The DOI matches its Crossref record; 47 of the 48 references it cites were found in a registry or an index.
Model inversion attacks against collaborative inference
Abstract
The prevalence of deep learning has drawn attention to the privacy protection of sensitive data. Various privacy threats have been presented, where an adversary can steal model owners' private data. Meanwhile, countermeasures have also been introduced to achieve privacy-preserving deep learning. However, most studies only focused on data privacy during training, and ignored privacy during inference.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“a number of works suggest5–7 that on its own, federated learning is an insufficient measure of privacy preservation.”
From Medical imaging deep learning with differential privacy (2021) · cites this paper as [7]
Citations
Cites
Image quality assessment: from error visibility to structural similarity
Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004) · IEEE Transactions on Image Processing · doi:10.1109/tip.2003.819861 · Cited by 57,892
Learning representations by back-propagating errors
Rumelhart, D. E., Hinton, G. E., & Williams, R. J. (1986) · Nature · doi:10.1038/323533a0 · Cited by 31,892
Nonlinear total variation based noise removal algorithms
Rudin, L., Osher, S., & Fatemi, E. (1992) · Physica D Nonlinear Phenomena · doi:10.1016/0167-2789(92)90242-f · Cited by 17,214
(2010) · Cited by 14,134
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280
(2016) · Cited by 11,679
A Stochastic Approximation Method
Robbins, H., & Monro, S. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729586 · Cited by 9,643
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2015) · arXiv · doi:10.48550/arxiv.1512.03385 · Cited by 4,196
Research works printed but not linked: 14
- Ateniese Giuseppe, 2015, International Journal of Security and Networks
- Chilimbi Trishul, 2014, USENIX Symposium on Operating Systems Design and Implementation.
- Ganju Karan, 2018, ACM Conference on Computer and Communications Security.
- Glorot Xavier, 2010, Proceedings of the thirteenth international conference on artificial intelligence and statistics. 249--256
- Jamie Hayes Luca Melis George Danezis and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). Jamie Hayes Luca Melis George Danezis and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). · arXiv
- Hua Weizhe, 2018, ACM/ESDA/IEEE Design Automation Conference.
- Kingma Diederik P, 2014, Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 · arXiv
- Liu Kin Sum, 2018, Generative Model: Membership Attack, Generalization and Diversity. arXiv preprint arXiv:1805.09898 · arXiv
- Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl A Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv preprint arXiv:1802.04889 (2018). Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl A Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv preprint arXiv:1802.04889 (2018). · arXiv
- Oh Seong Joon, 2018, INternational Conference on Learning Representations.
- Ohrimenko Olga, 2016, USENIX Security Symposium.
- Shokri Reza, 2015, ACM conference on computer and communications security.
- Tramèr Florian, 2016, USENIX Security Symposium.
- Wang Binghui, 2018, Stealing Hyperparameters in Machine Learning. In IEEE Symposium on Security and Privacy.
Cited by
Sorted by citations
Items 201–300 of 315
Xu, S., Qi, Y., Qi, F., Guo, S., & Zhao, Z. (2026) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2026.3667621 · Cited by 4
“While semantic communication obscures transmitting raw data, potential reconstruction risks via model inversion attacks remain [72].”
ALRS: An Adversarial Noise Based Privacy-Preserving Data Sharing Mechanism
Chen, J., Deng, R., Chen, H., Ruan, N., Liu, Y., Liu, C., & Su, C. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-90567-5_25 · Cited by 2
Wu, M., Ye, D., Zhang, C., & Yu, R. (2021) · EURASIP Journal on Advances in Signal Processing · doi:10.1186/s13634-021-00822-7 · Cited by 2
“It is harder for the attacker to reconstruct the image data under the black-box setting than under the white-box setting [18].”
BackgroundMethodInference Attacks and Counterattacks in Federated Learning
Yu, S., & Cui, L. (2022) · Digital Privacy and Security · doi:10.1007/978-981-19-8692-5_2 · Cited by 2
Confidentiality of Machine Learning Models
Poltavtseva, M. A., & Rudnitskaya, E. A. (2023) · Automatic Control and Computer Sciences · doi:10.3103/s0146411623080242 · Cited by 2
“In addition, this class describes the attack against deep learning systems using GAN [16], the attack against the cooperative deep learning system [17], and several other similar solutions.”
Beyond Recognition : Privacy Protections in a Surveilled World
Le, M. (2024) · Linköping studies in science and technology. Dissertations · doi:10.3384/9789180756761 · Cited by 2
Optimizing Federated Learning through Lightweight and Scalable Blockchain
Andronikidis, G., Niotis, G., Eleftheriadis, C., Kyranou, K., Nikoletseas, S., & Sarigiannidis, P. G. (2024) · International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT) · doi:10.1109/dcoss-iot61029.2024.00075 · Cited by 2
“For maintaining data privacy with a central server, potential threats like model extraction attacks [33] and model inversion attacks [34] exist.”
BackgroundSecureLite: An Intelligent Defense Mechanism for Securing CNN Models Against Model Inversion Attack
Hussain, H., Tamizharasan, P. S., Pandit, G., Panthakkan, A., & Mansoor, W. (2024) · IEEE Access · doi:10.1109/access.2024.3457846 · Cited by 2
SCIPER: Secure Collaborative Inference via Privacy-Enhancing Regularization
Prodomo, V., Gonzalez, R., & Gramaglia, M. (2024) · IEEE Transactions on Privacy · doi:10.1109/tp.2024.3513254 · Cited by 2
Gu, H., Zhao, X., Zhu, G., Han, Y., Kang, Y., Fan, L., & Yang, Q. (2025) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2025.3534622 · Cited by 3
“For instance, it was shown that attackers may infer training images at pixel level accuracy even random noise are added to exchanged gradients [8], [9], [10], [11], [12], but exceedingly large noise jeopardise learning reliability and lead to significant degradation of utility [5], [6], [7].”
A Dual-Defense Self-balancing Framework Against Bilateral Model Attacks in Federated Learning
Wu, X., Yao, A., Pal, S., Jiang, F., Li, X., Jia, X., Dong, C., Chen, X., Zhang, X., & Liu, X. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-1525-4_14 · Cited by 2
Zakariyya, I., Tran, L., Sivangi, K. B., Henderson, P., & Deligianni, F. (2025) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv61041.2025.00548 · Cited by 3
“For instance, Membership Inference At-tacks (MIA) [35, 69, 74] and Model Inversion (MI) attacks [27] can disclose private information about the patients and their training data by accessing only the pre-trained model outputs.”
E-GAP: Evolutionary Gradient Attack on Privacy
Chaudhry, Y. S., & Mallipeddi, R. (2025) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2025.110399 · Cited by 2
Adversarial Autoencoder based Model Extraction Attacks for Collaborative DNN Inference at Edge
Zneit, M., Zhang, X., Mounesan, M., & Debroy, S. (2025) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms57970.2025.11073724 · Cited by 2
“The current literature in this space either focuses on DNN model extraction during model training [12], or on non-collaborative scenarios involving hardware or software backdoors [13], or on reconstructing the original input data from intermediate output of a particular layer [7].”
InfluentialPriPHiT: Privacy-Preserving Hierarchical Training of Deep Neural Networks
Sepehri, Y., Pad, P., Pascal Frossard, B., & Dunbar, L. A. (2025) · IEEE Transactions on Multimedia · doi:10.1109/tmm.2025.3607801 · Cited by 2
“…experiment on face data, we show that the average SSIM similarity metric between the results of a standard deep reconstruction attacker and the input images is reduced from 0.89 on a non-privacy-preserving baseline to 0.29 in PriPHiT model, which indicates an unsuccessful attack according to [9].”
InfluentialStealing Data from Active Party in Vertical Split Learning
Liu, Y., Xu, X., Yi, W., Zhuang, Y., Wang, J., Yang, M., & Li, Z. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-06096-9_18 · Cited by 2
Ryu, J., Zheng, Y., Gao, Y., Abuadbba, A., Kim, J., Won, D., Nepal, ., Kim, H., & Wang, C. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.03813 · Cited by 2
“In a recent work [10], He et al. proposed reconstruction attacks that allow the cloud to reconstruct the input image given the intermediate output and the local part model in the collaborative inference framework.”
InfluentialLightweight privacy preservation techniques for deep learning and inference in Internet of Things
Jiang, L. (2022) · doi:10.32657/10356/155000 · Cited by 2
Quantifying and Localizing Usable Information Leakage from Neural Network Gradients
Mo, F., Borovykh, A., Malekzadeh, M., Demetriou, S., Gündüz, D., & Haddadi, H. (2021) · arXiv · doi:10.48550/arxiv.2105.13929 · Cited by 1
“The attacker can even actively participate in the training process [36].”
BackgroundSeFL: A Secure Privacy-Preserving Federated Learning
Saraswat, D., Das, M. L., & Tanwar, S. (2024) · Globecom · doi:10.1109/globecom52923.2024.10901377 · Cited by 1
“The transmitted/uploaded gradients in FL are vulnerable to various attacks, including membership inference [3], model inversion [4], and eavesdropping [5], which can lead to privacy breaches by exposing the model’s inputs.”
A Study of Improving The Privacy-Utility Trade-off of Task-specific Models with Learnable Privacy
Özkan, S., Ceritli, T. Y., Min, J., Noh, E., Cho, J. M., Park, D., & Özay, M. (2025) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp49660.2025.10889274 · Cited by 1
“For different privacy threats, we report different metrics as described below: Data Reconstruction Attack: We utilize an approach proposed by [1].”
InfluentialTowards A Common Task Framework for Distributed Collaborative Machine Learning
Liao, Q., Landuyt, D. V., Preuveneers, D., & Joosen, W. (2025) · IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) · doi:10.1109/icstw64639.2025.10962497 · Cited by 1
“Nonetheless, DCML approaches remain vulnerable to various complex security and privacy risks such as Client Drop-Off/Join [25], Model Poisoning [26], Membership Inference [27], and Model Inversion [28].”
Xu, Y., Chen, Z., Cai, J., Cheng, G., Zhong, Q., & Wu, M. (2025) · Wireless and Optical Communications Conference · doi:10.1109/wocc63563.2025.11082176 · Cited by 1
“White-box attack: After the forward propagation of the training data is completed on the device, the malicious attacker obtains the smashed data A i shared by the device [9]. x j is the training data of the target mobile device.”
Edge-PRUNE: A Dataflow-Based Framework for Distributed Signal Processing and Machine Learning
Boutellier, J. J., Tan, B., Nurmi, J., & Bhattacharyya, S. S. (2025) · IEEE Transactions on Signal Processing · doi:10.1109/tsp.2025.3598453 · Cited by 2
Unraveling Elevated Data Leakage in Split Learning for Fine-Tuning Stable Diffusion Models
Fei, W., Zhu, Y., & Li, B. (2025) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3708821.3733865 · Cited by 1
“As a result, the effectiveness of attacks that rely on training a shadow client model [11, 13, 26] may be greatly diminished, as they rely on the availability of public datasets with similar distributions to the target ones.”
InfluentialStructure-Preference Enabled Graph Embedding Generation Under Differential Privacy
Zhang, S., Ye, Q., & Hu, H. (2025) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde65448.2025.00104 · Cited by 1
“In this paper, we consider a white-box attack [23], where the adversary possesses full information about the skip-gram model used for graph embedding, including its architecture and parameters.”
Yao, Y., Wang, Z., Luo, P., Cheng, Y., Hou, J., & Li, X. (2025) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2025.3607483 · Cited by 1
“Adversaries, such as malicious edge nodes, can exploit uploaded data to reconstruct original inputs or infer sensitive attributes, leading to threats like model inversion attacks [15], [16], [17] and attribute inference attacks [18], [19].”
Vanishing Privacy: Fast Gradient Leakage Threat to Federated Learning
Jiang, Y., Liu, X., & Yan, Q. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11228471 · Cited by 1
Boar, P. E., Sharma, P. K., Akram, R. N., & Li, W. (2025) · SN Computer Science · doi:10.1007/s42979-025-04482-4 · Cited by 1
“…et al. [32], the privacy goal is defined as preventing the unauthorised expo - sure of training data either directly or via any of the other Local Model Parameters : Parameters exchanged between devices contain information that attackers can use to deduce an individual client’s training data [28].”
FedFlex: Protecting Shared Features in Vertical Federated Learning via Differential Privacy
Mi, Y., Liu, H., Xia, Y., Sun, Y., Tang, Y., Guan, J., & Zhou, S. (2025) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2025.3636492 · Cited by 1
“These attacks can exploit accumulated model prediction outputs [5], partial model parameters [6], shared feature embeddings [9], [8], or their respective gradients [7], or by asserting possession of extra samples [23].”
FedPN: Lightweight Privacy-Preserving Federated Learning With Hardness of Learning Periodic Neurons
Yang, W., Xing, H., Zhang, Z., Gu, H., Fan, L., & Cao, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3609663 · Cited by 2
“MI attacks are implemented based on the work of He et al. [6], corresponding to the assumption in our security analysis that the attacker has already reconstructed the obfuscated features.”
Fission: Distributed Privacy-Preserving Large Language Model Inference
Ugurbil, M., Mouris, D., Santos, M. B., Cabrero-Holgueras, J., de Vega, M., & Sengupta, S. (2025) · IEEE Conference on Communications and Network Security · doi:10.1109/cns66487.2025.11194960 · Cited by 1
“Because the revealed data are highly informative, without proper refinement and reduction, they may be relevant to a party looking to extract specific characteristics [13], [14], [15].”
InfluentialGuo, H., Chen, W., Li, J., & Geng, X. (2026) · Scientific Reports · doi:10.1038/s41598-026-35420-w · Cited by 1
“For example, untrustworthy servers can successfully reconstruct private data from clients or infer private features of training data through model inversion attacks 12 and inference attacks 13,14 .”
Tan, J., Li, A., Liu, Q., Ran, P., & Zhang, L. (2026) · ACM Transactions on Sensor Networks · doi:10.1145/3790100 · Cited by 1
DeepGuard: Defending Deep Joint Source-Channel Coding Against Eavesdropping at Physical-Layer
Chi, K., He, Y., Yang, Q., Shu, Y., Wang, Z., Luo, J., & Chen, J. (2026) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2026.3670338 · Cited by 1
“Chen et al. [18] were the first to introduce model inversion-based eavesdropping attacks [44] against DeepJSCC frameworks, demonstrating that adversaries can potentially reconstruct sensitive information from the transmitted semantic features.”
SoK: A Taxonomy of Attacks and Defenses in Split Learning
Shabbir, A., Kanpak, H. İ., Küpçü, A., & Sav, S. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-32578-5_1 · Cited by 1
Rényi Differential Private Proximal ADMM for Distributed Machine Learning
Wang, Z., Shi, X., & Guo, L. (2023) · Chinese Control Conference (CCC) · doi:10.23919/ccc58697.2023.10241146 · Cited by 1
Batch data recovery from gradients based on generative adversarial networks
Huang, Y., Chen, Y., Martínez-Ortega, J.-F., Yu, H., & Yang, Z. (2024) · Neural Computing and Applications · doi:10.1007/s00521-024-09870-0 · Cited by 1
“But when the batch size is 32, the details of the reconstructed image are missing, the images are unrecognizable [9].”
Dye4AI: Assuring Data Boundary on Generative AI Services
Wang, S., Sun, K., & Zhai, Y. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3670299 · Cited by 1
“Attackers can even recover an arbitrary input in collaborative systems without access to other participants’ data [35].”
Continuous Authentication Leveraging Matrix Profile
Ibañez-Lissen, L., Fuentes, J. M. D., González‐Manzano, L., & Anciaux, N. (2024) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3664476.3664481 · Cited by 1
“Nonetheless, this approach could be vulnerable to model inversion attacks [17], where an attacker may extract sensitive information from the distributed models.”
BackgroundAdvances and Challenges in Privacy-Preserving Machine Learning
Acheme, S., Edegbe, G. N., & Acheme, I. D. (2024) · IEEE SmartBlock4Africa · doi:10.1109/smartblock4africa61928.2024.10779547 · Cited by 1
Privacy-Preserving Data Obfuscation for Credit Scoring
Prodomo, V., González, R., Gramaglia, M., & Romano, S. P. (2025) · ACM Symposium on Applied Computing · doi:10.1145/3672608.3707864 · Cited by 1
A Survey of Challenges and Opportunities in Vertical Federated Unlearning
Tae, H. X., & Chan, C. S. (2025) · IEEE Access · doi:10.1109/access.2025.3600884 · Cited by 3
“In feature inference attack, the active party aims to reconstruct passive parties’ feature values via model inversion [86], CAFE [87], or prediction alignment [88].”
UIFV: Data Reconstruction Attack in Vertical Federated Learning
Yang, J., Chen, P., Lu, Z., Duan, Q., & Bao, Y. (2025) · IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws67624.2025.00026 · Cited by 4
Functional encryption based approaches for practical privacy-preserving machine learning
Xu, R. (2020) · D-Scholarship@Pitt (University of Pittsburgh) · Cited by 1
Loss-based differentiation strategy for privacy preserving of social robots
Yang, Q., Wang, T., Zhu, K., Wang, J., Yu, H., & Su, C. (2022) · The Journal of Supercomputing · doi:10.1007/s11227-022-04660-8 · Cited by 1
MixCon: Adjusting the Separability of Data Representations for Harder Data RecoveryPreprint
Li, X., Huang, Y., Peng, B., Song, Z., & Li, K. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.11463 · Cited by 1
Accuracy-Privacy Trade-off in Deep Ensembles.Preprint
Rezaei, S., Shafiq, Z., & Liu, X. (2021) · arXiv (Cornell University) · Cited by 1
Trapmi: A Data Protection Method to Resist Model Inversion Attacks in Split LearningPreprint
Na, H., & Choi, D. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4830899 · Cited by 1
Higgins, G., Razavi‐Far, R., Zhang, X., David, A., Ghorbani, A. A., & Ge, T. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.5062204 · Cited by 1
Reducing Risk of Model Inversion Using Privacy-Guided TrainingPreprint
Goldsteen, A., Ezov, G., & Farkash, A. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.15877 · Cited by 5
“Another type of attack proposed by He, Zhang, and Lee (He et al., 2019) compromises the privacy of inference data in collaborative deep learning systems.”
Preserving Privacy in Personalized Models for Distributed Mobile Services
Atrey, A., Shenoy, P. J., & Jensen, D. D. (2021) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs51616.2021.00088 · Cited by 2
Neural Network Information Leakage Through Hidden Learning
da Cunha, A., Natale, E., & Viennot, L. (2023) · Communications in computer and information science · doi:10.1007/978-3-031-34020-8_8
“Even if the official network is suspected to be produced by such a framework, naive strategies to use it while preventing information leakage, such as perturbing the network weights, appear ineffective in our robustness experiments 5 .”
ZS-IL: Looking Back on Learned Experiences For Zero-Shot Incremental LearningPreprint
Pourkeshavarz, M., & Sabokrou, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.12216
“Inspired by [14, 16, 30], we propose a solution to reply the previous experiences by recovery the learner network memory.”
MethodTopology-aware Differential Privacy for Decentralized Image ClassificationPreprint
Guo, S., Zhang, T., Xu, G., Yu, H., Xiang, T., & Liu, Y. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.07817
“Past works have demonstrated the feasibility and severity of model inversion attacks [8], [9], [10], [11] and membership inference attacks [12], [13] in distributed learning.”
BackgroundSelf-citationAccuracy-Privacy Trade-off in Deep Ensemble: A Membership Inference PerspectivePreprint
Rezaei, S., Shafiq, Z., & Liu, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.05381 · Cited by 5
Wang, X., Wang, X., Huang, B., Dai, M., & Li, J. (2022) · Security and Communication Networks · doi:10.1155/2022/8607234
Trapmi: A Data Protection Method to Resist Model Inversion Attacks in Split LearningPreprint
Na, H., & Choi, D. (2023) · SSRN Electronic Journal · doi:10.2139/ssrn.4664107
Mestari, S. Z. E., Doğan, F. S., & Botes, M. (2023) · Springer eBooks · doi:10.1007/978-3-031-44939-0_3
Targeted Model Inversion: Distilling style encoded in predictions
Jeong, H., Chung, K., Hwang, S. J., & Son, S. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103967
Label Privacy Source Coding in Vertical Federated Learning
Gao, D., Wan, S., Gu, H., Fan, L., Yao, X., & Yang, Q. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-70341-6_19
Novel Privacy Attacks and Defenses Against Neural Networks
Dibbo, S. V. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690863
“…enough and requires more attention due to the challenges (i.e., model accuracy drop, model-dependent defense, specific to centralized or federated learning) to enhance the robustness and trustworthiness of the deployed ML systems against these types of MI attacks at scale [9, 11, 12, 18, 23].”
CLUES: Collusive Theft of Conditional Generative Adversarial Networks
Queyrut, S., Schiavoni, V., Chen, L. Y., Felber, P. A., & Birke, R. (2024) · IEEE Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds64841.2024.00035
Towards Assessing Integrated Differential Privacy and Fairness Mechanisms in Supervised Learning
Aldairi, M., & Joshi, J. B. D. (2024) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa62245.2024.00034
PlugVFL: Robust and IP-Protecting Vertical Federated Learning against Unexpected Quitting of Parties
Sun, J., Du, Z., Dai, A., Baghersalimi, S., Amirshahi, A., Atienza, D., & Chen, Y. (2024) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata62323.2024.10825534 · Cited by 10
“In VFL, we categorize IP stealing attacks into two types, i.e., feature inference [27, 15, 17, 18] and label inference [9, 22, 26].”
Lim, G., Oh, W., & Hur, J. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-1624-4_6
Active Gradient Manipulation for Privacy Breaching in Vertical Federated Learning
Jeter, T. R., Vu, M. N., Alharbi, R., Seo, J. T., & Thai, M. T. (2025) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2025.3556094
“Since models for tabular data are not provided [8], our results on tabular data exclude the benchmark.”
InfluentialTowards Privacy-Preserving Split Learning for ControlNet
Yao, D. (2025) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv61041.2025.00024
“Inversion attack is based on training an inverse network [13,23,43].”
DeGain: Detecting GAN-Based Data Inversion in Collaborative Deep Learning
Chen, Z., Gao, Y., Fu, A., Zeng, F., Kuang, B., & Deng, R. H. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-9101-2_9 · Cited by 1
Tiwari, K., Sarkar, N., Bisht, K., & Shukla, S. (2025) · Lecture notes in networks and systems · doi:10.1007/978-981-96-4880-1_2
PAIR: Privacy Attack Against Image Recognition With Sample Augmentation
Feng, Y., & Liu, Q. (2025) · IET Image Processing · doi:10.1049/ipr2.70190
Towards Secure Co-Inference: Leveraging DNN Partitioning and Collaborative Friendly Jamming
Chen, X., Zhang, Q., Ni, W., Pan, G., Sun, Y., & Zhang, S. (2025) · IEEE/CIC International Conference on Communications in China (ICCC) · doi:10.1109/iccc65529.2025.11149293
“…National Key R&D Program of China grants 2022YFB2902002 and 2022YFB2902303, Shanghai Rising-Star Program, and Shanghai Municipal Science and Technology Commission Foundation grant 24DP1500703. droppers, who may intercept the intermediate data and infer the model parameters or input data [5], [6].”
Liu, D., Xu, C., Li, J., Nassereldine, A., & Xiong, J. (2025) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1109/dac63849.2025.11132673 · Cited by 1
“To reconstruct raw input x from the intermediate output M c,h ( x ) , the server adopts a common model inversion attack [4, 5, 20].”
InfluentialInverCRS: Generative Audio Inversion Attack in Collaborative Recognition Systems
Zhang, X., Luo, H., Han, M., Dong, Q., Zhang, G., Yang, Y., Li, Q., & Hu, P. (2025) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs63083.2025.00057
“Despite the advantages of CRS, recent research has revealed a critical vulnerability: intermediate representations can be exploited to reconstruct the original input, posing a significant threat to data privacy [18], [44], [46].”
Privacy and Latency-Aware Dynamic Split Computing
Ise, K., & Hara–Azumi, Y. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-01823-6_19
Lansari, M., Bellafqira, R., Kapusta, K., Thouvenot, V., Bettan, O., & Coatrieux, G. (2025) · Communications in computer and information science · doi:10.1007/978-3-032-09598-5_9
Z ORRO: Zero-Knowledge Robustness and Privacy for Split Learning
Sheybani, N., Pegoraro, A., Knauer, J., Rieger, P., Mollakuqe, E., Koushanfar, F., & Sadeghi, A. (2025) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3719027.3765160
Zhang, L., Gao, X., Zhao, B., Guan, Z., & Bian, S. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104159
Privacy-Preserving Robotic Perception for Object Detection in Curious Cloud Robotics
Antonazzi, M., Alberti, M., Bassot, A., Luperto, M., & Basilico, N. (2025) · IEEE Transactions on Robotics · doi:10.1109/tro.2025.3613551
“…, find encoder–decoder bottleneck dimension Z and parameters ( θ e , θ d ) such that, for data distribution D , the following is minimized: Then, we introduce an attacker , explicitly formalizing the process of executing our scenario’s threat, which is inspired by model inversion attack (MIA) [23].”
InfluentialMDiffFR: Modality-Guided Diffusion Generation for Cold-start Items in Federated Recommendation
Fu, K., Zhang, H., Zou, X., & Li, Y. (2026) · ACM Transactions on Information Systems · doi:10.1145/3843228
“Once the attacker obtains additional item embeddings from the system, the shadow model can be exploited to reconstruct the corresponding modality features, thereby recovering sensitive information from the embedding space.”
SLeak: Multi-Target Privacy Stealing Attack Against Split Learning
Xu, X., Yi, W., Wang, J., Hu, H., Yang, M., Li, Z., Zhuang, Y., Liu, Y., & Ye, M. (2026) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2026.3654092
“In this setting, the server modifies the gradients returned to the client, making it more vulnerable to data reconstruction attacks [17], [47].”
Col-TEEs: Secure and Efficient Collaborative Inference Framework in Heterogeneous TEEs
Liu, X., Li, T., Jian, Z., Xie, X., Li, M., & Wang, G. (2025) · IEEE International Conference on Parallel and Distributed Systems (ICPADS) · doi:10.1109/icpads67057.2025.11322922
“Meanwhile, to proactively defend against advanced model-reconstruction attacks (in which intermediate outputs may be exploited) [14], we establish a lower bound that guarantees sufficient defensive strength.”
InfluentialWang, X., Liu, X., Xie, X. N., Zhang, K., Cai, Q., Tong, X., Gong, Z., & Li, K. (2025) · IEEE International Conference on Parallel and Distributed Systems (ICPADS) · doi:10.1109/icpads67057.2025.11323172
“Authorized users may covertly acquire the model service by employing model inversion techniques [13]–[15] to bypass access control.”
MMD-Regularized Pseudo-Client for Reconstruction Attack in Split Learning
Xiang, F. (2025) · International Conference on Computer, Internet of Things and Control Engineering (CITCE) · doi:10.1109/citce67565.2025.11360075
“Several works [3], [5], [7], [14], [21] demonstrated that intermediate features generated by shallow cut layers preserve low-level visual patterns, enabling high-fidelity image reconstruction through gradient-based inversion or decoder-guided optimization.”
Privacy-Preserving Blockchain-Enabled Vertical Federated Learning with Data Auditing
Li, B., Xu, Z., Zhang, Y., & Wang, H. (2025) · IEEE Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds69199.2025.00019
“We assume that blockchain nodes and the active party are honest but curious, meaning they follow the VFL training protocol but may attempt to recover the private features of passive participants by observing the intermediate results [16], [28], [29].”
Loss-Optimized Recursive Gradient Attack on Privacy
Li, X., Ye, H., Kong, T., & Wen, S. (2025) · International Conference on Cyber Security and Information Engineering (ICCSIE) · doi:10.1109/iccsie65832.2025.00048
“More broadly, the existence of model inversion attacks [6, 11] raises fundamental questions about the security of transmission behavior.”
Towards the integration of Privacy-Preserving technologies in future mobile networking
Prodomo, V., González, R., Sperlí, G., & Romano, S. P. (2026) · Computer Communications · doi:10.1016/j.comcom.2026.108445
A Survey of Model Inversion Attacks on Image Domain
Kim, C., Hwang, C.-H., Kim, S., & Seo, J. H. (2025) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc66702.2025.11388195
“He et al. [16] constructed their model architecture with convolutional layers and ReLU activations to perform inversion on relatively simple datasets such as MNIST and CIFAR-10.”
Modeling and Security Analysis of Attacks on Machine Learning Systems
Singhal, A. (2025) · IEEE International Conference on Cognitive Machine Intelligence (CogMI) · doi:10.1109/cogmi67134.2025.00061
“Privacy attacks may reconstruct sensitive information about the training data from the model parameters or outputs [7, 27].”
Adaptive Generative Model Inversion Attacks in Edge–Cloud Collaborative Inference Systems
Liu, H., Chen, Y., & Yang, Z. (2026) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2026.3673987
“Meanwhile, if the target dataset is CIFAR-10 and the split layer is deep, the generative model cannot learn enough prior knowledge to offset the distribution shifts, and the reconstruction results of PPA [9] are worse than those of rMLE [5].”
InfluentialA NOVEL PRIVACY-PRESERVING FEDERATED LEARNING MODEL FOR FDIA DETECTION IN SMART GRIDS
Dr.G.Anil Kumar, D. A. B. (2026) · International Journal for Research In Science & Advanced Technologies · doi:10.65726/ijrsat.2026.v26.i04.06
On contradictions between model interpretability and inversion attacks
Naseem, M. L., Ye, Z., Qi, Z., & Luo, W. (2026) · Complex & Intelligent Systems · doi:10.1007/s40747-026-02294-4
Privacy and fairness issues with algorithmic decision systems
Béziaud, L. (2023) · theses.fr (ABES) · doi:10.70675/e81f85e9z1e9ez4868z9783zc3471c83c72b
A Survey of Model Inversion Attacks: An Interface-Prior Perspective
Liu, H., Chen, Y., & Yang, Z. (2025) · International Conference on Communication and Network Security (ICCNS) · doi:10.1145/3789456.3789473
Leveraging Sparsity for Privacy in Collaborative Inference
Hoefler, M. A., Mueller, K., & Samek, W. (2026) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv61042.2026.00733
“However, this paradigm introduces two fundamental and often conflicting challenges: the high communication cost of transmitting intermediate features and the severe privacy risks from exposing this data to a potentially untrusted server [7].”
Lost in the Averages: Reassessing Record-Specific Privacy Risk Evaluation
Krčo, N., Guépin, F., Meeus, M., Kulynych, B., & de Montjoye, Y.-A. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-16089-8_2
Priv-FedTL: Privacy-preserving federated transfer learning for resource constrained devices
Osmani, A. M. I. M., Rahman, T., Rahman, M. S., & Islam, S. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112449
Hu, Y., Huang, Y., Liu, R., Xue, X., Zhang, Y., Wu, J., Huang, Z.-A., & Tan, K. C. (2026) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2026.3704679
“…raise potential concerns about privacy leakage, as intermediate tensors, especially those from early layers, retain significant structural similarity to raw inputs, enabling malicious servers to perform high-fidelity reconstructions of original samples even with limited prior knowledge [34], [35].”
A comprehensive survey on communication optimization and privacy preservation in federated learning
Kunjumon, A., Sarath, G., & Nair, J. J. (2026) · Discover Computing · doi:10.1007/s10791-026-10272-0 · Cited by 1
Metadata
- Authors
- He, Z., Zhang, T., & Lee, R. B.
- Affiliations
- Princeton University (US)
- Nanyang Technological University (SG)
- Venue
- Proceedings of the 35th Annual Computer Security Applications Conference
- Publisher
- ACM
- Published
- 2019-12-09
- Pages
- 148-162
- ISSN
- 1063-9527 (ISSN-L)
- OpenAlex
- W2989885118
- Cited by
- 313
- References
- 48
- Citations by year
- 2026: 30 · 2025: 81 · 2024: 62 · 2023: 49 · 2022: 36 · 2021: 39 · 2020: 16
- FWCI
- 8.70
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Annual Computer Security Applications Conference (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- model inversion attacks, collaborative inference, inference privacy, privacy-preserving deep learning, data privacy, adversarial attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
