Model Inversion Attacks

Follow this topic Ask about this topic

Model inversion attacks study how an adversary can recover inputs or sensitive information from model outputs, shared gradients, released weights, and intermediate representations such as embeddings. Approaches include gradient matching, query-based optimization, and generative priors, with targets ranging from faces and text to genomic sequences, documents, and scenes. Evaluations span image and face-recognition benchmarks, language and genomic embeddings, and federated-learning settings; defenses include noise, quantization, aggregation, and removing sensitive features from representations. A central tension is that defenses must preserve task utility while resisting adaptive attackers, and low visual reconstruction quality or standard attack scores may not reliably indicate that semantic information is protected.

Latest papers

21 papers7 papers in the last four weeks, against 1 the four weeks before. 0.0% of all new papers.

Privacy-Preserving Personalized Federated Learning (PPP-FL) for Medical Imaging
Oct 20, 2026Md Morshedul Islam, Hossain Shahriar, Alfredo CuzzocreaFederated Learning Training Data Reconstruction Attacks
LLM-Attack Suite: A Unified Red-Team Framework for Privacy Evaluation of Split and Distributed LLM Systems
Oct 15, 2026Georgios Politis, Evangelos PappasLLM Security Privacy Leakage in Language Models
Which Optimizer Leaks Most? Optimizer Implicit Bias as a Training-Data Privacy Controller
Oct 13, 2026Sagi Habani, Yehonathan Refael, Ofir LindenbaumTraining Data Reconstruction Attacks Model Inversion Attacks
Ben-Gurion University · Tel Aviv University · Bar Ilan University
Inverting Multi-Vector Visual Document Indices
Oct 7, 2026Zhuchenyang Liu, Yao Zhang, Yu XiaoModel Inversion Attacks Multi-Vector Retrieval
Aalto University Espoo, Finland
Adaptive Model Inversion Attacks Generalize a Privacy-Robustness Tradeoff
Oct 6, 2026Shailen Smith, Rasmus Torp, Adam BreuerAdversarial Robustness Model Inversion Attacks
Department of Computer Science, Dartmouth College · Department of Government, Dartmouth College
On the Relationship between Model Quantization and Model Inversion Attacks
Sep 30, 2026Rongke Liu, Youwen ZhuModel Inversion Attacks Privacy-Preserving ML
School of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 211106, China
Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning
Sep 29, 2026Chaoyu Zhang, Shanghao Shi, Heng Jin +3Privacy-Preserving Federated Learning Model Inversion Attacks
Virginia Tech · Washington University in St. Louis · University of South Florida
SoK: Privacy Attacks on Machine Learning via Explainable AI
Sep 9, 2026Abdullah Caglar Oksuz, Anisa Halimi, Erman AydayModel Extraction Attacks Model Inversion Attacks
Case Western Reserve University · IBM Research
Misanthrope: A Privacy-Preserving Keypoint Detector
Aug 24, 2026Francesco Vultaggio, Predrag Djindjic, Markus Gerke +2Keypoint Detection Privacy-Preserving ML
Austrian Institute of Technology, Assistive & Autonomous Systems Vienna 1210, Austria. · Technical University of Braunschweig, Institute of Geodesy and Photogrammetry Braunschweig 38106, Germany. · University of Vienna, Data Mining and Machine Learning Vienna 1090, Austria.
Denoising-Aware Inversion: Revealing Privacy Risks in Noise-Protected Text Embeddings
Aug 19, 2026Yubo Wang, Shujie Cui, James Bailey +5Model Inversion Attacks Text Embedding Models
Monash University, Melbourne, Australia · The University of Queensland, Brisbane, Australia · Northeastern University, Shenyang, China
Steering the Flow: Inverting Face Recognition Models via Gradient-Guided Flow Matching
Aug 17, 2026Ye Lu, Shen Wang, Zhaoyang Zhang +4Model Inversion Attacks Flow-Based Generative Modeling
School of Cyberspace Science, Harbin Institute of Technology, Harbin 150001, China
A Privacy Study of Sparse Collaborative Inference
Aug 17, 2026Maximilian Andreas Hoefler, Karsten Mueller, Wojciech SamekPrivacy-Preserving ML Activation Sparsity
Fraunhofer Heinrich Hertz Institute, Germany · Technical University of Berlin, Germany · Berlin Institute for the Foundations of Learning and Data (BIFOLD)
Reducing information dependency does not cause training data privacy. Adversarially non-robust features do
Jul 14, 2026Rasmus Torp, Shailen K. Smith, Adam BreuerModel Inversion Attacks Neural Network Robustness
Department of Computer Science Dartmouth College · Department of Computer Science & Department of Government Dartmouth College
Seeing Through the Weights: Privacy Leakage in Scene Coordinate Regression
Jun 30, 2026Oleksii Nasypanyi, Jaemin Cho, Utku Ozbulak +2Scene Coordinate Regression 3D Reconstruction
Stony Brook University · Ghent University Global Campus · George Mason University Korea +1
TIGER: Inverting Transformer Gradients via Embedding-Subspace Distance Optimization
Jun 16, 2026William Kalikman, Ivo Petrov, Dimitar I. Dimitrov +1Gradient Inversion Attacks Transformer
ETH Zürich · INSAIT, Sofia University "St. Kliment Ohridski"
From Prompts to Responses: Dual-Sided Data Leakage and Defense in Split Large Language Models
Jun 12, 2026Zixuan Gu, Xiaojun Ye, Yang LiuPrivacy-Preserving Language Models Privacy Leakage in Language Models
School of Software, Tsinghua University, Beijing, China · the Hong Kong Polytechnic University, Hongkong, China
From Measurement to Mitigation: Quantifying and Reducing Identity Leakage in Image Representation Encoders with Linear Subspace Removal
Apr 7, 2026Daniel George, Charles Yeh, Daniel Lee +1Privacy-Preserving ML Visual Representation Learning
Persona Identities, USA
How Private Are DNA Embeddings? Inverting Foundation Model Representations of Genomic Sequences
Mar 6, 2026Sofiane Ouaari, Jules Kreuer, Nico PfeiferGenomic Foundation Models Model Inversion Attacks
Methods in Medical Informatics, Department of Computer Science, University of Tuebingen, Germany · Institute for Bioinformatics and Medical Informatics (IBMI), University of Tuebingen, Germany
Scores Know Bobs Voice: Speaker Impersonation Attack
Mar 3, 2026Chanwoo Hwang, Sunpill Kim, Yong Kiam Tan +6Black-Box Adversarial Attacks Speaker Verification
Hanyang University Seoul, Republic of Korea · I2R, A*STAR & NTU Singapore · National University of Singapore Singapore +1
FaceLinkGen: A Re-evaluation of Identity Leakage in Privacy-Preserving Face Recognition and Face Anonymization Systems Using Simple Distillation
Feb 2, 2026Wenqi Guo, Qingyun Qian, Mohamed Shehata +1Model Inversion Attacks Privacy-Preserving ML
Department of Computer Science, Mathematics, Physics and Statistics University of British Columbia, Kelowna, BC, Canada
Diffusion-aided Task-oriented Semantic Communications with Model Inversion Attack
Jun 24, 2025Xuesong Wang, Mo Li, Xingyan Shi +2Semantic Communication Task-Oriented Semantic Communication
School of Science and Engineering, The Chinese University of Hong Kong, Shenzhen, Guangdong 518172, China

Oct 20, 2026J/K move · Enter open · S save

Privacy-Preserving Personalized Federated Learning (PPP-FL) for Medical Imaging

Md Morshedul Islam, Hossain Shahriar, Alfredo Cuzzocrea

Federated Learning Training Data Reconstruction Attacks Model Inversion Attacks Differentially Private Federated Learning Medical Imaging Federated Learning Aggregation

Open paper AskPDF arXiv

Federated learning (FL) is a distributed machine learning paradigm that reduces transmission costs, mitigates cross-border data sharing restrictions, and enhances privacy by keeping raw data on local devices. Clients in FL systems train local models and share only updates, which are aggregated by a central server. While this setup limits direct data exposure, FL remains vulnerable to privacy attacks. Existing attack and defense strategies have largely been developed for centralized systems, and adapting them to FL introduces new challenges due to its unique architecture and training workflow. In this work, we first propose a model inversion attack on FL systems using Deep Convolutional Generative Adversarial Networks (DCGANs) in the context of large-scale medical imaging. Our method operates under realistic assumptions about the attacker's knowledge and capabilities. We then examine the effect of client-side differential privacy (DP) in mitigating privacy leakage and incorporate personalized FL to improve model performance under DP settings. Experiments on the Brain MRI ND-5 dataset show that DCGAN-based attacks can reconstruct semantically meaningful synthetic images, revealing significant risks to the privacy of training data. Applying DP reduces attack success but introduces an accuracy trade-off, which is further overcome by personalized FL at each client side. We also evaluate how different aggregation algorithms affect both attack vulnerability and defense effectiveness, underscoring the critical role of aggregation strategies. The proposed attack-and-defense framework is model-agnostic and applicable to a wide range of FL-based systems.