Training Data Extraction Attacks

Follow this topic Ask about this topic

Latest papers

11 papers3 papers in the last four weeks, with none the four weeks before. 0.0% of all new papers.

Adaptive Model Inversion Attacks Generalize a Privacy-Robustness Tradeoff
Oct 6, 2026Shailen Smith, Rasmus Torp, Adam BreuerAdversarial Robustness Model Inversion Attacks
Department of Computer Science, Dartmouth College · Department of Government, Dartmouth College
Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII
Oct 5, 2026Alexandru Nazare, Agnese Profico, Nicolò Vania +6Multilingual Language Models Cross-Lingual Representation Alignment
Human-Centric ART, University of Rome Tor Vergata · Department of Computer Science, University of Luxembourg · Almawave Labs, Rome
The Privacy Fallacy of Crowdsourced Fine-Tuning: Extracting Proprietary Data via Topic-Based Poisoning
Sep 27, 2026Sae Furukawa, Alina OpreaSupervised Fine-Tuning Privacy Leakage in Language Models
Khoury College of Computer Sciences, Northeastern University
Leak It: Per-Document Extraction Beyond Aggregate Membership Inference
Jul 31, 2026Victor MaricatoMembership Inference Attacks LLM Auditing
Karolinska Institutet, Sweden
Reducing information dependency does not cause training data privacy. Adversarially non-robust features do
Jul 14, 2026Rasmus Torp, Shailen K. Smith, Adam BreuerModel Inversion Attacks Neural Network Robustness
Department of Computer Science Dartmouth College · Department of Computer Science & Department of Government Dartmouth College
FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation
Jul 8, 2026Chongkai Li, Bang Zhang, Wenjian LuoPrivacy-Preserving ML Training Data Extraction Attacks
Guangdong Provincial Key Laboratory of Novel Security Intelligence Technologies, Institute of Cyberspace Security, School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen 518055, China
Loss Landscape Poisoning: Targeted Extraction of Unseen Training Data from LLMs
Jun 15, 2026Md Abdullah Al Mamun, Ngoc Phu Doan, Pedram Zaree +2Privacy Leakage in Language Models LLM Security
UC Riverside · Riverside, California, USA · Queen’s University Belfast +2
Extracting Training Data from Diffusion Language Models via Infilling
May 22, 2026Yihan Wang, N. AsokanData Leakage Masked Diffusion Models
University of Waterloo · KTH Royal Institute of Technology
Secret Stealing Attacks on Local LLM Fine-Tuning through Supply-Chain Model Code Backdoors
Apr 30, 2026Zi Li, Tian Zhou, Wenze Li +3Data Leakage LLM Backdoor Attacks
Nanjing University
Beyond Indistinguishability: Measuring Extraction Risk in LLM APIs
Apr 20, 2026Ruixuan Liu, David Evans, Li XiongLLM Auditing Privacy Leakage in Language Models
Emory University · University of Virginia
Extracting Training Dialogue Data from Large Language Model based Task Bots
Mar 2, 2026Shuo Zhang, Junzhou Zhao, Junji Hou +3Training Data Extraction Attacks Privacy Leakage in Language Models
MOE Key Laboratory for Intelligent Networks and Network Security, Xi’an Jiaotong University, P.O. Box 1088, No. 28, Xianning West Road, Xi’an, Shaanxi 710049, China.

Oct 6, 2026J/K move · Enter open · S save

Adaptive Model Inversion Attacks Generalize a Privacy-Robustness Tradeoff

Shailen Smith, Rasmus Torp, Adam Breuer

Department of Computer Science, Dartmouth College · Department of Government, Dartmouth College

Adversarial Robustness Model Inversion Attacks Training Data Reconstruction Attacks Training Data Extraction Attacks

Open paper AskPDF arXiv

In this paper, we show that standard evaluations of high-resolution Model Inversion Attacks (MIAs) significantly underestimate training-data privacy leakage. State-of-the-art privacy defenses, standard training techniques such as MixUp and Adversarial Training, and undefended models all leak training images at rates 1.16 to 6.59 times higher on FaceScrub under simple adaptive changes to the attack, with the largest increases among defenses reporting the strongest privacy. We further show that measured leakage depends on the feature basis of the external classifier used to evaluate reconstructions: for the same reconstructed images, an adversarially trained Inception evaluator identifies the targeted identity at different rates than the standard Inception evaluator. Our results suggest that standard MIA evaluation can mistake optimization and measurement failures for privacy. These underestimated leakage rates also concealed a broader relationship between privacy and adversarial robustness. Once we adapt the attack and vary the evaluator, reconstruction leakage closely tracks adversarial robustness across recent defenses and standard training regimes, suggesting that robustness provides an attack-agnostic proxy for reconstruction vulnerability that applies far more broadly than previously theorized. This raises an open question: can a practical defense reduce training-data reconstruction without paying a corresponding cost in adversarial robustness?