The DOI matches its Crossref record; 47 of the 48 references it cites were found in a registry or an index.
Model inversion attacks against collaborative inference
Abstract
The prevalence of deep learning has drawn attention to the privacy protection of sensitive data. Various privacy threats have been presented, where an adversary can steal model owners' private data. Meanwhile, countermeasures have also been introduced to achieve privacy-preserving deep learning. However, most studies only focused on data privacy during training, and ignored privacy during inference.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“a number of works suggest5–7 that on its own, federated learning is an insufficient measure of privacy preservation.”
From Medical imaging deep learning with differential privacy (2021) · cites this paper as [7]
Citations
Cites
Image quality assessment: from error visibility to structural similarity
Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004) · IEEE Transactions on Image Processing · doi:10.1109/tip.2003.819861 · Cited by 57,892
Learning representations by back-propagating errors
Rumelhart, D. E., Hinton, G. E., & Williams, R. J. (1986) · Nature · doi:10.1038/323533a0 · Cited by 31,892
Nonlinear total variation based noise removal algorithms
Rudin, L., Osher, S., & Fatemi, E. (1992) · Physica D Nonlinear Phenomena · doi:10.1016/0167-2789(92)90242-f · Cited by 17,214
(2010) · Cited by 14,134
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280
(2016) · Cited by 11,679
A Stochastic Approximation Method
Robbins, H., & Monro, S. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729586 · Cited by 9,643
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2015) · arXiv · doi:10.48550/arxiv.1512.03385 · Cited by 4,196
Research works printed but not linked: 14
- Ateniese Giuseppe, 2015, International Journal of Security and Networks
- Chilimbi Trishul, 2014, USENIX Symposium on Operating Systems Design and Implementation.
- Ganju Karan, 2018, ACM Conference on Computer and Communications Security.
- Glorot Xavier, 2010, Proceedings of the thirteenth international conference on artificial intelligence and statistics. 249--256
- Jamie Hayes Luca Melis George Danezis and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). Jamie Hayes Luca Melis George Danezis and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). · arXiv
- Hua Weizhe, 2018, ACM/ESDA/IEEE Design Automation Conference.
- Kingma Diederik P, 2014, Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 · arXiv
- Liu Kin Sum, 2018, Generative Model: Membership Attack, Generalization and Diversity. arXiv preprint arXiv:1805.09898 · arXiv
- Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl A Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv preprint arXiv:1802.04889 (2018). Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl A Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv preprint arXiv:1802.04889 (2018). · arXiv
- Oh Seong Joon, 2018, INternational Conference on Learning Representations.
- Ohrimenko Olga, 2016, USENIX Security Symposium.
- Shokri Reza, 2015, ACM conference on computer and communications security.
- Tramèr Florian, 2016, USENIX Security Symposium.
- Wang Binghui, 2018, Stealing Hyperparameters in Machine Learning. In IEEE Symposium on Security and Privacy.
Cited by
Sorted by citations
Items 101–200 of 315
Service Provisioning in Edge-Cloud Continuum: Emerging Applications for Mobile Devices
Rodrigues, D. O., Souza, A. M. D., Braun, T. I., Maia, G., Loureiro, A. A. F., & Villas, L. A. (2023) · Journal of Internet Services and Applications · doi:10.5753/jisa.2023.2913 · Cited by 13
“However, personal data sometimes may still be extracted from the trainedmodel with model-inversion attacks (He et al., 2019).”
BackgroundPrivacy-Preserving Neural Networks for Smart Manufacturing
Lee, H., Finke, D. A., & Yang, H. Y. (2023) · Journal of Computing and Information Science in Engineering · doi:10.1115/1.4063728 · Cited by 13
PrivatEyes: Appearance-based Gaze Estimation Using Federated Secure Multi-Party Computation
Elfares, M., Reisert, P., Hu, Z., Tang, W., Küsters, R., & Bulling, A. (2024) · Proceedings of the ACM on Human-Computer Interaction · doi:10.1145/3655606 · Cited by 16
“Prior works in ML investigated different attacks in isolation, e.g. model-inversion attacks [26, 31, 83] (i.e. reconstructing the training data) or inference attacks [3, 51, 71] (i.e. inferring private information).”
BackgroundPrivacy-Preserving Visual Localization With Event Cameras
Kim, J., Kim, Y. M., Zahreddine, R. N., Welge, W. A., Krishnan, G., Ma, S., & Wang, J. (2025) · IEEE Transactions on Image Processing · doi:10.1109/tip.2025.3607640 · Cited by 16
“Recent works target privacy protection in split inference scenarios where the costly neural network computation is shared between the client and server [53], [54], [55], [56], [57], [58], [59], [60], [61], [62].”
Security-Communication-Computation Tradeoff of Split Decisions for Edge Intelligence
Lyu, X., Liu, J., Ren, C., & Nan, G. (2023) · IEEE Wireless Communications · doi:10.1109/mwc.014.2200438 · Cited by 13
Survey on AI Ethics: A Socio‐Technical Perspective
Mbiazi, D., Bhange, M., Babaei, M., Sheth, I., Kenfack, P. J., & Kahou, S. E. (2025) · Computational Intelligence · doi:10.1111/coin.70149 · Cited by 39
“Generally, this may occur when data generation is outsourced to third parties, or pre‐trained models are fine‐tuned for a specific task.”
Chen, G., Qin, Z., Yang, M., Zhou, Y., Fan, T., Du, T., & Xu, Z. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690295 · Cited by 18
Zhang, X., Razavi‐Far, R., Isah, H., David, A., Higgins, G., & Zhang, M. Q. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.112965 · Cited by 15
Privacy preservation techniques through data lifecycle: A comprehensive literature survey
Madhusudhanan, S., & Jose, A. C. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104473 · Cited by 14
Accuracy-Privacy Trade-off in Deep Ensemble: A Membership Inference Perspective
Rezaei, S., Shafiq, Z., & Liu, X. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179463 · Cited by 15
Jiang, L., Song, Q., Tan, R., & Li, M. (2022) · ACM Conference on Embedded Networked Sensor Systems (SenSys) · doi:10.1145/3560905.3568531 · Cited by 11
“■ Inversion attack: The study [26] presented an inversion attack approach using maximum likelihood estimation.”
BackgroundMethodInfluentialHan, P., Huang, X., Fang, Y., & Han, G. (2025) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2025.3572362 · Cited by 11
“However, the model architecture and parameters are also sensitive information, as they can reveal private data through techniques like model inversion attacks [209], [210], [211].”
Split Learning Without Local Weight Sharing to Enhance Client-Side Data Privacy
Pham, N. D., Phan, K. T., Abuadbba, A., Gao, Y., Nguyen, V.-D., & Chilamkurti, N. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3565229 · Cited by 11
“This leakage can be attributed to the query-free attack described in [13], where the attacker does not require knowledge of the target model or the ability to query it.”
InfluentialRL-PDNN: Reinforcement Learning for Privacy-Aware Distributed Neural Networks in IoT Systems
Baccour, E., Erbad, A., Mohamed, A. M. S., Hamdi, M., & Guizani, M. (2021) · IEEE Access · doi:10.1109/access.2021.3070627 · Cited by 10
“However, the main drawbacks of such approach are the computation overhead to perform the encryption, the potential accuracy loss, and incompatibility with some DNN operations [26].”
BackgroundInfluentialPervasive AI for IoT Applications: Resource-efficient Distributed Artificial Intelligence.Preprint
Baccour, E., Mhaisen, N., Abdellatif, A. A., Erbad, A., Mohamed, A. M. S., Hamdi, M., & Guizani, M. (2021) · arXiv (Cornell University) · Cited by 11
Provable Privacy Advantages of Decentralized Federated Learning via Distributed Optimization
Yu, W., Li, Q., Lopuhaä-Zwakenberg, M., Christensen, M. G., & Heusdens, R. R. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3516564 · Cited by 12
“…typically fall into three types: membership inference [47], [48], [49], the property inference [48], [50] and the input reconstruction attack [51], [52], [53], [54], where the revealed information is membership (whether a particular data sample belongs to the training dataset or not),…”
GAN-based data reconstruction attacks in split learning
Zeng, B., Luo, S., Yu, F., Yang, G., Zhao, K., & Wang, L. (2025) · Neural Networks · doi:10.1016/j.neunet.2025.107150 · Cited by 13
Alhindi, A., Al-Ahmadi, S. A., & Ismail, M. M. B. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01045-9 · Cited by 12
“As indicated by prior literature [12, 39, 40, 43, 44], it is clear that SL is vulnerable to various attack types, which highlights the urgent need to adopt privacy-preserving meth-ods when using the SL framework.”
Prompt Inversion Attack Against Collaborative Inference of Large Language Models
Qu, W., Zhou, Y., Wu, Y., Xiao, T., Yuan, B., Li, Y., & Zhang, J. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00160 · Cited by 19
“In this section, we revisit two representative optimization-based attacks: He et al. [47] in the image domain and Song et al. [29] in the language domain.”
InfluentialCloudShield: Real-time Anomaly Detection in the Cloud
He, Z., Hu, G., & Lee, R. B.-L. (2023) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3577923.3583639 · Cited by 17
“There have been many attacks against deep learning systems [31], [33], [32], [62].”
BackgroundSelf-citationThe Role of Class Information in Model Inversion Attacks Against Image Deep Learning Classifiers
Tian, Z., Cui, L., Zhang, C., Tan, S., Yu, S., & Tian, Y. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3306748 · Cited by 9
“With the development of generative model, more researchers utilize the generative model in model inversion [5], [6], [15].”
BackgroundMethodYang, Y.-T. C., & Wei, H. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3220521 · Cited by 9
Is Homomorphic Encryption-Based Deep Learning Secure Enough?
Shin, J., Choi, S.-H., & Choi, Y.-H. (2021) · Sensors · doi:10.3390/s21237806 · Cited by 9
“However, black-box reconstruction attacks [19,20] can be a threat without any modification in HE-based deep learning model environment.”
BackgroundMethodInfluentialMind Your Heart: Stealthy Backdoor Attack on Dynamic Deep Neural Network in Edge Computing
Dong, T., Zhang, Z., Qiu, H., Zhang, T., Li, H., & Wang, T. (2023) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom53939.2023.10229092 · Cited by 11
“Many dynamic multi-exit architectures have been proposed to address the above challenge [27], [29], [30].”
Self-citationFuzzy Prediction Model in Privacy Protection: Takagi–Sugeno Rules Model via Differential Privacy
Zhang, G., Zhu, X., Yin, L., Pedrycz, W., & Li, Z. (2024) · IEEE Transactions on Fuzzy Systems · doi:10.1109/tfuzz.2024.3380596 · Cited by 8
Privacy-Preserving Autoencoder for Collaborative Object Detection
Azizian, B., & Bajić, I. V. (2024) · IEEE Transactions on Image Processing · doi:10.1109/tip.2024.3451938 · Cited by 9
“MIAs can be categorized into three classes based on the adversary’s level of access to the front-end model f 1 ( · ; θ 1 ) and its parameters [15]: 1) White-box attack: The entire front-end model f 1 ( · ; θ 1 ) and its parameters θ 1 are known to the adversary.”
BackgroundMethodInfluentialHiggins, G., Razavi‐Far, R., Zhang, X., David, A., Ghorbani, A. A., & Ge, T. (2025) · Internet of Things · doi:10.1016/j.iot.2025.101558 · Cited by 8
“Our initial investigation indicated that our best effective attack was only successful against the VGG16 architecture, not the ResNet50 architecture, using the white-box attack described in He et al. (2019).”
Ahmad, I., Kim, J., & Shin, S. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3558289 · Cited by 8
“However, input data reconstruction from these intermediate feature maps is still possible [47].”
Curriculum Dataset Distillation
Ma, Z., Cao, A., Yang, F., Gong, Y., & Wei, X. (2025) · IEEE Transactions on Image Processing · doi:10.1109/tip.2025.3579228 · Cited by 15
“Initially developed for transparent inverse attacks on neural networks [24], [25], the model inversion technique has since found widespread application in various fields, such as knowledge distillation [16], [26], [27], network compression [28], [29], [30], and continual learning [31], [32], noted…”
Usynin, D., Rueckert, D., Passerat‐Palmbach, J., & Kaissis, G. A. (2021) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2022-0014 · Cited by 10
“In accordance with these categories, we selected three attack scenarios: the Generative Decoder [6], Deep Leakage from Gradients [23] and Membership Inference Attack [5] in order to cover most realistic threat models.”
BackgroundMethodInfluentialFed-Fi: Federated Learning Malicious Model Detection Method Based on Feature Importance
Chuan-xin, Z., Sun, Y., Wang, D., & Gao, Q. (2022) · Security and Communication Networks · doi:10.1155/2022/7268347 · Cited by 8
“+is special distributed structure makes the central server vulnerable to sybil attacks [15].”
BackgroundCellular-Assisted, Deep Learning Based COVID-19 Contact Tracing
Yi, F., Xie, Y., & Jamieson, K. (2022) · Proceedings of the ACM on Interactive Mobile Wearable and Ubiquitous Technologies · doi:10.1145/3550332 · Cited by 8
“There are basically two types of model inversion attack, white-box model inversion [17, 25, 33] and black-box model inversion [16, 25].”
BackgroundExploring Model Inversion Attacks in the Black-box Setting
Dionysiou, A., Vassiliades, V., & Athanasopoulos, E. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2023-0012 · Cited by 8
“M id [19], [26], [29], [60], [62] [26], [48] Deep-BMI, [4], [19], [60]”
BackgroundMethodInfluentialDual-Masking Framework against Two-Sided Model Attacks in Federated Learning
Chiu, T.-C., Lin, W.-C., Pang, A., & Cheng, L.-C. (2021) · Globecom · doi:10.1109/globecom46510.2021.9685701 · Cited by 8
“…(compromised by other malicious nodes) or just curious about users’ raw data, another well-known model attacks, called model inversion attacks , would be launched, which reverses the model weights to some synthetic data and extracts users’ sensitive information from the synthetic data [6] [7].”
BackgroundDomain Specified Optimization for Deployment Authorization
Wang, H., Chi, H., Yang, W., Lin, Z., Geng, M., Lan, L., Zhang, J., & Tao, D. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00470 · Cited by 7
“Due to the huge business value, deep models are prone to be attacked by a variety of techniques including stealing private training data and deploying the model for private usage without verification [17, 5, 1, 34, 49].”
BackgroundData Leakage Threats and Protection in Split Learning: A Survey
Pham, N. D., & Chilamkurti, N. (2023) · International Conference on Intelligent Computing and Its Emerging Applications (ICEA) · doi:10.1145/3659154.3659189 · Cited by 11
“In the common semi-trusted server model, certain assumptions increase the server’s ability, such as the server having information about the local model or the client being queryable [14].”
Cheng, Z., Xia, X., Wang, H., Liwang, M., Chen, N., Fan, X., & Wang, X. M. (2025) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2025.3607117 · Cited by 7
“These feature maps are susceptible to model inversion attacks, which may lead to privacy breaches and the compromise of sensitive data [16], [17].”
Privacy-Preserving Feature Coding for Machines
Azizian, B., & Bajić, I. V. (2022) · Picture Coding Symposium · doi:10.1109/pcs56426.2022.10018066 · Cited by 7
“Our particular focus in this paper is on the model inversion attack [6], where the attacker attempts to recover the original image from the intercepted features.”
BackgroundAn Experimental Survey of Incremental Transfer Learning for Multicenter Collaboration
Huang, Y., Bert, C., Gomaa, A., Fietkau, R., Maier, A., & Putz, F. (2024) · IEEE Access · doi:10.1109/access.2024.3431885 · Cited by 10
“Recent attack techniques, e.g. model inversion attacks, have the capability of reverse engineering private data at federated training phases [66] and federated inference phases [67], [68].”
BackgroundZhong, D., Wang, X., Xu, Z., Xu, J. L., & Wang, H. (2024) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3627673.3679804 · Cited by 8
Large Language Models for Electronic Health Record De-Identification in English and German
Sousa, S., Jantscher, M., Kröll, M., & Kern, R. (2025) · Information · doi:10.3390/info16020112 · Cited by 9
Stand-in Model Protection: Synthetic defense for membership inference and model inversion attacks
Chen, H., Zhu, T., Ji, S., & Zhou, W. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.113339 · Cited by 8
A Systematic Review of Challenges and Techniques of Privacy-Preserving Machine Learning
Tiwari, K., Shukla, S., & George, J. P. (2021) · Lecture notes in networks and systems · doi:10.1007/978-981-16-4486-3_3 · Cited by 6
Revealing Task-Relevant Model Memorization for Source-Protected Unsupervised Domain Adaptation
Yang, B., Ma, A. J., & Yuen, P. C. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3149397 · Cited by 7
An empirical analysis of image augmentation against model inversion attack in federated learning
Shin, S., Boyapati, M., Suo, K., Kang, K., & Son, J. (2022) · Cluster Computing · doi:10.1007/s10586-022-03596-1 · Cited by 7
“In previous model inversion research, many authors mentioned that differential privacy could be a solution for diverse attacks against privacy including model inversion attack [3, 9, 10].”
BackgroundC2PI: An Efficient Crypto-Clear Two-Party Neural Network Private Inference
Zhang, Y., Chen, D., Kundu, S., Liu, H., Peng, R., & Beerel, P. A. (2023) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1109/dac56929.2023.10247682 · Cited by 7
“When targeting layer l, MLA solves x̂ = argminx̂∥Ml(x̂) − Ml(x)∥22 through gradient descent with 10000 iterations and randomly initialized x̂.”
BackgroundMethodResultInfluentialActive Data Reconstruction Attacks in Vertical Federated Learning
Vu, M. N., Jeter, T. R., Alharbi, R., & Thai, M. T. (2023) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata59044.2023.10386594 · Cited by 7
“Consequently, we benchmark our method against the black-box MI method [7], referred by benchmark in our reports.”
BackgroundMethodInfluentialPrivate Federated Learning Without a Trusted Server: Optimal Algorithms for Convex LossesPreprint
Lowy, A. M., & Razaviyayn, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.09779 · Cited by 7
“Unfortunately, merely storing data locally is not sufficient to prevent data leakage, as model parameters or updates can still reveal sensitive information [FJR15, HZL19, SWZ ` 20, ZH20].”
BackgroundReinforcement Learning based collaborative DNN inference for edge intelligence
Ghamri, M. A., Djamaa, B., Benatia, M. A., & Hosni, A. I. E. (2025) · Future Generation Computer Systems · doi:10.1016/j.future.2025.107942 · Cited by 6
Benchmarking Relaxed Differential Privacy in Private Learning: A Comparative Survey
Zheng, Z., Yao, L., Hu, H., & Wu, G. (2025) · ACM Computing Surveys · doi:10.1145/3729216 · Cited by 6
“A model inversion attack is a privacy-related attack that targets ML models to reveal sensitive information about the training data used to build those models [46].”
Privacy-Preserving Learning Models for Communication: A tutorial on Advanced Split Learning
Tran, N., Dao, N., Nguyen, T. V., & Cho, S. (2022) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc55196.2022.9952628 · Cited by 6
Differentially Private Decentralized LearningPreprint
Guo, S., Zhang, T., Xiang, T., & Liu, Y. (2020) · arXiv (Cornell University) · Cited by 6
Self-citationBlack-box Model Inversion Attribute Inference Attacks on Classification ModelsPreprint
Mehnaz, S., Li, N., & Bertino, E. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.03404 · Cited by 6
“He et al. [35] devise a new set of model inversion attacks against collaborative inference where a deep neural network and the corresponding inference task are distributed among different participants.”
A Survey of Image Gradient Inversion Against Federated LearningPreprint
Li, Z., Wang, L., Chen, G., Shafq, M., & Gu, Z. (2022) · doi:10.36227/techrxiv.18254723 · Cited by 6
“Finally, you can specify the label and the participant party ID to get the data of the target client generated by the generator; He et al. [45] proposed a data leakage method for collaborative inference.”
Robust and privacy-preserving collaborative training: a comprehensive survey
Yang, F., Zhang, X., Guo, S., Chen, D., Gan, Y., Xiang, T., & Liu, Y. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10797-0 · Cited by 17
Deepfake Detection in CCTV Videos Using Deep Learning
Imran, J., Bawany, N. Z., & Tahzeeb, S. (2025) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-025-10526-x · Cited by 5
“The attacker reconstructs the original input data using the model’s predictions together with some additional data [34].”
Private and Secure Distributed Deep Learning: A Survey
Allaart, C. G., Amiri, S., Bal, H. E., Belloum, A. S. Z., Gommans, L., van Halteren, A., & Klous, S. (2024) · ACM Computing Surveys · doi:10.1145/3703452 · Cited by 9
“Inversion attacks [60] are a nuanced subset of reconstruction attacks where the objective is to invert the model’s predictive function to reveal details about the training data or reconstruct the input leading to specific outputs.”
SensFL: Privacy-Preserving Vertical Federated Learning with Sensitive Regularization
Cai, B., Zhang, C., Liu, Z., Xu, X., Hu, F., Dai, J., & Wang, W. (2024) · Computer Modeling in Engineering & Sciences · doi:10.32604/cmes.2024.055596 · Cited by 5
“He et al. [34] proposed a black-box model inversion attack, it can learn the passive party’s features by training a shadow model to mimic the local model using auxiliary data in SplintNN.”
Privacy for Free: Spy Attack in Vertical Federated Learning by Both Active and Passive Parties
Fu, C., Chen, H., & Ruan, N. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3534469 · Cited by 8
“Besides, di ff er from traditional attacks targeting VFL framework [14], [15], [17], [18], the spy attack needs to balance the trade-o ff between two objectives: pursuing the accuracy of privacy information inference while maintaining the stealthiness of hitchhiking behavior to avoid detection.”
Efficient and privacy-preserving deep inference towards cloud–edge collaborative
Wang, Y., Zhong, G., Duan, Y., Cheng, Y., Yin, M., & Yang, R. (2025) · Applied Soft Computing · doi:10.1016/j.asoc.2025.113381 · Cited by 5
Secure vertical federated learning based on feature disentanglement
Zhang, F., Li, G., Suo, Z., Wang, L., Cui, C., & Meng Qingshu, B. (2023) · Signal Processing · doi:10.1016/j.sigpro.2023.109077 · Cited by 5
Systematic Evaluation of Robustness Against Model Inversion Attacks on Split Learning
Na, H., Oh, Y., Lee, W., & Choi, D. (2024) · Lecture notes in computer science · doi:10.1007/978-981-99-8024-6_9 · Cited by 5
InvMetrics: Measuring Privacy Risks for Split Model–Based Customer Behavior Analysis
Deng, R., Hu, S., Lin, J., Yang, J., Lu, Z., Wu, J., Huang, S.-C., & Duan, Q. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3370764 · Cited by 5
“Specifically, our threat model meets with most of previous DRA works [11], [12], [20].”
BackgroundMethodResultInfluentialDIA: Diffusion based Inverse Network Attack on Collaborative Inference
Chen, D., Li, S., Zhang, Y., Li, C., Kundu, S., & Beerel, P. A. (2024) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw63382.2024.00017 · Cited by 6
“Several studies [6, 25, 27] have shown that the presence of non-linear layers not only enhances model generalization but also obfuscates some model details, possibly increasing the model’s resilience against inverse network attacks.”
BackgroundMethodResultInfluentialImproving Robustness to Model Inversion Attacks via Sparse Coding Architectures
Dibbo, S. V., Breuer, A., Moore, J. E., & Teti, M. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-72989-8_7 · Cited by 8
Efficient Secure Neural Network Prediction Protocol Reducing Accuracy Degradation
Nishida, N., Oba, T., Unagami, Y., CRUZ, J. P., Yanai, N., Teruya, T., Attrapadung, N., Matsuda, T., & Hanaoka, G. (2020) · IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences · doi:10.1587/transfun.2020tap0011 · Cited by 5
Fingerprinting Multi-exit Deep Neural Network Models via Inference TimePreprint
Dong, T., Qiu, H., Zhang, T., Li, J., Li, H., & Lu, J. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.03175 · Cited by 5
“…DNN model, such multi-exit structures are found much more efficient compared with previous works like DNN split learning task (Hauswald et al., 2014; Kang et al., 2017; Eshratifar et al., 2019; He et al., 2019; 2020) which every sample has to go through all the distributed layers for prediction.”
MethodSelf-citationProVFL: Property Inference Attacks Against Vertical Federated Learning
Bai, L., Zhang, X., Zhang, S., Ye, Q., & Hu, H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3581743 · Cited by 4
Facial Data Minimization: Shallow Model as Your Privacy Filter
Pu, Y., Chen, J., Pan, J., Yan, D., Zhang, X., & Ji, S. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3563477 · Cited by 4
“Therefore, a model-based method was proposed to reconstruct the facial images given the facial features [18], [20], [23], [40], [41].”
InfluentialDefQ: Defensive Quantization Against Inference Slow-Down Attack for Edge Computing
Qiu, H., Zhang, T., Zhang, T., Li, H., & Meikang Qiu, A. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3138935 · Cited by 4
“Third, split learning was proposed for distributed inference [15], [16], [17], [18], [19].”
BackgroundMethodSelf-citationPranjal, R., Seshadri, R., Kadaba, R. K. S. K., Feng, T., Narayanan, S. S., & Chaspari, T. (2023) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp49357.2023.10096235 · Cited by 4
“Inference attacks are such an example, including model inversion attacks [8, 9, 10] and membership inference attacks [11, 12, 13, 14], in which PII might not be explicitly encoded in the data, but can inferred by the models that represent this data.”
Feature Sniffer: A Stealthy Inference Attacks Framework on Split Learning
Luo, S., Yu, F., Wang, L., Zeng, B., Pang, Z., & Zhao, K. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-44195-0_6 · Cited by 4
Baccour, E., Erbad, A., Mohamed, A. M. S., Hamdi, M., & Guizani, M. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.103933 · Cited by 4
Ahmadzai, M., & Nguyen, G. (2024) · Future Internet · doi:10.3390/fi16070220 · Cited by 4
“[24] Evaluating model inversion attacks while protecting privacy [25] Updates Leak [26] Collaborative Inference MIA 3 [27] The Secret Sharer Property Inference Attacks: These attacks uncover sensitive properties of a model.”
BackgroundSecoInfer: Secure DNN End-Edge Collaborative Inference Framework Optimizing Privacy and Latency
Yao, Y., Hou, J., Wu, G., Cheng, Y., Yuan, M., Luo, P., Wang, Z., & Li, X. (2024) · ACM Transactions on Sensor Networks · doi:10.1145/3694972 · Cited by 4
“Adversaries like malicious edge nodes can reconstruct the original input from the intermediate data transmitted from end devices to edge nodes, known as a model inversion attack [10, 13, 54].”
PixelFade: Privacy-preserving Person Re-identification with Noise-guided Progressive Replacement
Zhang, D., Peng, Y.-X., Wu, X.-M., Wu, A., & Zheng, W. (2024) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3664647.3681262 · Cited by 4
Towards a Secure Peer-to-Peer Federated Learning Framework
Piotrowski, T., & Nochta, Z. (2022) · Communications in computer and information science · doi:10.1007/978-3-031-23298-5_2 · Cited by 4
Exploring Machine Learning Privacy/Utility Trade-Off from a Hyperparameters Lens
Arous, A., Guesmi, A., Hanif, M. A., Alouani, I., & Shafique, M. (2023) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn54540.2023.10191743 · Cited by 4
“Researchers have proposed several attacks on deep learning models such as membership inference attacks [5], model stealing attacks [6] and inversion attacks [7].”
BackgroundMistNet: A superior edge-cloud privacy-preserving training framework with one-shot communication
Guo, W., Cui, J., Li, X., Qu, L., Li, H., Hu, A., & Cai, T. (2023) · Internet of Things · doi:10.1016/j.iot.2023.100975 · Cited by 4
Ensuring Bidirectional Privacy on Wireless Split Inference Systems
Sa, C.-C., Cheng, L.-C., Chung, H.-H., Chiu, T.-C., Wang, C.-Y., Pang, A., & Chen, S.-T. (2024) · IEEE Wireless Communications · doi:10.1109/mwc.014.2300400 · Cited by 3
“Recently, the output privacy of the server inference paradigm has received further attention users have started relying on those large-scale models to create meaningful and valuable output data.”
BackgroundInfluentialJiang, G., Han, S., Xu, X., Zhang, W., & Zhang, P. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3622076 · Cited by 3
“On the other hand, the semantic extraction process inherently raises severe privacy concerns, as sensitive user information can be exposed to attacks [2], [3], [4].”
InfluentialCapRecover : A Cross-Modality Feature Inversion Attack Framework on Vision Language Models
Xiu, K., & Zhang, S. Q. (2025) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3746027.3755203 · Cited by 5
Vulnerabilities in Machine Learning for cybersecurity: Current trends and future research directions
Pal, S., Yadav, G., Jadidi, Z., Habib, A., Uddin, M. P., Karmakar, C. K., & Shukla, S. K. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104269 · Cited by 5
Steal from Collaboration: Spy Attack by a Dishonest Party in Vertical Federated Learning
Chen, H., Fu, C., & Ruan, N. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-33488-7_22 · Cited by 3
Resource-Aware DNN Partitioning for Privacy-Sensitive Edge-Cloud Systems
Ding, A., Hass, A., Chan, M., Sehatbakhsh, N., & Zonouz, S. (2023) · Lecture notes in computer science · doi:10.1007/978-981-99-8073-4_15 · Cited by 3
SIMBA: Split Inference—Mechanisms, Benchmarks and Attacks
Singh, A., Sharma, V., Sukumaran, R., Mose, J., Chiu, J., Yu, J., & Raskar, R. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73116-7_13 · Cited by 4
Mind your indices! Index hijacking attacks on collaborative unpooling autoencoder systems
Lee, K., Yun, J., Jin, J., Han, J. Y., & Ko, J. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101462 · Cited by 3
Investigation of Feature Distribution and Network Weight Updates in the Machine Unlearning Process
Liao, W., & Lin, Y.-J. (2024) · International Symposium on Multimedia · doi:10.1109/ism63611.2024.00022 · Cited by 3
“Furthermore, it should ensure that this data cannot be exploited by attackers through methods such as member inference attack [2], model inversion attack [3], etc., to illegally obtain privacy data.”
Privacy and Security in Distributed Data Markets
Alabi, D., Galhotra, S., Mehnaz, S., Song, Z., & Wu, E. (2025) · ACM SIGMOD International Conference on Management of Data (SIGMOD) · doi:10.1145/3722212.3726008 · Cited by 3
AdVAR-DNN: Adversarial Misclassification Attack on Collaborative DNN Inference
Yousefi, S., Mounesan, M., & Debroy, S. (2025) · Conference on Local Computer Networks · doi:10.1109/lcn65610.2025.11146344 · Cited by 3
Zheng, T., & Li, B. (2022) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3488932.3517402 · Cited by 3
“Reconstruction attacks, which might also be referred to as model inversion attacks, aim to reconstruct the training data or representative data based on different levels of information from the models, including model parameters, model predictions, and model gradients [12, 39].”
BackgroundInteger Is Enough: When Vertical Federated Learning Meets Rounding
Qiu, P., Pu, Y., Liu, Y., Liu, W., Yue, Y., Zhu, X., Li, L., Li, J., & Ji, S. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i13.29388 · Cited by 3
“Empirical evidence has shown that the reconstructed intermediate results are close to the original ones and can be used to infer samples’ raw features and relations (He, Zhang, and Lee 2019).”
ResultRuan, N., Chen, J., Huang, T., Sun, Z., & Li, J. (2024) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2024.3405548 · Cited by 3
“Model Inversion Attack: As described in [16], the attacker can reconstruct the private data by building a substitute decoder SDec : Z −→ X .”
BackgroundInfluentialA Study of Differentially Private Machine Learning in Healthcare
Shahid, A. R., & Talukder, S. (2021) · Innovations in Intelligent Systems and Applications Conference (ASYU) · doi:10.1109/asyu52992.2021.9598991 · Cited by 3
“This shows that ML models can capture information on their training data, and exploitation of the models could lead to membership inference attack[20], model inversion attack[15] and training data leakage using the model’s prediction[10].”
MethodA Survey of Image Gradient Inversion Against Federated LearningPreprint
Li, Z., Wang, L., Chen, G., Shafq, M., & Gu, Z. (2022) · doi:10.36227/techrxiv.18254723.v1 · Cited by 3
FedCrypt: A Dynamic White-Box Watermarking Scheme for Homomorphic Federated LearningPreprint
Lansari, M., Bellafqira, R., Kapusta, K., Kallas, K., Thouvenot, V., Bettan, O., & Coatrieux, G. (2024) · doi:10.36227/techrxiv.172114666.63343276/v1 · Cited by 3
Functionality and Data Stealing by Pseudo-Client Attack and Target Defenses in Split Learning
Zhang, L., Gao, X., Li, Y., & Liu, Y. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3387396 · Cited by 2
TrapMI: A Data Protection Method to Resist Model Inversion Attacks in Split Learning
Na, H., & Choi, D. (2025) · IEEE Access · doi:10.1109/access.2025.3545597 · Cited by 2
“Nevertheless, split learning faces severe security issues owing to model inversion attacks [10], [11], [12].”
InfluentialAdvSGM: Differentially Private Graph Learning via Adversarial Skip-Gram Model
Zhang, S., Ye, Q., Hu, H., & Xu, J. (2025) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde65448.2025.00261 · Cited by 2
“In this work, we consider a white-box attack scenario [18].”
Efficient Neural Architecture Search for Split Computing via Supernet Fine-Tuning
Ogawa, K., & Hara–Azumi, Y. (2025) · IEEE Access · doi:10.1109/access.2025.3610959 · Cited by 2
“Privacy concerns were also studied by methods [12], [34] that add noise to bottlenecks to ensure theoretical privacy bounds against inversion attacks [35], [36], [37].”
Metadata
- Authors
- He, Z., Zhang, T., & Lee, R. B.
- Affiliations
- Princeton University (US)
- Nanyang Technological University (SG)
- Venue
- Proceedings of the 35th Annual Computer Security Applications Conference
- Publisher
- ACM
- Published
- 2019-12-09
- Pages
- 148-162
- ISSN
- 1063-9527 (ISSN-L)
- OpenAlex
- W2989885118
- Cited by
- 313
- References
- 48
- Citations by year
- 2026: 30 · 2025: 81 · 2024: 62 · 2023: 49 · 2022: 36 · 2021: 39 · 2020: 16
- FWCI
- 8.70
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Annual Computer Security Applications Conference (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- model inversion attacks, collaborative inference, inference privacy, privacy-preserving deep learning, data privacy, adversarial attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
