The DOI matches its Crossref record; 47 of the 48 references it cites were found in a registry or an index.
Model inversion attacks against collaborative inference
Abstract
The prevalence of deep learning has drawn attention to the privacy protection of sensitive data. Various privacy threats have been presented, where an adversary can steal model owners' private data. Meanwhile, countermeasures have also been introduced to achieve privacy-preserving deep learning. However, most studies only focused on data privacy during training, and ignored privacy during inference.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“a number of works suggest5–7 that on its own, federated learning is an insufficient measure of privacy preservation.”
From Medical imaging deep learning with differential privacy (2021) · cites this paper as [7]
Citations
Cites
Image quality assessment: from error visibility to structural similarity
Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004) · IEEE Transactions on Image Processing · doi:10.1109/tip.2003.819861 · Cited by 57,892
Learning representations by back-propagating errors
Rumelhart, D. E., Hinton, G. E., & Williams, R. J. (1986) · Nature · doi:10.1038/323533a0 · Cited by 31,892
Nonlinear total variation based noise removal algorithms
Rudin, L., Osher, S., & Fatemi, E. (1992) · Physica D Nonlinear Phenomena · doi:10.1016/0167-2789(92)90242-f · Cited by 17,214
(2010) · Cited by 14,134
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280
(2016) · Cited by 11,679
A Stochastic Approximation Method
Robbins, H., & Monro, S. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729586 · Cited by 9,643
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2015) · arXiv · doi:10.48550/arxiv.1512.03385 · Cited by 4,196
Research works printed but not linked: 14
- Ateniese Giuseppe, 2015, International Journal of Security and Networks
- Chilimbi Trishul, 2014, USENIX Symposium on Operating Systems Design and Implementation.
- Ganju Karan, 2018, ACM Conference on Computer and Communications Security.
- Glorot Xavier, 2010, Proceedings of the thirteenth international conference on artificial intelligence and statistics. 249--256
- Jamie Hayes Luca Melis George Danezis and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). Jamie Hayes Luca Melis George Danezis and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). · arXiv
- Hua Weizhe, 2018, ACM/ESDA/IEEE Design Automation Conference.
- Kingma Diederik P, 2014, Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 · arXiv
- Liu Kin Sum, 2018, Generative Model: Membership Attack, Generalization and Diversity. arXiv preprint arXiv:1805.09898 · arXiv
- Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl A Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv preprint arXiv:1802.04889 (2018). Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl A Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv preprint arXiv:1802.04889 (2018). · arXiv
- Oh Seong Joon, 2018, INternational Conference on Learning Representations.
- Ohrimenko Olga, 2016, USENIX Security Symposium.
- Shokri Reza, 2015, ACM conference on computer and communications security.
- Tramèr Florian, 2016, USENIX Security Symposium.
- Wang Binghui, 2018, Stealing Hyperparameters in Machine Learning. In IEEE Symposium on Security and Privacy.
Cited by
Sorted by citations
Items 301–315 of 315
Muñoz-Organero, M., & Lorero, S. (2026) · Machine Learning with Applications · doi:10.1016/j.mlwa.2026.100942
Full-Stack Model Extraction: Evaluating System-Wide Stealing Attacks
Hackett, W., Trawicki, S., Yu, Z., Suri, N., & Garraghan, P. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-32764-2_3
Privacy Risk Assessment of AI Models in the Healthcare Domain
Anderson, M., Goldsteen, A., Amit, G., Shachor, S., Razinkov, N., Koren, N., & Farkash, A. (2026) · Springer eBooks · doi:10.1007/978-3-032-25917-2_7
Noise-Aware Misclassification Attack Detection in Collaborative DNN Inference
Yousefi, S., & Debroy, S. (2026) · IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing (CCGrid) · doi:10.1109/ccgrid68966.2026.00026
“In addition, attackers can leverage model outputs or intermediate representations to reconstruct sensitive input data or extract model parameters [7].”
Countering Overfitting with Counterfactual Examples
Giorgi, F., Veglianti, F., Silvestri, F., & Tolomei, G. (2026) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3770854.3780243
Towards Secure Machine Learning: Preventing Data Poisoning and Model Inversion in AI Pipelines
Al-Matari, M. R., Al-Haija, Q. S. A., & Najadat, H. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-21174-3_29
FedAdOb: Privacy-Preserving Fed erated Deep Learning With Ad aptive Ob fuscation
Gu, H., Luo, J., Kang, Y., Yao, Y., Zhu, G., Li, B., Fan, L., & Yang, Q. (2026) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2026.3715766 · Cited by 1
“Modelinversion[24] andCAFE[6]arethetwomostwell-knownFIattacksinVFL.”
InfluentialBlack-Box Embedding Inversion Attack on Vector Databases
Sun, L., Wu, Y., Sha, H., Luo, X., Yi, M., Zhang, M., Li, C., & Chen, H. (2026) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3770855.3817917
“Early work [11] reconstructs private images by training inverse networks on input–output pairs.”
InfluentialWang, X., Li, K., Zhang, J., Gulomsafdarov, A., Xie, X. N., Zhang, K., Cai, Q., Liu, J., Wang, K., & Li, K. (2026) · IEEE Transactions on Communications · doi:10.1109/tcomm.2026.3721643
“The authors in [19] investigate such training-based inversion methods under stringent closed-box constraints.”
Improving Privacy-Utility Trade-Off with Learnable Privacy Mechanism in Machine Learning Tasks
Ozkan, S., Mutlu, S., & Ozay, M. (2026) · Proceedings - International Conference on Image Processing · doi:10.1109/icip61757.2026.11630216
Secure and Efficient Healthcare Prediction via Differentially Private Split Learning
Dhinesh Kanna, S., & Thirunavukkarasan, M. (2026) · International Conference on Trends in Quantum Computing and Emerging Business Technologies (TQCEBT) · doi:10.1109/tqcebt67648.2026.11681091
“…improvements, SL is not necessarily a secure system: an honest-but-curious server can use the received smashed activations to reconstruct client inputs using feature inversion and model inversion attacks, as shown by He et al. both in the collaborative inference and edge-cloud setting [3], [4].”
Reconstructing Training Data from Models Trained with Transfer Learning
Oz, Y., Yehudai, G., Vardi, G., Antebi, I., Irani, M., & Haim, N. (2026) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml68715.2026.00066
“Reconstruction in a federated learning setup [10], [11], [12], [13], [14], [15], [16], [17], [18] where the attacker assumes knowledge of samples’ gradients.”
ReTarget: Representation Transformation via Adversarial Regularization for Geometric Misalignment
Chen, J.-Y., & Chen, S.-T. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-37531-5_20
A Unified Privacy-Utility Framework for Collaborative Inference Via Randomized Smoothing
Ding, S., Zhang, L., Wang, Z., & Yuan, X. (2026) · doi:10.1109/cvprf71909.2026.00772
“…data on the client, it does not ensure privacy, as intermediate representations transmitted to the server can still leak sensitive information [17, 22, 35, 48], and a growing body of work has demonstrated input reconstruction attacks capable of recovering original input from these representations…”
Roy, F., Ding, X., Choo, K. K. R., & Zhou, P. (2024) · arXiv · doi:10.48550/arxiv.2409.12651 · Cited by 7
Metadata
- Authors
- He, Z., Zhang, T., & Lee, R. B.
- Affiliations
- Princeton University (US)
- Nanyang Technological University (SG)
- Venue
- Proceedings of the 35th Annual Computer Security Applications Conference
- Publisher
- ACM
- Published
- 2019-12-09
- Pages
- 148-162
- ISSN
- 1063-9527 (ISSN-L)
- OpenAlex
- W2989885118
- Cited by
- 313
- References
- 48
- Citations by year
- 2026: 30 · 2025: 81 · 2024: 62 · 2023: 49 · 2022: 36 · 2021: 39 · 2020: 16
- FWCI
- 8.70
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Annual Computer Security Applications Conference (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- model inversion attacks, collaborative inference, inference privacy, privacy-preserving deep learning, data privacy, adversarial attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
