Diffusion-aided Task-oriented Semantic Communications with Model Inversion Attack

Xuesong Wang; Mo Li; Xingyan Shi; Zhaoqian Liu; Shenghao Yang

cs.CRJun 24, 2025

Diffusion-aided Task-oriented Semantic Communications with Model Inversion Attack

Authors: Xuesong Wang, Mo Li, Xingyan Shi, Zhaoqian Liu, Shenghao Yang

Organizations: School of Science and Engineering, The Chinese University of Hong Kong, Shenzhen, Guangdong 518172, China

Abstract

Semantic communication enhances transmission efficiency by conveying semantic information rather than raw input symbol sequences. Task-oriented semantic communication further aims to retain only task-specific information, thereby achieving greater bandwidth savings. However, these neural-network-based communication systems are vulnerable to model inversion attacks, in which adversaries attempt to recover sensitive input information from intercepted semantic features. The key challenge is therefore to preserve privacy while maintaining task accuracy and robustness. We consider a task-confidential setting in which the adversary attempts to reconstruct the original input from intercepted features without knowing the legitimate receiver's task or model. Although PSNR and SSIM are commonly used to assess reconstruction quality, we find that an external classifier can still perform the legitimate receiver's task with nontrivial accuracy on reconstructions with low PSNR or SSIM, indicating that these reconstructions still contain task-level semantic leakage. We therefore propose DiffSem, which splits the diffusion process between controlled transmitter-side self-noising and matched receiver-side reverse denoising. Experiments on the MNIST, CIFAR-10, and CelebA datasets show that DiffSem improves the legitimate receiver's task accuracy without increasing either the transmitted feature size or information leakage.

Figures & tables

Fig. 1 : System models. (a) Task-oriented transmission system, where the transmitter encodes the input into semantic features, applies self-noising before transmission, and the receiver performs diffusion-based denoising followed by task inference. (b) Model inversion attack, where the adversary eavesdrops on a separate channel and attempts to reconstruct the source input from the intercepted transmitted features.

Fig. 2 : Adversary-side data preparation and evaluation. The adversary constructs surrogate inputs $\dot{x}$ , repeatedly queries the transmitter to obtain post-channel observations $\hat{\dot{z}}$ , and trains the inversion model $A_{a}$ to reconstruct $\hat{\dot{x}}$ . The strong classifier $\bar{\Theta}_{\bar{\theta}}$ is not part of the adversary; it is a separate third-party evaluator used only to assess whether the reconstructed images still preserve task-relevant semantics. Green dashed lines indicate the datasets used to train the strong classifier.

Fig. 3 : Changes of $\sqrt{\bar{\alpha}_{t}}$ , $\sqrt{1-\bar{\alpha}_{t}}$ and $p$ with $t$ .

Fig. 4 : Simplified asymptotic separation between task recovery and exact source recovery under transmitter-side self-noising.

Dataset	Image $\rightarrow$ Latent	Encoder $\Phi$	Receiver Classifier $\Theta$	Third-party Classifier $\bar{\Theta}$	Adversary $\mathcal{A}$
MNIST	$1\times 28\times 28$ $\rightarrow 1\times 8\times 8$	Conv2d $(1,16)$ , stride 2 + LReLU Conv2d $(16,32)$ , stride 2 + LReLU Conv2d $(32,1)$ + LayerNorm	Concat $(\hat{z},\hat{f},t)$ Linear + ReLU Linear ( $10$ classes)	Linear + Tanh Linear + Tanh Linear + Sigmoid	Flatten Linear + Tanh Linear Reshape to $1\times 28\times 28$
CIFAR-10	$3\times 32\times 32$ $\rightarrow 3\times 8\times 8$	Conv2d $(3,16)$ + LReLU Conv2d $(16,32)$ , stride 2 + LReLU Residual Block Conv2d $(32,3)$ , stride 2 + LReLU + LayerNorm	Concat $(\hat{z},\hat{f},t)$ Conv + Tanh Strided Conv + Tanh Residual Block Global Pool + Linear ( $10$ classes)	Strided Conv + ReLU Strided Conv + ReLU Residual Block Global Pool Linear + ReLU Linear ( $10$ classes)	Conv + Tanh Deconv + Tanh Residual Block Deconv + Tanh Residual Block Conv + Tanh
CelebA	$3\times 128\times 128$ $\rightarrow 3\times 32\times 32$	Conv2d $(3,32)$ + BN + ReLU Conv2d $(32,32)$ + BN + ReLU Conv2d $(32,64)$ , stride 2 + BN + ReLU Conv2d $(64,96)$ , stride 2 + BN + ReLU Conv2d $(96,64)$ + BN + ReLU Conv2d $(64,3)$ + LayerNorm	MobileNetV2 Input $3\times 32\times 32$ latent Linear head ( $3$ logits)	ResNet-18 Input $3\times 128\times 128$ image Linear head ( $3$ logits)	Conv2d $(3,128)$ + BN + ReLU Residual Block Upsample + Conv2d $(128,192)$ + BN + ReLU Residual Block Upsample + Conv2d $(192,160)$ + BN + ReLU Conv2d $(160,96)$ + ReLU Conv2d $(96,3)$ + Tanh

TABLE I: Summary of Non-diffusion Modules

Component	MNIST	CIFAR-10	CelebA
Latent Domain	$1\times 8\times 8$	$3\times 8\times 8$	$3\times 32\times 32$
DiffSem U-Net	Time EmbedFC ( $2\times$ ) ResidualConvBlock $(128)$ UnetDown $(128)$ UnetDown $(256)$ AvgPool2d + GELU ConvTranspose2d + GN + ReLU $(256)$ UnetUp $(128)$ UnetUp $(128)$ Conv2d + GroupNorm + ReLU + Conv2d	Time EmbedFC ( $2\times$ ) ResidualConvBlock $(3,128)$ UnetDown $(128)$ UnetDown $(256)$ AvgPool2d + GELU ConvTranspose2d + GN + ReLU $(256)$ UnetUp $(128)$ UnetUp $(128)$ Conv2d + GroupNorm + ReLU + Conv2d $(128,3)$	Time embedding (sinusoidal + MLP) Conv2d $(3,96)$ ResBlock $\times 2$ Downsample $(96,128)$ + ResBlock $\times 2$ Downsample $(128,192)$ + ResBlock $\times 2$ Mid ResBlock + Self-Attention + ResBlock Upsample $(192,128)$ + ResBlock $\times 2$ Upsample $(128,96)$ + ResBlock $\times 2$ GroupNorm + SiLU + Conv2d $(96,3)$
E-DiffSem U-Net	Same U-Net backbone as DiffSem Time EmbedFC ( $2\times$ ) Context EmbedFC ( $2\times$ )	Same U-Net backbone as DiffSem Time EmbedFC ( $2\times$ ) Context EmbedFC ( $2\times$ )	Same U-Net backbone as DiffSem Time embedding (sinusoidal + MLP) Attribute embedding MLP ( $3\rightarrow 64\rightarrow 256$ ) Time and condition fused in every ResBlock

TABLE II: Summary of Dataset-specific U-Nets

Fig. 5 : System performances and baselines using MNIST dataset.

Fig. 6 : Plot of accuracy versus SSIM and PSNR using MNIST dataset.

Panel of Figure 9 — Fig. 7 : Adversary’s output images with different SNR or $t$ under MNIST dataset. 1st row: $-10$ dB; $t=344$ . 2nd row: $0$ dB; $t=184$ . 3rd row: $10$ dB; $t=67$ . (a)(b)(c) Original images. (d)(e)(f) IBAL system. (g)(h)(i) IBAL-D system. (j)(k)(l) Our system.

Panel of Figure 10 — Fig. 8 : (a)(b)(c) Direct mode and (d)(e)(f) permutation mode, with channel noise $-10$ dB, $0$ dB, $10$ dB. Original images are as (a)(b)(c) in Fig. 7 .

Fig. 9 : System performances on MNIST dataset under AWGN channel with different channel SNRs.

Fig. 10 : System performances using CIFAR-10 dataset.

Fig. 11 : Plot of accuracy versus SSIM and PSNR using CIFAR-10 dataset.

Panel of Figure 14 — Fig. 12 : Adversary’s output images with different $t$ under CIFAR-10 dataset. (a) Original image. (b)(c)(d) Adversary’s recovery when $t=60$ , $150$ and $300$ .

Fig. 13 : Robustness of DiffSem to imperfect SNR estimation on CIFAR-10 dataset.

Panel of Figure 16 — Fig. 14 : CelebA performance under different self-noising levels $t$ .

Explore similar work

Semantic Leakage and Privacy Preservation in Relay-Assisted Semantic Communications
Jun 30, 2026Yalin E. Sagduyu, Tugba Erpek, Aylin Yener +1Semantic Communications Data Leakage
1Nexcepta, Gaithersburg, MD, USA · 2The Ohio State University, Columbus, OH, USA · University of Maryland, College Park, MD, USA
Adaptive Dual-Path Framework for Covert Semantic Communication
May 5, 2026Xi Yu, Weicai Li, Lin Yin +1Semantic Communications Dual-Path Network
School of Information and Communication Engineering, Beijing University of Posts and Telecommunications (BUPT), Beijing 100876, China · Center for Target Cognition Information Processing Science and Technology, and the Key Laboratory of Modern Measurement and Control Technology, Ministry of Education, both at Beijing Information Science and Technology University, Beijing, China
TONIC: Token-Centric Semantic Communication for Task-Oriented Wireless Systems
May 20, 2026Sige Liu, Kezhi WangSemantic Communications Wireless Communications
Department of Computer Science, Brunel University London, Uxbridge UB8 3PH, U.K.

Jun 30, 2026, cs.NIJ/K move · Enter open · S save

Semantic Leakage and Privacy Preservation in Relay-Assisted Semantic Communications

Yalin E. Sagduyu, Tugba Erpek, Aylin Yener, Sennur Ulukus

1Nexcepta, Gaithersburg, MD, USA · 2The Ohio State University, Columbus, OH, USA · University of Maryland, College Park, MD, USA

Semantic Communications Data Leakage Privacy Preservation

Open paper AskPDF arXiv

Semantic communication (SemCom) has emerged as a promising paradigm in which the transmission of task-relevant information is prioritized over raw data, enabling efficient and robust communication under resource and channel constraints. In this paper, the privacy implications of relay-assisted SemCom systems are studied, where the intermediate relay node operates directly on learned latent representations. It is shown that the relay, even without access to source data, can reliably infer semantic meaning and reconstruct signals with performance comparable to that of the legitimate receiver, revealing a fundamental privacy vulnerability of semantic representations. To address this issue, an iterative adversarial training framework is proposed in which a strong, adaptively trained eavesdropper at the relay is explicitly accounted for. The proposed approach alternates between optimizing the relay's eavesdropping function and the legitimate system, resulting in representations that preserve semantic decoding performance at the intended receiver while degrading semantic inference at the relay. The semantic accuracy gap between the legitimate receiver and the eavesdropper is significantly enlarged across channel conditions. Importantly, this protection is achieved in a stealthy manner, with high reconstruction fidelity maintained while semantic leakage is selectively suppressed.

Abstract

Explore similar work

Semantic Leakage and Privacy Preservation in Relay-Assisted Semantic Communications

Adaptive Dual-Path Framework for Covert Semantic Communication

TONIC: Token-Centric Semantic Communication for Task-Oriented Wireless Systems