Model inversion attacks against collaborative inference
Abstract
The prevalence of deep learning has drawn attention to the privacy protection of sensitive data. Various privacy threats have been presented, where an adversary can steal model owners' private data. Meanwhile, countermeasures have also been introduced to achieve privacy-preserving deep learning. However, most studies only focused on data privacy during training, and ignored privacy during inference.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
On its own, federated learning is an insufficient measure of privacy preservation.
“a number of works suggest5–7 that on its own, federated learning is an insufficient measure of privacy preservation.”
From Medical imaging deep learning with differential privacy (2021) · cites this paper as [7]
Cites
Image quality assessment: from error visibility to structural similarity
Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004) · IEEE Transactions on Image Processing · doi:10.1109/tip.2003.819861 · Cited by 57,892 · see citing works
Learning representations by back-propagating errors
Rumelhart, D. E., Hinton, G. E., & Williams, R. J. (1986) · Nature · doi:10.1038/323533a0 · Cited by 31,892 · see citing works
Nonlinear total variation based noise removal algorithms
Rudin, L., Osher, S., & Fatemi, E. (1992) · Physica D Nonlinear Phenomena · doi:10.1016/0167-2789(92)90242-f · Cited by 17,089 · see citing works
(2010) · Cited by 14,134 · see citing works
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280 · see citing works
(2016) · Cited by 11,679 · see citing works
A Stochastic Approximation Method
Robbins, H., & Monro, S. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729586 · Cited by 9,643 · see citing works
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2015) · arXiv · doi:10.48550/arxiv.1512.03385 · Cited by 4,196 · see citing works
Large Scale Distributed Deep Networks
Dean, J. B., Corrado, G. S., Monga, R., Chen, K., Devin, M., Mao, M., Ranzato, M., Senior, A., Tucker, P. A., Yang, K., et al. (2012) · Cited by 3,189 · see citing works
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961 · see citing works
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356 · see citing works
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734 · see citing works
August, W. U., Moore, D., Voelker, G. M., & Savage, S. (2004) · IEEE Security & Privacy · doi:10.1109/msp.2004.9 · Cited by 1,519 · see citing works
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
Hitaj, B., Ateniese, G., & Perez-Cruz, F. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134012 · Cited by 1,377 · see citing works
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S. (2018) · 2018 IEEE 31st Computer Security Foundations Symposium (CSF) · doi:10.1109/csf.2018.00027 · Cited by 1,001 · see citing works
Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., & Backes, M. (2019) · Proceedings 2019 Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23119 · Cited by 852 · see citing works
Distributed Deep Neural Networks Over the Cloud, the Edge and End Devices
Teerapittayanon, S., McDanel, B., & Kung, H. T. (2017) · 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2017.226 · Cited by 843 · see citing works
Stealing Machine Learning Models via Prediction APIs
Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., & Ristenpart, T. (2016) · arXiv · doi:10.48550/arxiv.1609.02943 · Cited by 796 · see citing works
Effective Approaches to Attention-based Neural Machine TranslationPreprint
Luong, M.-T., Pham, H., & Manning, C. D. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1508.04025 · Cited by 742 · see citing works
Machine Learning Classification over Encrypted Data
Bost, R., Popa, R. A., Tu, S., & Goldwasser, S. (2015) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2015.23241 · Cited by 683 · see citing works
Neurosurgeon: Collaborative Intelligence Between the Cloud and Mobile Edge
Kang, Y., Hauswald, J., Gao, C., Rovinski, A., Mudge, T., Mars, J., & Tang, L. (2017) · Proceedings of the Twenty-Second International Conference on Architectural Support for Programming Languages and Operating Systems · doi:10.1145/3037697.3037698 · Cited by 673 · see citing works
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.
Fredrikson, M., Lantz, E., Jha, S., Lin, S. M., Page, D., & Ristenpart, T. (2014) · PubMed · Cited by 658 · see citing works
Towards Making Systems Forget with Machine Unlearning
Cao, Y., & Yang, J. (2015) · 2015 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2015.35 · Cited by 622 · cited 1× · see citing works
“[5] proposed a methodology to remove the effects of sensitive training samples on the models.”
MethodProject Adam: building an efficient and scalable deep learning training system
Chilimbi, T. M., Suzue, Y., Apacible, J., & Kalyanaraman, K. (2014) · Operating Systems Design and Implementation · doi:10.5555/2685048.2685094 · Cited by 614 · see citing works
Machine Learning Models that Remember Too Much
Song, C., Ristenpart, T., & Shmatikov, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134077 · Cited by 526 · see citing works
Ateniese, G., Mancini, L. V., Spognardi, A., Villani, A., Vitali, D., & Felici, G. (2015) · International Journal of Security and Networks · doi:10.1504/ijsn.2015.071829 · Cited by 482 · see citing works
Handwritten digit recognition: applications of neural network chips and automatic learning
Le Cun, Y., Jackel, L. D., Boser, B., Denker, J. S., Graf, H. P., Guyon, I., Henderson, D., Howard, R. E., & Hubbard, W. (1989) · IEEE Communications Magazine · doi:10.1109/35.41400 · Cited by 480 · see citing works
Ganju, K., Wang, Q., Yang, W., Gunter, C. A., & Borisov, N. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243834 · Cited by 475 · cited 1× · see citing works
“, property inference attacks [3, 11], membership inference attacks [18, 29, 30, 39, 41, 49], model inversion attacks [9, 10].”
BackgroundJointDNN: An Efficient Training and Inference Engine for Intelligent Mobile Cloud Computing Services
Eshratifar, A. E., Abrishami, M. S., & Pedram, M. (2019) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2019.2947893 · Cited by 383 · see citing works
Reverse Engineering Convolutional Neural Networks Through Side-channel Information Leaks
Hua, W., Zhang, Z., & Suh, G. E. (2018) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1145/3195970.3196105 · Cited by 256 · see citing works
Wei, L., Luo, B., Li, Y., Liu, Y., & Xu, Q. (2018) · Annual Computer Security Applications Conference · doi:10.1145/3274694.3274696 · Cited by 206 · see citing works
Neurosurgeon: Collaborative Intelligence Between the Cloud and Mobile Edge
Kang, Y., Hauswald, J., Gao, C., Rovinski, A., Mudge, T., Mars, J., & Tang, L. (2017) · ACM SIGPLAN Notices · doi:10.1145/3093336.3037698 · Cited by 185 · see citing works
Chiron: Privacy-preserving Machine Learning as a ServicePreprint
Hunt, T., Song, C., Shokri, R., Shmatikov, V., & Witchel, E. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.05961 · Cited by 168 · see citing works
Ko, J. H., Na, T., Amir, M. F., & Mukhopadhyay, S. (2018) · 2018 15th IEEE International Conference on Advanced Video and Signal Based Surveillance (AVSS) · doi:10.1109/avss.2018.8639121 · Cited by 153 · see citing works
Sensitive-Sample Fingerprinting of Deep Neural Networks
He, Z., Zhang, T., & Lee, R. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00486 · Cited by 90 · see citing works
Self-citationDifferentially Private Releasing via Deep Generative ModelPreprint
Zhang, X.-Y., Ji, S.-L., & Wang, T. (2018) · arXiv.org · doi:10.48550/arxiv.1801.01594 · Cited by 75 · see citing works
Privacy-preserving Machine Learning through Data ObfuscationPreprint
Zhang, T., He, Z., & Lee, R. B.-L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.01860 · Cited by 72 · see citing works
Self-citationCrowd-ML: A Privacy-Preserving Learning Framework for a Crowd of Smart Devices
Hamm, J., Champion, A. C., Chen, G., Belkin, M., & Dong, X. (2015) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2015.10 · Cited by 64 · see citing works
A hybrid approach to offloading mobile image classification
Hauswald, J., Manville, T., Zheng, Q., Dreslinski, R., Chakrabarti, C., & Mudge, T. (2014) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp.2014.6855235 · Cited by 56 · see citing works
I Know What You See: Power Side-Channel Attack on Convolutional Neural Network AcceleratorsPreprint
Wei, L., Luo, B., Li, Y., Liu, Y., & Xu, Q. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.05847 · Cited by 54 · see citing works
Generating Artificial Data for Private Deep LearningPreprint
Triastcyn, A., & Faltings, B. V. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.03148 · Cited by 50 · see citing works
Towards Reverse-Engineering Black-Box Neural NetworksPreprint
Oh, S. J., Augustin, M., Schiele, B., & Fritz, M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.01768 · Cited by 42 · see citing works
Power-Grid Controller Anomaly Detection with Enhanced Temporal Deep Learning
He, Z., Raghavan, A., Hu, G., Chai, S. M., & Lee, R. B.-L. (2019) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom/bigdatase.2019.00030 · Cited by 26 · see citing works
Self-citationA Hierarchical Inference Model for Internet-of-Things
Yin, H., Wang, Z., & Jha, N. K. (2018) · IEEE Transactions on Multi-Scale Computing Systems · doi:10.1109/tmscs.2018.2821154 · Cited by 25 · see citing works
(2014) · doi:10.4230/oasics.slate.2021.16 · Cited by 1 · see citing works
Flagged first, then by citations
1 of the 48 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
End-to-end privacy preserving deep learning on multi-institutional medical imaging
Kaissis, G., Ziller, A., Passerat-Palmbach, J., Ryffel, T., Usynin, D., Trask, A., Lima, I., Mancuso, J., Jungmann, F., Steinborn, M.-M., et al. (2021) · Nature Machine Intelligence · doi:10.1038/s42256-021-00337-8 · Cited by 513 · see citing works
See through Gradients: Image Batch Recovery via GradInversion
Yin, H., Mallya, A., Vahdat, A., Álvarez, J. M., Kautz, J., & Molchanov, P. A. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.01607 · Cited by 482 · see citing works
Dreaming to Distill: Data-Free Knowledge Transfer via DeepInversion
Yin, H., Molchanov, P., Alvarez, J. M., Li, Z., Mallya, A., Hoiem, D., Jha, N. K., & Kautz, J. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00874 · Cited by 540 · see citing works
Vertical Federated Learning: Concepts, Advances, and Challenges
Liu, Y., Kang, Y., Zou, T., Pu, Y., He, Y., Ye, X., Ouyang, Y., Zhang, Y.-Q., & Yang, Q. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3352628 · Cited by 433 · see citing works
A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning
Tian, Z., Cui, L., Liang, J., & Yu, S. (2022) · ACM Computing Surveys · doi:10.1145/3551636 · Cited by 277 · see citing works
Analyzing User-Level Privacy Attack Against Federated Learning
Song, M., Wang, Z., Zhang, Z., Song, Y., Wang, Q., Ren, J., & Qi, H. (2020) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2020.3000372 · Cited by 256 · see citing works
A Survey of Privacy Attacks in Machine Learning
Rigaki, M., & Garcia, S. (2024) · ACM Computing Surveys · doi:10.1145/3624010 · Cited by 285 · see citing works
Baccour, E., Mhaisen, N., Abdellatif, A. A., Erbad, A., Mohamed, A. M. S., Hamdi, M., & Guizani, M. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3200740 · Cited by 209 · see citing works
Medical imaging deep learning with differential privacy
Ziller, A., Usynin, D., Braren, R., Makowski, M., Rueckert, D., & Kaissis, G. (2021) · Scientific Reports · doi:10.1038/s41598-021-93030-0 · Cited by 172 · see citing works
Unleashing the Tiger: Inference Attacks on Split Learning
Pasquini, D., Ateniese, G., & Bernaschi, M. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3485259 · Cited by 172 · see citing works
Preserving data privacy in machine learning systems
Mestari, S. Z. E., Lenzini, G., & Demirci, H. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103605 · Cited by 180 · see citing works
Attacking and Protecting Data Privacy in Edge–Cloud Collaborative Inference Systems
He, Z., Zhang, T., & Lee, R. B.-L. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3022358 · Cited by 126 · see citing works
Self-citationPrivacy in Deep Learning: A Survey
Mireshghallah, F., Taram, M., Vepakomma, P., Singh, A., Raskar, R., & Esmaeilzadeh, H. (2020) · arXiv · doi:10.48550/arxiv.2004.12254 · Cited by 106 · see citing works
RingSFL: An Adaptive Split Federated Learning Towards Taming Client Heterogeneity
Shen, J., Cheng, N., Wang, X., Lyu, F., Xu, W., Liu, Z., Aldubaikhy, K., & Shen, X. (2023) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2023.3309633 · Cited by 104 · see citing works
Towards Security Threats of Deep Learning Systems: A Survey
He, Y., Meng, G., Chen, K., Hu, X., & He, J. (2020) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2020.3034721 · Cited by 114 · see citing works
Exploiting Explanations for Model Inversion Attacks
Zhao, X., Zhang, W., Xiao, X., & Lim, B. Y. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00072 · Cited by 94 · see citing works
AttrLeaks on the Edge: Exploiting Information Leakage from Privacy-Preserving Co-inference
Wang, Z., Liu, K., Hu, J., Ren, J., Guo, H., & Yuan, W. M. (2023) · Chinese Journal of Electronics · doi:10.23919/cje.2022.00.031 · Cited by 91 · see citing works
Privacy-Preserving Machine Learning: Methods, Challenges and DirectionsPreprint
Xu, R., Baracaldo, N., & Joshi, J. B. D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2108.04417 · Cited by 172 · see citing works
Erdoğan, E., Küpçü, A., & Çiçek, A. E. (2022) · Workshop on Privacy in the Electronic Society · doi:10.1145/3559613.3563201 · Cited by 83 · see citing works
Tran, H.-Y., Hu, J., Yin, X., & Pota, H. R. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3267892 · Cited by 81 · see citing works
R-GAP: Recursive Gradient Attack on PrivacyPreprint
Zhu, J., & Blaschko, M. B. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.07733 · Cited by 79 · see citing works
Differential privacy in deep learning: A literature survey
Pan, K., Ong, Y.-S., Gong, M., Li, H., Qin, A. K., & Gao, Y. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.127663 · Cited by 79 · see citing works
Privacy Inference Attack and Defense in Centralized and Federated Learning: A Comprehensive Survey
Rao, B., Zhang, J., Wu, D., Zhu, C., Sun, X., & Chen, B. (2024) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2024.3363670 · Cited by 79 · see citing works
Integration of large language models and federated learning
Chen, C., Feng, X., Li, Y., Lyu, L., Zhou, J., Zheng, X., & Yin, J. (2024) · Patterns · doi:10.1016/j.patter.2024.101098 · Cited by 103 · see citing works
Sousa, S., & Kern, R. (2022) · Artificial Intelligence Review · doi:10.1007/s10462-022-10204-6 · Cited by 74 · see citing works
Survey: Leakage and Privacy at Inference Time
Jegorova, M., Kaul, C., Mayor, C., O'Neil, A. Q., Weir, A., Murray-Smith, R., & Tsaftaris, S. A. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3229593 · Cited by 77 · see citing works
A robust analysis of adversarial attacks on federated learning environments
Nair, A. K., Raj, E. D., & Sahoo, J. (2023) · Computer Standards & Interfaces · doi:10.1016/j.csi.2023.103723 · Cited by 70 · see citing works
Adversarial machine learning: a review of methods, tools, and critical industry sectors
Pelekis, S., Koutroubas, T., Blika, A., Berdelis, A., Karakolis, E., Ntanos, C., Spiliotis, E., & Askounis, D. (2025) · Artificial Intelligence Review · doi:10.1007/s10462-025-11147-4 · Cited by 75 · see citing works
Adversarial interference and its mitigations in privacy-preserving collaborative machine learning
Usynin, D., Ziller, A., Makowski, M. R., Braren, R., Rueckert, D., Glocker, B., Kaissis, G. A., & Passerat‐Palmbach, J. (2021) · Nature Machine Intelligence · doi:10.1038/s42256-021-00390-3 · Cited by 64 · see citing works
Binarizing Split Learning for Data Privacy Enhancement and Computation Reduction
Pham, N. D., Abuadbba, A., Gao, Y., Phan, K. T., & Chilamkurti, N. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3274391 · Cited by 61 · see citing works
Approximate homomorphic encryption based privacy-preserving machine learning: a survey
Yuan, J., Liu, W., Shi, J., & Li, Q. (2025) · Artificial Intelligence Review · doi:10.1007/s10462-024-11076-8 · Cited by 69 · see citing works
No Free Lunch Theorem for Security and Utility in Federated Learning
Zhang, X., Gu, H., Fan, L., Chen, K., & Yang, Q. (2022) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3563219 · Cited by 65 · see citing works
Exploring the Landscape of Machine Unlearning: A Comprehensive Survey and Taxonomy
Shaik, T., Tao, X., Xie, H., Li, L., Zhu, X., & Li, Q. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2024.3486109 · Cited by 78 · see citing works
Federated learning attack surface: taxonomy, cyber defences, challenges, and future directions
Qammar, A., Ding, J., & Ning, H. (2021) · Artificial Intelligence Review · doi:10.1007/s10462-021-10098-w · Cited by 55 · see citing works
Collaborative Inference for AI-Empowered IoT Devices
Shlezinger, N., & Bajić, I. V. (2022) · IEEE Internet of Things Magazine · doi:10.1109/iotm.001.2200152 · Cited by 54 · see citing works
pvCNN: Privacy-Preserving and Verifiable Convolutional Neural Network Testing
Weng, J., Weng, J., Tang, G., Yang, A., Li, M., & Liu, J.-N. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3262932 · Cited by 57 · see citing works
Yao, A., Li, G., Li, X., Jiang, F., Jia, X., & Liu, X. (2023) · Array · doi:10.1016/j.array.2023.100293 · Cited by 55 · see citing works
SoK: Model Inversion Attack Landscape: Taxonomy, Challenges, and Future Roadmap
Dibbo, S. V. (2023) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf57540.2023.00027 · Cited by 52 · see citing works
MIRROR: Model Inversion for Deep Learning Network with High Fidelity
An, S., Tao, G., Xu, Q., Liu, Y., Shen, G., Yao, Y., Xu, J., & Zhang, X. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24335 · Cited by 48 · see citing works
Practical Membership Inference Attack Against Collaborative Inference in Industrial IoT
Chen, H., Li, H., Dong, G., Hao, M., Xu, G., Huang, X., & Liu, Z. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.3046648 · Cited by 46 · see citing works
Adaptive Privacy Preserving Deep Learning Algorithms for Medical Data
Zhang, X., Ding, J., Wu, M., Wong, S. T. C., Nguyen, H. V., & Pan, M. (2021) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv48630.2021.00121 · Cited by 43 · see citing works
Not All Features Are Equal: Discovering Essential Features for Preserving Prediction Privacy
Mireshghallah, F., Taram, M., Jalali, A., Elthakeb, A. T., Tullsen, D. M., & Esmaeilzadeh, H. (2021) · International World Wide Web Conference (WWW) · doi:10.1145/3442381.3449965 · Cited by 46 · see citing works
ActionBert: Leveraging User Actions for Semantic Understanding of User Interfaces
He, Z., Sunkara, S., Zang, X., Xu, Y., Liu, L., Wichers, N., Schubiner, G., Lee, R., & Chen, J. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i7.16741 · Cited by 44 · see citing works
Self-citationPrivacy-preserving Adversarial Facial Features
Wang, Z., Wang, H., Jin, S., Zhang, W., Hut, J., Wang, Y., Sun, P., Yuan, W., Liu, K., & Rent, K. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00794 · Cited by 40 · see citing works
Privacy-preserving Collaborative Learning with Automatic Transformation Search
Gao, W., Guo, S., Zhang, T., Qiu, H., Wen, Y., & Liu, Y. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00018 · Cited by 41 · see citing works
Self-citationLiu, C., Chen, B., Shao, W., Zhang, W., Wong, K. K. L., & Zhang, Y. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3377730 · Cited by 43 · see citing works
Ten Challenging Problems in Federated Foundation Models
Fan, T., Gu, H., Cao, X., Chan, C. S., Chen, Q., Chen, Y., Feng, Y., Gu, Y., Geng, J., Luo, B., et al. (2025) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2025.3555328 · Cited by 39 · see citing works
Self-citationAsad, M., Moustafa, A., & Aslam, M. (2021) · Applied Soft Computing · doi:10.1016/j.asoc.2021.107235 · Cited by 39 · see citing works
A Bargaining Game for Personalized, Energy Efficient Split Learning over Wireless Networks
Kim, M., DeRieux, A., & Saad, W. (2023) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc55385.2023.10118601 · Cited by 37 · see citing works
Machine learning security and privacy: a review of threats and countermeasures
Paracha, A., Arshad, J., Farah, M. A. B., & Ismail, K. N. (2024) · EURASIP Journal on Information Security · doi:10.1186/s13635-024-00158-3 · Cited by 42 · see citing works
Stealing Deep Reinforcement Learning Models for Fun and Profit
Chen, K., Guo, S., Zhang, T., Xie, X., & Liu, Y. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3453090 · Cited by 37 · see citing works
Self-citationPrivacy-Preserving Federated Adversarial Domain Adaptation Over Feature Groups for Interpretability
Kang, Y., He, Y., Luo, J., Fan, T. T., Liu, Y., & Yang, Q. (2022) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2022.3188292 · Cited by 37 · see citing works
Yang, R., Ma, J., Zhang, J., Kumari, S., Kumar, S., & Rodrigues, J. J. P. C. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3275161 · Cited by 37 · see citing works
Handling data heterogeneity with generative replay in collaborative learning for medical imaging
Qu, L., Balachandar, N., Zhang, M., & Rubin, D. L. (2022) · Medical Image Analysis · doi:10.1016/j.media.2022.102424 · Cited by 35 · see citing works
Privacy-Preserving Face Recognition Using Trainable Feature Subtraction
Mi, Y., Zhong, Z., Huang, Y., Ji, J., Xu, J., Wang, J., Wang, S., Ding, S., & Zhou, S. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.00036 · Cited by 34 · see citing works
Real world federated learning with a knowledge distilled transformer for cardiac CT imaging
Tölle, M., Garthe, P., Scherer, C., Seliger, J. M., Leha, A., Krüger, N., Simm, S., Martin, S. S., Eble, S., Kelm, H., et al. (2025) · npj Digital Medicine · doi:10.1038/s41746-025-01434-3 · Cited by 36 · see citing works
HSFL: Efficient and Privacy-Preserving Offloading for Split and Federated Learning in IoT Services
Deng, R., Du, X., Lu, Z., Duan, Q., Huang, S.-C., & Wu, J. (2023) · IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws60048.2023.00084 · Cited by 32 · see citing works
Khowaja, S. A., Lee, I. H., Dev, K., Jarwar, M. A., & Qureshi, N. M. F. (2022) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2022.3188575 · Cited by 32 · see citing works
Privacy-preserving explainable AI: a survey
Nguyên, T. T., Huynh, T. T., Ren, Z., Nguyen, T. T., Nguyen, P. L., Yin, H., & Nguyen, Q. V. H. (2024) · Science China Information Sciences · doi:10.1007/s11432-024-4123-4 · Cited by 31 · see citing works
Security of federated learning for cloud‐edge intelligence collaborative computing
Yang, J., Zheng, J., Zhang, Z., Chen, Q., Wong, D. S., & Li, Y. (2022) · International Journal of Intelligent Systems · doi:10.1002/int.22992 · Cited by 31 · see citing works
Issa, W., Moustafa, N., Turnbull, B., & Choo, K. R. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3368879 · Cited by 30 · see citing works
Subbanna, N. K., Wilms, M., Tuladhar, A., & Forkert, N. D. (2021) · Sensors · doi:10.3390/s21113874 · Cited by 30 · see citing works
Practical Defences Against Model Inversion Attacks for Split Neural NetworksPreprint
Titcombe, T., Hall, A. J., Papadopoulos, P., & Romanini, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.05743 · Cited by 50 · see citing works
HashVFL: Defending Against Data Reconstruction Attacks in Vertical Federated Learning
Qiu, P., Zhang, X., Ji, S., Fu, C., Yang, X., & Wang, T. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3356164 · Cited by 30 · see citing works
Preserving data privacy in federated learning through large gradient pruning
Zhang, Z., Zhu, T., Ren, W., Xiong, P., & Choo, K. R. (2022) · Computers & Security · doi:10.1016/j.cose.2022.103039 · Cited by 28 · see citing works
A GAN-Based Defense Framework Against Model Inversion Attacks
Gong, X., Wang, Z., Li, S., Chen, Y., & Wang, Q. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3295944 · Cited by 29 · see citing works
Kaleidoscope: Physical Backdoor Attacks Against Deep Neural Networks With RGB Filters
Gong, X., Wang, Z., Chen, Y., Xue, M., Wang, Q., & Shen, C. Q. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3239225 · Cited by 27 · see citing works
A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack Against Split Learning
Xu, X., Yang, M., Yi, W., Li, Z., Wang, J., Hu, H., Zhuang, Y., & Liu, Y. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.01153 · Cited by 26 · see citing works
Beyond Gradients: Exploiting Adversarial Priors in Model Inversion Attacks
Usynin, D., Rueckert, D., & Kaissis, G. A. (2023) · ACM Transactions on Privacy and Security · doi:10.1145/3592800 · Cited by 26 · see citing works
Du, W., Li, A., Zhou, P., Niu, B., & Wu, D. O. (2021) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2021.3050458 · Cited by 27 · see citing works
Can differential privacy practically protect collaborative deep learning inference for IoT?
Ryu, J., Zheng, Y., Gao, Y., Abuadbba, A., Kim, J., Won, D., Nepal, ., Kim, H., & Wang, C. (2022) · Wireless Networks · doi:10.1007/s11276-022-03113-7 · Cited by 22 · see citing works
A comprehensive survey and taxonomy on privacy-preserving deep learning
Tran, A.-T., Luong, T.-D., & Huynh, V.-N. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.127345 · Cited by 21 · see citing works
A Hybrid Self-Supervised Learning Framework for Vertical Federated Learning
He, Y., Kang, Y., Zhao, X., Luo, J., Fan, L., Han, Y., & Yang, Q. (2024) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2024.3403386 · Cited by 21 · see citing works
Privacy and security vulnerabilities in edge intelligence: An analysis and countermeasures
Shafee, A. A., Hasan, S. R., & Awaad, T. A. (2025) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2025.110146 · Cited by 25 · see citing works
Cooperative Inference of DNNs for Delay- and Memory-Constrained Wireless IoT Systems
Yun, S., Choi, W., & Kim, I. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3152359 · Cited by 21 · see citing works
LDS-FL: Loss Differential Strategy Based Federated Learning for Privacy Preserving
Wang, T., Yang, Q., Zhu, K., Wang, J., Su, C., & Sato, K. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3322328 · Cited by 22 · see citing works
Ding, W., Abdel‐Basset, M., Ali, A. M., & Moustafa, N. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2024.109451 · Cited by 21 · see citing works
A Method to Improve the Privacy and Security for Federated Learning
Bai, Y., & Fan, M. (2021) · International Conference on Computer and Communication Systems (ICCCS) · doi:10.1109/icccs52626.2021.9449214 · Cited by 20 · see citing works
DistPrivacy: Privacy-Aware Distributed Deep Neural Networks in IoT surveillance systems
Baccour, E., Erbad, A., Mohamed, A. M. S., Hamdi, M., & Guizani, M. (2020) · Globecom · doi:10.1109/globecom42002.2020.9322470 · Cited by 20 · see citing works
Ginver: Generative Model Inversion Attacks Against Collaborative Inference
Yin, Y., Zhang, X., Zhang, H., Li, F., Yu, Y., Cheng, X., & Hu, P. (2023) · International World Wide Web Conference (WWW) · doi:10.1145/3543507.3583306 · Cited by 19 · see citing works
Topology-Aware Differential Privacy for Decentralized Image Classification
Guo, S., Zhang, T., Xu, G., Yu, H., Xiang, T., & Liu, Y. (2021) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2021.3105723 · Cited by 20 · see citing works
Self-citationEvaluation of Inference Attack Models for Deep Learning on Medical DataPreprint
Wu, M., Zhang, X., Ding, J., Nguyen, H. V., Rong, Y., Pan, M., & Wong, S. T. C. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.00177 · Cited by 23 · see citing works
Differentially private federated deep learning for multi-site medical image segmentationPreprint
Ziller, A., Usynin, D., Remerscheid, N. W., Knolle, M. A., Braren, R., Rueckert, D., & Kaissis, G. A. (2022) · Research Square · doi:10.21203/rs.3.rs-1478332/v1 · Cited by 18 · see citing works
Yang, B., Yeh, H.-W., Harada, T., & Yuen, P. C. (2021) · IEEE Transactions on Image Processing · doi:10.1109/tip.2021.3130530 · Cited by 17 · see citing works
On Feasibility of Server-side Backdoor Attacks on Split Learning
Tajalli, B., Ersoy, O., & Picek, S. (2023) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw59333.2023.00014 · Cited by 17 · see citing works
Li, J., Liao, G., Chen, L., & Chen, X. (2023) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2023.3312304 · Cited by 17 · see citing works
RL-DistPrivacy: Privacy-Aware Distributed Deep Inference for Low Latency IoT Systems
Baccour, E., Erbad, A., Mohamed, A. M. S., Hamdi, M., & Guizani, M. (2022) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2022.3165472 · Cited by 17 · see citing works
Frontier AI regulation: what form should it take?
Radanliev, P. (2025) · Frontiers in Political Science · doi:10.3389/fpos.2025.1561776 · Cited by 16 · see citing works
Roth, H. R., Hatamizadeh, A., Xu, Z., Zhao, C., Li, W., Myronenko, A., & Xu, D. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-18523-6_5 · Cited by 16 · see citing works
Practical and General Backdoor Attacks Against Vertical Federated Learning
Xuan, Y., Chen, X., Zhao, Z., Tang, B., & Dong, Y. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-43415-0_24 · Cited by 16 · see citing works
PATROL: Privacy-Oriented Pruning for Collaborative Inference Against Model Inversion Attacks
Ding, S., Zhang, L., Pan, M., & Yuan, X. (2024) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv57701.2024.00465 · Cited by 17 · see citing works
GANMIA: GAN-based Black-box Membership Inference Attack
Bai, Y., Chen, D., Chen, T., & Fan, M. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500657 · Cited by 16 · see citing works
Erdoğan, E., Küpçü, A., & Çiçek, A. E. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2108.09033 · Cited by 16 · see citing works
FedPass: Privacy-Preserving Vertical Federated Deep Learning with Adaptive Obfuscation
Gu, H., Luo, J., Kang, Y., Fan, L., & Yang, Q. (2023) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2023/418 · Cited by 15 · see citing works
A Game-theoretic Framework for Privacy-preserving Federated Learning
Zhang, X., Fan, L., Wang, S., Li, W., Chen, K., & Yang, Q. (2024) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3656049 · Cited by 16 · see citing works
Split Without a Leak: Reducing Privacy Leakage in Split Learning
Nguyen, K., Khan, T., & Michalas, A. (2024) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-64954-7_17 · Cited by 15 · see citing works
Enhancing Accuracy-Privacy Trade-Off in Differentially Private Split Learning
Pham, N. D., Phan, K. T., & Chilamkurti, N. (2024) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2024.3485723 · Cited by 18 · see citing works
Zhang, M., Abdi, M., Dasari, V. R., & Restuccia, F. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111531 · Cited by 20 · see citing works
FLSys: Toward an Open Ecosystem for Federated Learning Mobile Apps
Jiang, X., Hu, H., On, T., Lai, P., Mayyuri, V. D., Chen, A., Shila, D. M., Larmuseau, A., Jin, R., Borcea, C., et al. (2022) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2022.3223578 · Cited by 14 · see citing works
ATPL: Mutually enhanced adversarial training and pseudo labeling for unsupervised domain adaptation
Yi, C., Chen, H., Xu, Y., Liu, Y., Jiang, L., & Tan, H. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.108831 · Cited by 14 · see citing works
- Authors
- He, Z., Zhang, T., & Lee, R. B.
- Affiliations
- Princeton University (US)
- Nanyang Technological University (SG)
- Venue
- Proceedings of the 35th Annual Computer Security Applications Conference
- Publisher
- ACM
- Published
- 2019-12-09
- Pages
- 148-162
- ISSN
- 1063-9527 (ISSN-L)
- OpenAlex
- W2989885118
- Cited by
- 313
- References
- 48
- Citations by year
- 2026: 30 · 2025: 81 · 2024: 62 · 2023: 49 · 2022: 36 · 2021: 39 · 2020: 16
- FWCI
- 8.70
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Annual Computer Security Applications Conference (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
- Keywords
- model inversion attacks, collaborative inference, inference privacy, privacy-preserving deep learning, data privacy, adversarial attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
