The DOI matches its Crossref record; 47 of the 48 references it cites were found in a registry or an index.
Model inversion attacks against collaborative inference
Abstract
The prevalence of deep learning has drawn attention to the privacy protection of sensitive data. Various privacy threats have been presented, where an adversary can steal model owners' private data. Meanwhile, countermeasures have also been introduced to achieve privacy-preserving deep learning. However, most studies only focused on data privacy during training, and ignored privacy during inference.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“a number of works suggest5–7 that on its own, federated learning is an insufficient measure of privacy preservation.”
From Medical imaging deep learning with differential privacy (2021) · cites this paper as [7]
Citations
Cites
Image quality assessment: from error visibility to structural similarity
Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004) · IEEE Transactions on Image Processing · doi:10.1109/tip.2003.819861 · Cited by 57,892
Learning representations by back-propagating errors
Rumelhart, D. E., Hinton, G. E., & Williams, R. J. (1986) · Nature · doi:10.1038/323533a0 · Cited by 31,892
Nonlinear total variation based noise removal algorithms
Rudin, L., Osher, S., & Fatemi, E. (1992) · Physica D Nonlinear Phenomena · doi:10.1016/0167-2789(92)90242-f · Cited by 17,214
(2010) · Cited by 14,134
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280
(2016) · Cited by 11,679
A Stochastic Approximation Method
Robbins, H., & Monro, S. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729586 · Cited by 9,643
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2015) · arXiv · doi:10.48550/arxiv.1512.03385 · Cited by 4,196
Research works printed but not linked: 14
- Ateniese Giuseppe, 2015, International Journal of Security and Networks
- Chilimbi Trishul, 2014, USENIX Symposium on Operating Systems Design and Implementation.
- Ganju Karan, 2018, ACM Conference on Computer and Communications Security.
- Glorot Xavier, 2010, Proceedings of the thirteenth international conference on artificial intelligence and statistics. 249--256
- Jamie Hayes Luca Melis George Danezis and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). Jamie Hayes Luca Melis George Danezis and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). · arXiv
- Hua Weizhe, 2018, ACM/ESDA/IEEE Design Automation Conference.
- Kingma Diederik P, 2014, Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 · arXiv
- Liu Kin Sum, 2018, Generative Model: Membership Attack, Generalization and Diversity. arXiv preprint arXiv:1805.09898 · arXiv
- Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl A Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv preprint arXiv:1802.04889 (2018). Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl A Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv preprint arXiv:1802.04889 (2018). · arXiv
- Oh Seong Joon, 2018, INternational Conference on Learning Representations.
- Ohrimenko Olga, 2016, USENIX Security Symposium.
- Shokri Reza, 2015, ACM conference on computer and communications security.
- Tramèr Florian, 2016, USENIX Security Symposium.
- Wang Binghui, 2018, Stealing Hyperparameters in Machine Learning. In IEEE Symposium on Security and Privacy.
Cited by
Sorted by citations
End-to-end privacy preserving deep learning on multi-institutional medical imaging
Kaissis, G., Ziller, A., Passerat-Palmbach, J., Ryffel, T., Usynin, D., Trask, A., Lima, I., Mancuso, J., Jungmann, F., Steinborn, M.-M., et al. (2021) · Nature Machine Intelligence · doi:10.1038/s42256-021-00337-8 · Cited by 513
“We note that while the data enjoys information-theoretic secrecy guarantees, the party requesting inference has access to the model’s predictions and can perform black-box membership inference 59 or model inversion attacks 60 .”
See through Gradients: Image Batch Recovery via GradInversion
Yin, H., Mallya, A., Vahdat, A., Álvarez, J. M., Kautz, J., & Molchanov, P. A. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.01607 · Cited by 519
Dreaming to Distill: Data-Free Knowledge Transfer via DeepInversion
Yin, H., Molchanov, P., Alvarez, J. M., Li, Z., Mallya, A., Hoiem, D., Jha, N. K., & Kautz, J. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00874 · Cited by 540
Vertical Federated Learning: Concepts, Advances, and Challenges
Liu, Y., Kang, Y., Zou, T., Pu, Y., He, Y., Ye, X., Ouyang, Y., Zhang, Y.-Q., & Yang, Q. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3352628 · Cited by 496
“He et al. [95] proposed a black-box MI attack to learn features x B of the passive party B under the splitNN setting by training a shadow model ˆ G B to mimic the local model G B using auxiliary data.”
BackgroundMethodInfluentialA Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning
Tian, Z., Cui, L., Liang, J., & Yu, S. (2022) · ACM Computing Surveys · doi:10.1145/3551636 · Cited by 293
“The privacy attack could be defined as malicious attempts revealing training data, such as membership inference [109, 114, 125] and model inversion [34, 45, 146, 154, 161].”
BackgroundAnalyzing User-Level Privacy Attack Against Federated Learning
Song, M., Wang, Z., Zhang, Z., Song, Y., Wang, Q., Ren, J., & Qi, H. (2020) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2020.3000372 · Cited by 262
“Considering the privacy threat of inference data rather than training data, He et al. [28] proposed an inversion attack to recover the optimal samples by minimizing the distance of the target data’s intermediate output.”
BackgroundA Survey of Privacy Attacks in Machine Learning
Rigaki, M., & Garcia, S. (2024) · ACM Computing Surveys · doi:10.1145/3624010 · Cited by 285
Baccour, E., Mhaisen, N., Abdellatif, A. A., Erbad, A., Mohamed, A. M. S., Hamdi, M., & Guizani, M. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3200740 · Cited by 223
“in [46], advised to perform deep partition in case the source device has enough computational capacity.”
BackgroundMethodInfluentialMedical imaging deep learning with differential privacy
Ziller, A., Usynin, D., Braren, R., Makowski, M., Rueckert, D., & Kaissis, G. (2021) · Scientific Reports · doi:10.1038/s41598-021-93030-0 · Cited by 172
Unleashing the Tiger: Inference Attacks on Split Learning
Pasquini, D., Ateniese, G., & Bernaschi, M. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3485259 · Cited by 190
“This assumption is congruent with previous attacks against collaborative inference [29], and makes our threat model more realistic and less restrictive than the ones adopted in other related works [55, 58], where the adversary is assumed to have direct access to leaked pairs of smashed data and private data.”
ResultPreserving data privacy in machine learning systems
Mestari, S. Z. E., Lenzini, G., & Demirci, H. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103605 · Cited by 195
“There are various privacy attacks against machine learning systems such as membership inference attacks (Shokri et al., 2017; Bernau et al., 2019; Jia et al., 2019a; Li et al., 2020) and model inversion attacks (Fredrikson et al., 2015; He et al., 2019; Wu et al., 2016).”
BackgroundAttacking and Protecting Data Privacy in Edge–Cloud Collaborative Inference Systems
He, Z., Zhang, T., & Lee, R. B.-L. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3022358 · Cited by 130
“More details on the attacks can be found in [1].”
BackgroundSelf-citationPrivacy in Deep Learning: A Survey
Mireshghallah, F., Taram, M., Vepakomma, P., Singh, A., Raskar, R., & Esmaeilzadeh, H. (2020) · arXiv · doi:10.48550/arxiv.2004.12254 · Cited by 106
“[47] propose a new set of attacks to compromise the”
BackgroundRingSFL: An Adaptive Split Federated Learning Towards Taming Client Heterogeneity
Shen, J., Cheng, N., Wang, X., Lyu, F., Xu, W., Liu, Z., Aldubaikhy, K., & Shen, X. (2023) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2023.3309633 · Cited by 117
“As discussed in [39], there are three main settings for the model inversion attack: white-box setting , black-box setting , and query-free setting , and we discuss each of these three settings.”
BackgroundTowards Security Threats of Deep Learning Systems: A Survey
He, Y., Meng, G., Chen, K., Hu, X., & He, J. (2020) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2020.3034721 · Cited by 121
“The technology of model inversion attack can also be used to recover an input sample [65] [88], and detect a replay attack [192].”
MethodExploiting Explanations for Model Inversion Attacks
Zhao, X., Zhang, W., Xiao, X., & Lim, B. Y. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00072 · Cited by 109
“We focus on model inversion attacks that can reconstruct data from model predictions [11, 15, 50, 54].”
BackgroundAttrLeaks on the Edge: Exploiting Information Leakage from Privacy-Preserving Co-inference
Wang, Z., Liu, K., Hu, J., Ren, J., Guo, H., & Yuan, W. M. (2023) · Chinese Journal of Electronics · doi:10.23919/cje.2022.00.031 · Cited by 91
Privacy-Preserving Machine Learning: Methods, Challenges and DirectionsPreprint
Xu, R., Baracaldo, N., & Joshi, J. B. D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2108.04417 · Cited by 233
“An adversary can also infer private information by exploiting an ML model via various inference attacks such as membership inference attacks [11, 12, 13, 14, 15], model inversion attacks [16, 17, 18], property inference attacks [19, 20], and privacy leakage from gradients exchanged in distributed ML scenarios [21, 22].”
BackgroundErdoğan, E., Küpçü, A., & Çiçek, A. E. (2022) · Workshop on Privacy in the Electronic Society · doi:10.1145/3559613.3563201 · Cited by 83
“Table 5 displays the average number of black-box queries made by the server in [7]’s black-box attack to reach the same PSNR values UnSplit obtains.”
BackgroundMethodInfluentialTran, H.-Y., Hu, J., Yin, X., & Pota, H. R. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3267892 · Cited by 81
“However, federated learning is vulnerable to inference attacks from dishonest aggregators who can infer information about clients’ training data from their model parameters (weights, gradients) [2], [3], [4], [5], [6], [7].”
BackgroundR-GAP: Recursive Gradient Attack on PrivacyPreprint
Zhu, J., & Blaschko, M. B. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.07733 · Cited by 109
“More broadly, the existence of model inversion attacks (He et al., 2019; Wang et al., 2019; Yang et al., 2019; Zhang et al., 2020) calls into question whether transferring”
BackgroundDifferential privacy in deep learning: A literature survey
Pan, K., Ong, Y.-S., Gong, M., Li, H., Qin, A. K., & Gao, Y. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.127663 · Cited by 89
Privacy Inference Attack and Defense in Centralized and Federated Learning: A Comprehensive Survey
Rao, B., Zhang, J., Wu, D., Zhu, C., Sun, X., & Chen, B. (2024) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2024.3363670 · Cited by 89
Integration of large language models and federated learning
Chen, C., Feng, X., Li, Y., Lyu, L., Zhou, J., Zheng, X., & Yin, J. (2024) · Patterns · doi:10.1016/j.patter.2024.101098 · Cited by 140
“On the other hand, model inversion attacks primarily aim to reverse-engineer the internal representation produced by the model to reveal training data [51, 50, 66].”
Sousa, S., & Kern, R. (2022) · Artificial Intelligence Review · doi:10.1007/s10462-022-10204-6 · Cited by 81
“2020), and images (He et al. 2019; Sánchez et al. 2018), inherently present sensitive content which must be protected.”
BackgroundSurvey: Leakage and Privacy at Inference Time
Jegorova, M., Kaul, C., Mayor, C., O'Neil, A. Q., Weir, A., Murray-Smith, R., & Tsaftaris, S. A. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3229593 · Cited by 77
“4 [22], [34], [50] [53], [54] [65], [66], [67], [68], [69], [70] [69] [19], [22], [44], [71] [44], [50] [19], [22], [34], [50] [65], [67], [68], [69], [70] [53], [54], [71], [72], [73] [19], [44], [69] [22], [50] - - [34], [50], [67] 9092 IEEE TRANSACTIONS ON PATTERN ANALYSIS AND MACHINE INTELLIGENCE, VOL.”
BackgroundA robust analysis of adversarial attacks on federated learning environments
Nair, A. K., Raj, E. D., & Sahoo, J. (2023) · Computer Standards & Interfaces · doi:10.1016/j.csi.2023.103723 · Cited by 70
Adversarial machine learning: a review of methods, tools, and critical industry sectors
Pelekis, S., Koutroubas, T., Blika, A., Berdelis, A., Karakolis, E., Ntanos, C., Spiliotis, E., & Askounis, D. (2025) · Artificial Intelligence Review · doi:10.1007/s10462-025-11147-4 · Cited by 92
Adversarial interference and its mitigations in privacy-preserving collaborative machine learning
Usynin, D., Ziller, A., Makowski, M. R., Braren, R., Rueckert, D., Glocker, B., Kaissis, G. A., & Passerat‐Palmbach, J. (2021) · Nature Machine Intelligence · doi:10.1038/s42256-021-00390-3 · Cited by 68
“In contrast, MInv concentrates on the relationship between the model input and model output, trying to reverse-engineer the internal representations produced by the model to reveal the training data and makes no such assumptions 12,43 .”
BackgroundMethodBinarizing Split Learning for Data Privacy Enhancement and Computation Reduction
Pham, N. D., Abuadbba, A., Gao, Y., Phan, K. T., & Chilamkurti, N. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3274391 · Cited by 61
“various metrics such as mean square error, Kullback-Leibler divergence (KL-D) [17], distance correlation (DCOR) [16], [20], structural similarity index measure (SSIM), and peak signal-to-noise ratio (PNSR) [39].”
BackgroundApproximate homomorphic encryption based privacy-preserving machine learning: a survey
Yuan, J., Liu, W., Shi, J., & Li, Q. (2025) · Artificial Intelligence Review · doi:10.1007/s10462-024-11076-8 · Cited by 76
“…(2022), the authors observed that for some application scenarios lacking data support, Transfer Learning (TL) is generally used for these scenarios, but TL (Fuzhen et al. 2021 ) also suffers from privacy leakage in some application scenarios, such as model inver - sion attacks (He et al. 2019 ).”
No Free Lunch Theorem for Security and Utility in Federated Learning
Zhang, X., Gu, H., Fan, L., Chen, K., & Yang, Q. (2022) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3563219 · Cited by 74
“However, adversaries could still infer private data from the model output in this case [27, 41].”
BackgroundMethodResultInfluentialExploring the Landscape of Machine Unlearning: A Comprehensive Survey and Taxonomy
Shaik, T., Tao, X., Xie, H., Li, L., Zhu, X., & Li, Q. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2024.3486109 · Cited by 113
“…a model’s predictions to infer the characteristics of the underlying training data, thereby posing potential risks to data privacy and security [79]. a) Inversion mechanism: The crux of model inversion lies in manipulating a model’s inputs in such a manner as to elicit a particular output,…”
Federated learning attack surface: taxonomy, cyber defences, challenges, and future directions
Qammar, A., Ding, J., & Ning, H. (2021) · Artificial Intelligence Review · doi:10.1007/s10462-021-10098-w · Cited by 58
“1 Poisoning attacks The objective of a poisoning attack is to converge a benign model into a wrong model and it has a high probability of occurrence in the FL environment Kairouz et al. (2019); Bhagoji et al.”
BackgroundCollaborative Inference for AI-Empowered IoT Devices
Shlezinger, N., & Bajić, I. V. (2022) · IEEE Internet of Things Magazine · doi:10.1109/iotm.001.2200152 · Cited by 54
“For example, the model inversion attack [11] tries to recover the original data”
BackgroundpvCNN: Privacy-Preserving and Verifiable Convolutional Neural Network Testing
Weng, J., Weng, J., Tang, G., Yang, A., Li, M., & Liu, J.-N. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3262932 · Cited by 65
“Next, due to that the plaintext outputs of PriorNet might be susceptible to model inversion attacks [28] by the malicious server, an off-the-shelf and generic adversarial training strategy [29] is able to protect the PriorNet’s outputs against the attacks.”
BackgroundYao, A., Li, G., Li, X., Jiang, F., Jia, X., & Liu, X. (2023) · Array · doi:10.1016/j.array.2023.100293 · Cited by 58
SoK: Model Inversion Attack Landscape: Taxonomy, Challenges, and Future Roadmap
Dibbo, S. V. (2023) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf57540.2023.00027 · Cited by 58
“While some attacks are customizable to suit other access types, they significantly suffer in performance [20], [23], [87].”
BackgroundInfluentialMIRROR: Model Inversion for Deep Learning Network with High Fidelity
An, S., Tao, G., Xu, Q., Liu, Y., Shen, G., Yao, Y., Xu, J., & Zhang, X. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24335 · Cited by 48
“There are also recent works that studied information leakage problem in collaborative learning [27], [29], [41], [68], where the training or inference tasks are distributed to multiple participants.”
BackgroundPractical Membership Inference Attack Against Collaborative Inference in Industrial IoT
Chen, H., Li, H., Dong, G., Hao, M., Xu, G., Huang, X., & Liu, Z. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.3046648 · Cited by 46
Adaptive Privacy Preserving Deep Learning Algorithms for Medical Data
Zhang, X., Ding, J., Wu, M., Wong, S. T. C., Nguyen, H. V., & Pan, M. (2021) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv48630.2021.00121 · Cited by 43
“Specifically, in this work, we consider the white-box attack [15] where the adversary has the full knowledge of our deep networks, including their architectures and parameters.”
BackgroundNot All Features Are Equal: Discovering Essential Features for Preserving Prediction Privacy
Mireshghallah, F., Taram, M., Jalali, A., Elthakeb, A. T., Tullsen, D. M., & Esmaeilzadeh, H. (2021) · International World Wide Web Conference (WWW) · doi:10.1145/3442381.3449965 · Cited by 55
“However, the impending importance of prediction (inference) privacy has led to the emergence of recent research efforts in this direction [18, 27, 41, 60, 61, 86].”
BackgroundActionBert: Leveraging User Actions for Semantic Understanding of User Interfaces
He, Z., Sunkara, S., Zang, X., Xu, Y., Liu, L., Wichers, N., Schubiner, G., Lee, R., & Chen, J. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i7.16741 · Cited by 54
Self-citationPrivacy-preserving Adversarial Facial Features
Wang, Z., Wang, H., Jin, S., Zhang, W., Hut, J., Wang, Y., Sun, P., Yuan, W., Liu, K., & Rent, K. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00794 · Cited by 40
“Attacker’s Strategy: Following existing reconstruction attacks [4,7,13,23,37], we consider that the attacker tends to reconstruct facial images from facial features by building a reconstruction network, denoted by R(·).”
BackgroundInfluentialPrivacy-preserving Collaborative Learning with Automatic Transformation Search
Gao, W., Guo, S., Zhang, T., Qiu, H., Wen, Y., & Liu, Y. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00018 · Cited by 44
“[12, 13] proposed reconstruction attacks against collaborative inference systems, which are not considered in this paper.”
BackgroundSelf-citationLiu, C., Chen, B., Shao, W., Zhang, W., Wong, K. K. L., & Zhang, Y. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3377730 · Cited by 45
“He et al. [95] employed regularized maximum-likelihood estimation in a white-box setting to achieve image restoration.”
BackgroundTen Challenging Problems in Federated Foundation Models
Fan, T., Gu, H., Cao, X., Chan, C. S., Chen, Q., Chen, Y., Feng, Y., Gu, Y., Geng, J., Luo, B., et al. (2025) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2025.3555328 · Cited by 49
“[61]introducedFedGKT,amethod tailoringtheserver’sFMtoclients’DMsusingknowledge distillation between the FM and DM. Gu et al. [62] presented MINILLM, which distills LLMs in a white-box setting by minimizing reverse Kullback-Leibler divergence.”
Self-citationAsad, M., Moustafa, A., & Aslam, M. (2021) · Applied Soft Computing · doi:10.1016/j.asoc.2021.107235 · Cited by 39
A Bargaining Game for Personalized, Energy Efficient Split Learning over Wireless Networks
Kim, M., DeRieux, A., & Saad, W. (2023) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc55385.2023.10118601 · Cited by 37
“In other words, an honest-but-curious server can do model inversion attack during training to restore private input data [12].”
Machine learning security and privacy: a review of threats and countermeasures
Paracha, A., Arshad, J., Farah, M. A. B., & Ismail, K. N. (2024) · EURASIP Journal on Information Security · doi:10.1186/s13635-024-00158-3 · Cited by 47
“Research study [67] experimentally revealed the privacy attack during inference in collaborative machine learning and argued that a single malicious participant could infer the target system and steal the confidential information of the targeted system.”
BackgroundStealing Deep Reinforcement Learning Models for Fun and Profit
Chen, K., Guo, S., Zhang, T., Xie, X., & Liu, Y. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3453090 · Cited by 44
“A quantity of works have been done to disclose the privacy threats about the training data [16, 20, 21] or models [42, 53, 55, 62] in the deep learning development pipeline.”
BackgroundSelf-citationPrivacy-Preserving Federated Adversarial Domain Adaptation Over Feature Groups for Interpretability
Kang, Y., He, Y., Luo, J., Fan, T. T., Liu, Y., & Yang, Q. (2022) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2022.3188292 · Cited by 37
“To recover data of reasonably high quality, [12] makes strong assumptions that the attacker knows the network structure of the victim and has access to the training data that follows the same distribution as those of the victim, aiming to approximate the victim’s local model.”
BackgroundInfluentialYang, R., Ma, J., Zhang, J., Kumari, S., Kumar, S., & Rodrigues, J. J. P. C. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3275161 · Cited by 37
“There are many different types of inference attacks in FL, such as membership inference attacks (MemInf) [42], PIAs [18], [19], and ModInvs [23], [24].”
BackgroundMethodHandling data heterogeneity with generative replay in collaborative learning for medical imaging
Qu, L., Balachandar, N., Zhang, M., & Rubin, D. L. (2022) · Medical Image Analysis · doi:10.1016/j.media.2022.102424 · Cited by 35
Privacy-Preserving Face Recognition Using Trainable Feature Subtraction
Mi, Y., Zhong, Z., Huang, Y., Ji, J., Xu, J., Wang, J., Wang, S., Ding, S., & Zhou, S. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.00036 · Cited by 34
“A successful recovery attack [9, 15, 30] necessitates training the attack model on consistent representations.”
BackgroundReal world federated learning with a knowledge distilled transformer for cardiac CT imaging
Tölle, M., Garthe, P., Scherer, C., Seliger, J. M., Leha, A., Krüger, N., Simm, S., Martin, S. S., Eble, S., Kelm, H., et al. (2025) · npj Digital Medicine · doi:10.1038/s41746-025-01434-3 · Cited by 36
“One such attack is Model Inversion, in which an attacker might obtain data, which was used for training,bystudyinghowspeci fi cinputsaffectthemodel ’ soutput 60,61 .”
HSFL: Efficient and Privacy-Preserving Offloading for Split and Federated Learning in IoT Services
Deng, R., Du, X., Lu, Z., Duan, Q., Huang, S.-C., & Wu, J. (2023) · IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws60048.2023.00084 · Cited by 32
“Smashed data in SL/SFL may reveal private information of the raw data as demonstrated in [25], [30], [31], where data reconstruction attacks recover the raw training data from the revealed information (e.g., the smashed data, the gradients, model parameters) during training, posing a severe privacy…”
InfluentialKhowaja, S. A., Lee, I. H., Dev, K., Jarwar, M. A., & Qureshi, N. M. F. (2022) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2022.3188575 · Cited by 32
“The reason for choosing 2nd conv layer for the split is driven by the research findings from [5], [20] that the reconstruction of intermediary outputs work better when performed at initial layers as the structural similarity of the feature maps is high with the input data.”
Privacy-preserving explainable AI: a survey
Nguyên, T. T., Huynh, T. T., Ren, Z., Nguyen, T. T., Nguyen, P. L., Yin, H., & Nguyen, Q. V. H. (2024) · Science China Information Sciences · doi:10.1007/s11432-024-4123-4 · Cited by 58
Security of federated learning for cloud‐edge intelligence collaborative computing
Yang, J., Zheng, J., Zhang, Z., Chen, Q., Wong, D. S., & Li, Y. (2022) · International Journal of Intelligent Systems · doi:10.1002/int.22992 · Cited by 32
Issa, W., Moustafa, N., Turnbull, B., & Choo, K. R. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3368879 · Cited by 30
Subbanna, N. K., Wilms, M., Tuladhar, A., & Forkert, N. D. (2021) · Sensors · doi:10.3390/s21113874 · Cited by 31
“The last attack type is the model inversion attack [7,8,20].”
BackgroundPractical Defences Against Model Inversion Attacks for Split Neural NetworksPreprint
Titcombe, T., Hall, A. J., Papadopoulos, P., & Romanini, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.05743 · Cited by 71
“It has been shown that model inversion attacks work better on earlier hidden layers of a neural network due to the increased structural similarity to input data (He et al., 2019).”
BackgroundHashVFL: Defending Against Data Reconstruction Attacks in Vertical Federated Learning
Qiu, P., Zhang, X., Ji, S., Fu, C., Yang, X., & Wang, T. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3356164 · Cited by 34
“In the worst case where the adversary knows the model and the output for a target sample [26], there remains a chance of the reconstruction attack.”
BackgroundMethodInfluentialPreserving data privacy in federated learning through large gradient pruning
Zhang, Z., Zhu, T., Ren, W., Xiong, P., & Choo, K. R. (2022) · Computers & Security · doi:10.1016/j.cose.2022.103039 · Cited by 31
A GAN-Based Defense Framework Against Model Inversion Attacks
Gong, X., Wang, Z., Li, S., Chen, Y., & Wang, Q. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3295944 · Cited by 34
“To recap, in [18], regularized Maximum Likelihood Estimation (rMSE), Inverse-Network , and query-free shadow model reconstruction techniques are used in white-box, black-box, and query-free black-box settings, respectively.”
BackgroundMethodKaleidoscope: Physical Backdoor Attacks Against Deep Neural Networks With RGB Filters
Gong, X., Wang, Z., Chen, Y., Xue, M., Wang, Q., & Shen, C. Q. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3239225 · Cited by 29
“Other inference-time attacks include membership inference attacks [34] and model inversion attacks [35].”
BackgroundA Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack Against Split Learning
Xu, X., Yang, M., Yi, W., Li, Z., Wang, J., Hu, H., Zhuang, Y., & Liu, Y. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.01153 · Cited by 26
“Data Reconstruction Attack (DRA) on SL. DRA [19, 27, 35, 48] is one of the most powerful privacy attacks that aim to steal the input data by the model’s intermediate features.”
BackgroundMethodBeyond Gradients: Exploiting Adversarial Priors in Model Inversion Attacks
Usynin, D., Rueckert, D., & Kaissis, G. A. (2023) · ACM Transactions on Privacy and Security · doi:10.1145/3592800 · Cited by 26
“Additionally, there exist other variations of model inversion attacks which exploit intermediate activations produced by the victim such as He et al. [11] where the central server is used in an inference mode and the adversary inverts the target activations to obtain the original image.”
BackgroundResultInfluentialDu, W., Li, A., Zhou, P., Niu, B., & Wu, D. O. (2021) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2021.3050458 · Cited by 27
Can differential privacy practically protect collaborative deep learning inference for IoT?
Ryu, J., Zheng, Y., Gao, Y., Abuadbba, A., Kim, J., Won, D., Nepal, ., Kim, H., & Wang, C. (2022) · Wireless Networks · doi:10.1007/s11276-022-03113-7 · Cited by 22
“In a recent work [10], He et al. proposed reconstruction attacks that allow the cloud to reconstruct the input image given the intermediate output and the local part model in the collaborative inference framework.”
InfluentialA comprehensive survey and taxonomy on privacy-preserving deep learning
Tran, A.-T., Luong, T.-D., & Huynh, V.-N. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.127345 · Cited by 21
A Hybrid Self-Supervised Learning Framework for Vertical Federated Learning
He, Y., Kang, Y., Zhao, X., Luo, J., Fan, L., Han, Y., & Yang, Q. (2024) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2024.3403386 · Cited by 21
“[20] proposed model inversion attack to infer features of the passive party.”
Privacy and security vulnerabilities in edge intelligence: An analysis and countermeasures
Shafee, A. A., Hasan, S. R., & Awaad, T. A. (2025) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2025.110146 · Cited by 25
Cooperative Inference of DNNs for Delay- and Memory-Constrained Wireless IoT Systems
Yun, S., Choi, W., & Kim, I. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3152359 · Cited by 21
“For preserving the data privacy of the IoT device against the so-called model inversion attack [39], [40], we constrain that at least three blocks of the DNNs must be computed at the IoT device (i.e., (cid:6) ≥ (cid:6) min = 3), which means that the local input data of the IoT device is hardly…”
MethodLDS-FL: Loss Differential Strategy Based Federated Learning for Privacy Preserving
Wang, T., Yang, Q., Zhu, K., Wang, J., Su, C., & Sato, K. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3322328 · Cited by 23
“Compared to IID, this distribution is more prone to privacy attacks due to data imbalance, and related privacy attacks can be roughly divided into two categories, which are Membership Inference Attack [3], [4], [5], [6] and Model Inversion Attack [2], [7], [8], [9], [10], [11].”
BackgroundMethodDing, W., Abdel‐Basset, M., Ali, A. M., & Moustafa, N. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2024.109451 · Cited by 24
A Method to Improve the Privacy and Security for Federated Learning
Bai, Y., & Fan, M. (2021) · International Conference on Computer and Communication Systems (ICCCS) · doi:10.1109/icccs52626.2021.9449214 · Cited by 20
“In paper [16], [19], [20], they proposed an attack against federated learning, wherein the attacker is one of the participants who can observe the global parameters and craft his adversarial parameter updates to gain more information about the information of other participants’ training dataset.”
BackgroundDistPrivacy: Privacy-Aware Distributed Deep Neural Networks in IoT surveillance systems
Baccour, E., Erbad, A., Mohamed, A. M. S., Hamdi, M., & Guizani, M. (2020) · Globecom · doi:10.1109/globecom42002.2020.9322470 · Cited by 20
“We note that, in our work, the fully connected layers will be computed on a single device as the output of such layers cannot be recovered [10].”
BackgroundInfluentialGinver: Generative Model Inversion Attacks Against Collaborative Inference
Yin, Y., Zhang, X., Zhang, H., Li, F., Yu, Y., Cheng, X., & Hu, P. (2023) · International World Wide Web Conference (WWW) · doi:10.1145/3543507.3583306 · Cited by 19
“In the black-box setting, existing work assumes that Mallory holds an auxiliary dataset in the same data distribution as Alice’s [13, 14].”
BackgroundMethodResultInfluentialTopology-Aware Differential Privacy for Decentralized Image Classification
Guo, S., Zhang, T., Xu, G., Yu, H., Xiang, T., & Liu, Y. (2021) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2021.3105723 · Cited by 20
“Past works have demonstrated the feasibility and severity of model inversion attacks [8], [9], [10], [11] and membership inference attacks [12], [13] in distributed learning.”
BackgroundSelf-citationEvaluation of Inference Attack Models for Deep Learning on Medical DataPreprint
Wu, M., Zhang, X., Ding, J., Nguyen, H. V., Rong, Y., Pan, M., & Wong, S. T. C. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.00177 · Cited by 33
“In the collaborative inference mode [7, 43], Hospital A sends the outputs of the cut layer to Hospital B and retrieves the final results.”
BackgroundMethodInfluentialDifferentially private federated deep learning for multi-site medical image segmentationPreprint
Ziller, A., Usynin, D., Remerscheid, N. W., Knolle, M. A., Braren, R., Rueckert, D., & Kaissis, G. A. (2022) · Research Square · doi:10.21203/rs.3.rs-1478332/v1 · Cited by 27
Yang, B., Yeh, H.-W., Harada, T., & Yuen, P. C. (2021) · IEEE Transactions on Image Processing · doi:10.1109/tip.2021.3130530 · Cited by 20
On Feasibility of Server-side Backdoor Attacks on Split Learning
Tajalli, B., Ersoy, O., & Picek, S. (2023) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw59333.2023.00014 · Cited by 17
“Still, existing works have revealed its vulnerabilities to inference attacks [7], [8].”
BackgroundLi, J., Liao, G., Chen, L., & Chen, X. (2023) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2023.3312304 · Cited by 17
“Theedgeserveror anymaliciousattackersafterinterceptingtheintermediaterep-resentation,afterreceivingtheintermediaterepresentation,can launchmodelinversionattacks(i.e.,instancerecoveryattack) toreconstructrawdata[13],[14],[15].”
BackgroundInfluentialRL-DistPrivacy: Privacy-Aware Distributed Deep Inference for Low Latency IoT Systems
Baccour, E., Erbad, A., Mohamed, A. M. S., Hamdi, M., & Guizani, M. (2022) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2022.3165472 · Cited by 17
Frontier AI regulation: what form should it take?
Radanliev, P. (2025) · Frontiers in Political Science · doi:10.3389/fpos.2025.1561776 · Cited by 16
“Moreover, model inversion attacks threaten privacy by reconstructing sensitive training data (12), exposing personal information embedded within AI models (13).”
Roth, H. R., Hatamizadeh, A., Xu, Z., Zhao, C., Li, W., Myronenko, A., & Xu, D. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-18523-6_5 · Cited by 16
Practical and General Backdoor Attacks Against Vertical Federated Learning
Xuan, Y., Chen, X., Zhao, Z., Tang, B., & Dong, Y. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-43415-0_24 · Cited by 17
PATROL: Privacy-Oriented Pruning for Collaborative Inference Against Model Inversion Attacks
Ding, S., Zhang, L., Pan, M., & Yuan, X. (2024) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv57701.2024.00465 · Cited by 17
“[1], [2], [3].”
GANMIA: GAN-based Black-box Membership Inference Attack
Bai, Y., Chen, D., Chen, T., & Fan, M. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500657 · Cited by 17
“He et al. [10] propose a white-box attack on ML model.”
BackgroundErdoğan, E., Küpçü, A., & Çiçek, A. E. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2108.09033 · Cited by 22
“Table 5 displays the average number of black-box queries made by the server in [7]’s black-box attack to reach the same PSNR values UnSplit obtains.”
BackgroundMethodInfluentialFedPass: Privacy-Preserving Vertical Federated Deep Learning with Adaptive Obfuscation
Gu, H., Luo, J., Kang, Y., Fan, L., & Yang, Q. (2023) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2023/418 · Cited by 22
A Game-theoretic Framework for Privacy-preserving Federated Learning
Zhang, X., Fan, L., Wang, S., Li, W., Chen, K., & Yang, Q. (2024) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3656049 · Cited by 21
“For attacking mechanisms, semi-honest attacking is one of the most common approaches, including gradient inversion attack [ 10 , 48 , 50 , 51 ], model inversion attack [ 9 , 13 , 14 , 16 , 33 ], and GAN-based attack [ 17 , 36 ].”
Split Without a Leak: Reducing Privacy Leakage in Split Learning
Nguyen, K., Khan, T., & Michalas, A. (2024) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-64954-7_17 · Cited by 15
Enhancing Accuracy-Privacy Trade-Off in Differentially Private Split Learning
Pham, N. D., Phan, K. T., & Chilamkurti, N. (2024) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2024.3485723 · Cited by 24
“In a black-box setting, the authors of [9] introduce an inverse network as an effective means of accurately recovering raw data.”
InfluentialZhang, M., Abdi, M., Dasari, V. R., & Restuccia, F. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111531 · Cited by 26
FLSys: Toward an Open Ecosystem for Federated Learning Mobile Apps
Jiang, X., Hu, H., On, T., Lai, P., Mayyuri, V. D., Chen, A., Shila, D. M., Larmuseau, A., Jin, R., Borcea, C., et al. (2022) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2022.3223578 · Cited by 15
“In this paper, we focus on defending against privacy inference attacks from an honest-but-curious server, which can attempt to infer clients’ local training data.”
BackgroundATPL: Mutually enhanced adversarial training and pseudo labeling for unsupervised domain adaptation
Yi, C., Chen, H., Xu, Y., Liu, Y., Jiang, L., & Tan, H. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.108831 · Cited by 14
Metadata
- Authors
- He, Z., Zhang, T., & Lee, R. B.
- Affiliations
- Princeton University (US)
- Nanyang Technological University (SG)
- Venue
- Proceedings of the 35th Annual Computer Security Applications Conference
- Publisher
- ACM
- Published
- 2019-12-09
- Pages
- 148-162
- ISSN
- 1063-9527 (ISSN-L)
- OpenAlex
- W2989885118
- Cited by
- 313
- References
- 48
- Citations by year
- 2026: 30 · 2025: 81 · 2024: 62 · 2023: 49 · 2022: 36 · 2021: 39 · 2020: 16
- FWCI
- 8.70
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Annual Computer Security Applications Conference (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- model inversion attacks, collaborative inference, inference privacy, privacy-preserving deep learning, data privacy, adversarial attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
