Training Data Reconstruction Attacks

Follow this topic Ask about this topic

Latest papers

17 papers4 papers in the last four weeks, against 2 the four weeks before. 0.0% of all new papers.

Which Optimizer Leaks Most? Optimizer Implicit Bias as a Training-Data Privacy Controller
Oct 13, 2026Sagi Habani, Yehonathan Refael, Ofir LindenbaumTraining Data Reconstruction Attacks Model Inversion Attacks
Ben-Gurion University · Tel Aviv University · Bar Ilan University
From Pixels to Privacy-Sensitive Features: An Information-Theoretic Framework for Reconstruction Bounds
Oct 9, 2026Henry Bourne, Robert F. AllisonTraining Data Reconstruction Attacks Differentially Private Stochastic Gradient Descent
Department of Mathematics The University of Bristol Beacon House, Queens Road, Bristol, BS8 1QU, United Kingdom
Adaptive Model Inversion Attacks Generalize a Privacy-Robustness Tradeoff
Oct 6, 2026Shailen Smith, Rasmus Torp, Adam BreuerAdversarial Robustness Model Inversion Attacks
Department of Computer Science, Dartmouth College · Department of Government, Dartmouth College
A Sharp Transition in Data Reconstruction under Differential Privacy
Sep 29, 2026Max Cairney-Leeming, Simone Bombari, Marco MondelliAdversarial Attacks Training Data Reconstruction Attacks
Institute of Science and Technology Austria
Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning
Sep 9, 2026Saeed Shariati, Mohsen Alambardar MeybodiGradient Inversion Attacks Federated Learning
Department of Applied Mathematics and Computer Science, Faculty of Mathematics and Statistics, University of Isfahan, Isfahan 81746-73441, Iran
Client-Side Probing of Deleted Ridge Statistics in Federated Unlearning
Sep 3, 2026Yijun Quan, Giovanni MontanaTraining Data Reconstruction Attacks Federated Unlearning
University of Warwick
Geometric Data Perturbation with Noisy-Anchor Alignment for Privacy-Preserving Collaborative Learning
Aug 19, 2026Keiyu Nosaka, Yamato Suetake, Yuichi Takano +2Orthogonal Procrustes Alignment Training Data Reconstruction Attacks
Graduate School of Science and Technology, University of Tsukuba, 1-1-1, Tennodai, Tsukuba, 305-8573, Ibaraki, Japan · Institute of Systems and Information Engineering, University of Tsukuba, 1-1-1, Tennodai, Tsukuba, 305-8573, Ibaraki, Japan · Center for Artificial Intelligence Research, Tsukuba Institute for Advanced Research (TIAR), University of Tsukuba, 1-1-1, Tennodai, Tsukuba, 305-8577, Ibaraki, Japan
Reducing information dependency does not cause training data privacy. Adversarially non-robust features do
Jul 14, 2026Rasmus Torp, Shailen K. Smith, Adam BreuerModel Inversion Attacks Neural Network Robustness
Department of Computer Science Dartmouth College · Department of Computer Science & Department of Government Dartmouth College
TIGER: Inverting Transformer Gradients via Embedding-Subspace Distance Optimization
Jun 16, 2026William Kalikman, Ivo Petrov, Dimitar I. Dimitrov +1Gradient Inversion Attacks Transformer
ETH Zürich · INSAIT, Sofia University "St. Kliment Ohridski"
The Art of Mixology: Mixup-based Obfuscation for Privacy-Preserving Split Learning in Large Language Models
Jun 15, 2026Chen Chen, Xiang Gao, Xianshun Wang +6Privacy-Preserving Language Models Privacy Leakage in Language Models
College of Computing and Data Science, Nanyang Technological University, Singapore · School of Cyber Science and Engineering, Wuhan University, China
From Latent Space to Training Data: Explainable Specialization in Minimal MLPs
May 25, 2026Enrique Alba, Ezequiel Lopez-RubioMultilayer Perceptrons Neural Network Interpretability
aITIS Software, University of Malaga, Spain
Efficient Techniques for Data Reconstruction, with Finite-Width Recovery Guarantees
May 7, 2026Edward Tansley, Roy Makhlouf, Estelle Massart +1Training Data Reconstruction Attacks Random Feature Methods
Mathematical Institute, Woodstock Road, University of Oxford, Oxford, UK, OX2 6GG. · ICTEAM Institute, UCLouvain, Euler Building, Avenue Georges Lemaˆıtre, 4 - bte L4.05.01, Louvain-la-Neuve, B - 1348, Belgium.
Turning Black Box into White Box: Dataset Distillation Leaks
Mar 1, 2026Huajie Chen, Tianqing Zhu, Yuchen Zhong +7Training Data Reconstruction Attacks Dataset Distillation
City University of Macau · CISPA Helmholtz Center for Information Security · University of Technology Sydney +1
Learning to Detect Language Model Training Data via Active Reconstruction
Feb 22, 2026Junjie Oscar Yin, John X. Morris, Vitaly Shmatikov +2Membership Inference Attacks Privacy Leakage in Language Models
University of Washington · Cornell University · UC Berkeley +1
Guarding the Middle: Protecting Intermediate Representations in Federated Split Learning
Feb 19, 2026Obaidullah Zaland, Sajib Mistry, Monowar BhuyanTraining Data Reconstruction Attacks Privacy-Preserving ML
Department of Computing Science, Umeå Unviersity, Umeå, SE-90187, Sweden · Curtin University, Bentley WA 6102, Australia
Protecting the Undeleted in Machine Unlearning
Feb 18, 2026Aloni Cohen, Refael Kohen, Kobbi Nissim +1Training Data Reconstruction Attacks Machine Unlearning
University of Chicago · Tel Aviv University · Dept. of Computer Science, Georgetown University
Mitigating Data Reconstruction Attacks in Federated Learning: Conditions, Bounds, and Theoretical Guarantees
Jul 23, 2024Xiaojin Zhang, Mingcong Xu, Wei Chen +1Federated Learning Training Data Reconstruction Attacks
Huazhong University of Science and Technology

Oct 13, 2026J/K move · Enter open · S save

Which Optimizer Leaks Most? Optimizer Implicit Bias as a Training-Data Privacy Controller

Sagi Habani, Yehonathan Refael, Ofir Lindenbaum

Ben-Gurion University · Tel Aviv University · Bar Ilan University

Training Data Reconstruction Attacks Model Inversion Attacks Deep Learning Optimization Neural Network Optimization

Open paper AskPDF arXiv

Releasing a neural network checkpoint can leak information about its training data, and existing reconstruction results rely on gradient-descent training. We ask whether the choice of optimizer affects the ability to recover the training data. Extending work connecting Karush--Kuhn--Tucker conditions to training-data reconstruction, we show that the implicit biases of popular optimizers (SGD, Adam, Muon) leave very different fingerprints of the training data. We argue that the key distinction is the weight-specificity of these implicit biases, namely how much continuous information about the final weights the optimizer-dependent target of the stationarity conditions encodes. The limiting stationarity conditions for models trained with SGD and Muon retain enough weight-specific information to reconstruct training examples in practice. For Adam in the

\ell_\infty

implicit-bias regime, the optimizer-dependent part of these conditions encodes only a discrete pattern of maximal coordinates and their signs, and at nondegenerate KKT points the conditions are too few to identify the training set to first order. Experiments on MNIST and CIFAR-10 support these claims: models trained with Muon can yield stronger reconstructions at much lower training cost than models trained with SGD, although this advantage depends on the training regime and architecture, and models trained with Adam appear consistently more resistant to the evaluated attacks.