privacy vulnerability of semantic representations. To address this issue, an iterative adversarial training framework is proposed in which a strong, adaptively trained eavesdropper at the relay is explicitly accounted for. The proposed approach alternates between optimizing the relay's eavesdropping function and the legitimate system, resulting in representations that preserve semantic decoding performance at the intended receiver while degrading semantic inference at the relay. The semantic accuracy gap between the legitimate receiver and the eavesdropper is significantly enlarged across channel conditions. Importantly, this protection is achieved in a stealthy manner, with high reconstruction fidelity maintained while semantic leakage is selectively suppressed.

Yalin E. Sagduyu, Tugba Erpek, Aylin Yener +1

1Nexcepta, Gaithersburg, MD, USA · 2The Ohio State University, Columbus, OH, USA · University of Maryland, College Park, MD, USA

Semantic Communications Data Leakage Privacy Preservation

Ask PDF

May 5, 2026cs.AI

Adaptive Dual-Path Framework for Covert Semantic Communication

This paper proposes a novel adaptive dual-path framework for covert semantic communication (SemCom), which integrates covert information transmission with task-oriented semantic coding. Unlike conventional covert communication methods that embed hidden messages through power-domain signal superposition, our framework embeds covert data within task-specific features via semantic-level intrinsic encoding. This new architecture introduces dual encoding paths with adaptive block selection: an Explicit path for public task execution and a Stego path that jointly encodes both public and covert information through contrastive representation alignment. A Gumbel-Softmax enabled adaptive path selection mechanism dynamically activates network blocks based on task require- ments. We formulate a multi-objective optimization framework that simultaneously ensures accurate semantic understanding and reliable covert transmission. We rigorously evaluate our framework's security against a powerful, independently trained attacker. Experimental results on the Cityscapes dataset demon- strate a state-of-the-art level of covertness: our method suppresses the attacker's detection accuracy to a near-random guessing level of 56.12%. This robust security is achieved while simultaneously maintaining superior performance on the primary semantic tasks compared to the baselines.

Xi Yu, Weicai Li, Lin Yin +1

School of Information and Communication Engineering, Beijing University of Posts and Telecommunications (BUPT), Beijing 100876, China · Center for Target Cognition Information Processing Science and Technology, and the Key Laboratory of Modern Measurement and Control Technology, Ministry of Education, both at Beijing Information Science and Technology University, Beijing, China

Semantic Communications Dual-Path Network Sabotage

Ask PDF

May 20, 2026cs.LG

TONIC: Token-Centric Semantic Communication for Task-Oriented Wireless Systems

Tokens are becoming the basic units through which foundation models represent and process information for understanding and inference. However, traditional wireless communication, centered on bit-level fidelity, faces a mismatch between what is transmitted reliably and what downstream models actually consume. This mismatch calls for a communication design that directly accounts for token-level task relevance and downstream model requirements, rather than treating all transmitted bits as equally important. In this paper, we propose TONIC, a token-centric semantic communication framework for task-oriented wireless systems. The transmitter converts each source sample into a sequence of tokens, estimates token-level task relevance, and allocates protection through utility-aware unequal error protection under a fixed channel-use budget. At the receiver, token-level confidence is used to gate unreliable decisions, turning harmful substitutions into recoverable erasures before a Transformer-based completion model restores the masked tokens for final task inference. Our framework combines transmitter-side semantic-aware protection with receiver-side confidence-aware gating in a modular and interpretable architecture, rather than relying solely on fully black-box end-to-end learning. We further establish a utility-aware Bayes-risk interpretation for the receiver-side gating rule and study its interaction with unequal protection and completion. Experimental results on image classification show that TONIC consistently outperforms separation-based schemes, the pixel-domain DeepJSCC baseline, and token-domain baselines under matched communication budgets over AWGN, Rayleigh, and Rician channels.

Sige Liu, Kezhi Wang

Department of Computer Science, Brunel University London, Uxbridge UB8 3PH, U.K.

Semantic Communications Wireless Communications Source-Channel Coding

Ask PDF