The DOI matches its Crossref record; 47 of the 48 references it cites were found in a registry or an index.
Model inversion attacks against collaborative inference
Abstract
The prevalence of deep learning has drawn attention to the privacy protection of sensitive data. Various privacy threats have been presented, where an adversary can steal model owners' private data. Meanwhile, countermeasures have also been introduced to achieve privacy-preserving deep learning. However, most studies only focused on data privacy during training, and ignored privacy during inference.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“a number of works suggest5–7 that on its own, federated learning is an insufficient measure of privacy preservation.”
From Medical imaging deep learning with differential privacy (2021) · cites this paper as [7]
Citations
Cites
Image quality assessment: from error visibility to structural similarity
Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004) · IEEE Transactions on Image Processing · doi:10.1109/tip.2003.819861 · Cited by 57,892
Learning representations by back-propagating errors
Rumelhart, D. E., Hinton, G. E., & Williams, R. J. (1986) · Nature · doi:10.1038/323533a0 · Cited by 31,892
Nonlinear total variation based noise removal algorithms
Rudin, L., Osher, S., & Fatemi, E. (1992) · Physica D Nonlinear Phenomena · doi:10.1016/0167-2789(92)90242-f · Cited by 17,214
(2010) · Cited by 14,134
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280
(2016) · Cited by 11,679
A Stochastic Approximation Method
Robbins, H., & Monro, S. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729586 · Cited by 9,643
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2015) · arXiv · doi:10.48550/arxiv.1512.03385 · Cited by 4,196
Large Scale Distributed Deep Networks
Dean, J. B., Corrado, G. S., Monga, R., Chen, K., Devin, M., Mao, M., Ranzato, M., Senior, A., Tucker, P. A., Yang, K., et al. (2012) · Cited by 3,202
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734
August, W. U., Moore, D., Voelker, G. M., & Savage, S. (2004) · IEEE Security & Privacy · doi:10.1109/msp.2004.9 · Cited by 1,519
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
Hitaj, B., Ateniese, G., & Perez-Cruz, F. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134012 · Cited by 1,377
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S. (2018) · 2018 IEEE 31st Computer Security Foundations Symposium (CSF) · doi:10.1109/csf.2018.00027 · Cited by 1,001
Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., & Backes, M. (2019) · Proceedings 2019 Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23119 · Cited by 852
Distributed Deep Neural Networks Over the Cloud, the Edge and End Devices
Teerapittayanon, S., McDanel, B., & Kung, H. T. (2017) · 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2017.226 · Cited by 843
Stealing Machine Learning Models via Prediction APIs
Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., & Ristenpart, T. (2016) · arXiv · doi:10.48550/arxiv.1609.02943 · Cited by 796
Effective Approaches to Attention-based Neural Machine TranslationPreprint
Luong, M.-T., Pham, H., & Manning, C. D. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1508.04025 · Cited by 742
Machine Learning Classification over Encrypted Data
Bost, R., Popa, R. A., Tu, S., & Goldwasser, S. (2015) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2015.23241 · Cited by 683
Neurosurgeon: Collaborative Intelligence Between the Cloud and Mobile Edge
Kang, Y., Hauswald, J., Gao, C., Rovinski, A., Mudge, T., Mars, J., & Tang, L. (2017) · Proceedings of the Twenty-Second International Conference on Architectural Support for Programming Languages and Operating Systems · doi:10.1145/3037697.3037698 · Cited by 673
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.
Fredrikson, M., Lantz, E., Jha, S., Lin, S. M., Page, D., & Ristenpart, T. (2014) · PubMed · Cited by 658
Towards Making Systems Forget with Machine Unlearning
Cao, Y., & Yang, J. (2015) · 2015 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2015.35 · Cited by 622 · cited 1×
“[5] proposed a methodology to remove the effects of sensitive training samples on the models.”
MethodProject Adam: building an efficient and scalable deep learning training system
Chilimbi, T. M., Suzue, Y., Apacible, J., & Kalyanaraman, K. (2014) · Operating Systems Design and Implementation · doi:10.5555/2685048.2685094 · Cited by 614
Machine Learning Models that Remember Too Much
Song, C., Ristenpart, T., & Shmatikov, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134077 · Cited by 526
Ateniese, G., Mancini, L. V., Spognardi, A., Villani, A., Vitali, D., & Felici, G. (2015) · International Journal of Security and Networks · doi:10.1504/ijsn.2015.071829 · Cited by 518
Handwritten digit recognition: applications of neural network chips and automatic learning
Le Cun, Y., Jackel, L. D., Boser, B., Denker, J. S., Graf, H. P., Guyon, I., Henderson, D., Howard, R. E., & Hubbard, W. (1989) · IEEE Communications Magazine · doi:10.1109/35.41400 · Cited by 480
Ganju, K., Wang, Q., Yang, W., Gunter, C. A., & Borisov, N. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243834 · Cited by 475 · cited 1×
“, property inference attacks [3, 11], membership inference attacks [18, 29, 30, 39, 41, 49], model inversion attacks [9, 10].”
BackgroundJointDNN: An Efficient Training and Inference Engine for Intelligent Mobile Cloud Computing Services
Eshratifar, A. E., Abrishami, M. S., & Pedram, M. (2019) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2019.2947893 · Cited by 398
Reverse Engineering Convolutional Neural Networks Through Side-channel Information Leaks
Hua, W., Zhang, Z., & Suh, G. E. (2018) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1145/3195970.3196105 · Cited by 256
Chiron: Privacy-preserving Machine Learning as a ServicePreprint
Hunt, T., Song, C., Shokri, R., Shmatikov, V., & Witchel, E. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.05961 · Cited by 234
Wei, L., Luo, B., Li, Y., Liu, Y., & Xu, Q. (2018) · Annual Computer Security Applications Conference · doi:10.1145/3274694.3274696 · Cited by 217
Neurosurgeon: Collaborative Intelligence Between the Cloud and Mobile Edge
Kang, Y., Hauswald, J., Gao, C., Rovinski, A., Mudge, T., Mars, J., & Tang, L. (2017) · ACM SIGPLAN Notices · doi:10.1145/3093336.3037698 · Cited by 185
Ko, J. H., Na, T., Amir, M. F., & Mukhopadhyay, S. (2018) · 2018 15th IEEE International Conference on Advanced Video and Signal Based Surveillance (AVSS) · doi:10.1109/avss.2018.8639121 · Cited by 153
Sensitive-Sample Fingerprinting of Deep Neural Networks
He, Z., Zhang, T., & Lee, R. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00486 · Cited by 90
Self-citationPrivacy-preserving Machine Learning through Data ObfuscationPreprint
Zhang, T., He, Z., & Lee, R. B.-L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.01860 · Cited by 82
Self-citationDifferentially Private Releasing via Deep Generative ModelPreprint
Zhang, X.-Y., Ji, S.-L., & Wang, T. (2018) · arXiv.org · doi:10.48550/arxiv.1801.01594 · Cited by 75
Crowd-ML: A Privacy-Preserving Learning Framework for a Crowd of Smart Devices
Hamm, J., Champion, A. C., Chen, G., Belkin, M., & Dong, X. (2015) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2015.10 · Cited by 65
Generating Artificial Data for Private Deep LearningPreprint
Triastcyn, A., & Faltings, B. V. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.03148 · Cited by 62
A hybrid approach to offloading mobile image classification
Hauswald, J., Manville, T., Zheng, Q., Dreslinski, R., Chakrabarti, C., & Mudge, T. (2014) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp.2014.6855235 · Cited by 56
I Know What You See: Power Side-Channel Attack on Convolutional Neural Network AcceleratorsPreprint
Wei, L., Luo, B., Li, Y., Liu, Y., & Xu, Q. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.05847 · Cited by 54
Towards Reverse-Engineering Black-Box Neural NetworksPreprint
Oh, S. J., Augustin, M., Schiele, B., & Fritz, M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.01768 · Cited by 42
Power-Grid Controller Anomaly Detection with Enhanced Temporal Deep Learning
He, Z., Raghavan, A., Hu, G., Chai, S. M., & Lee, R. B.-L. (2019) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom/bigdatase.2019.00030 · Cited by 27
Self-citationA Hierarchical Inference Model for Internet-of-Things
Yin, H., Wang, Z., & Jha, N. K. (2018) · IEEE Transactions on Multi-Scale Computing Systems · doi:10.1109/tmscs.2018.2821154 · Cited by 25
(2014) · doi:10.4230/oasics.slate.2021.16 · Cited by 1
Research works printed but not linked: 14
- Ateniese Giuseppe, 2015, International Journal of Security and Networks
- Chilimbi Trishul, 2014, USENIX Symposium on Operating Systems Design and Implementation.
- Ganju Karan, 2018, ACM Conference on Computer and Communications Security.
- Glorot Xavier, 2010, Proceedings of the thirteenth international conference on artificial intelligence and statistics. 249--256
- Jamie Hayes Luca Melis George Danezis and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). Jamie Hayes Luca Melis George Danezis and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). · arXiv
- Hua Weizhe, 2018, ACM/ESDA/IEEE Design Automation Conference.
- Kingma Diederik P, 2014, Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 · arXiv
- Liu Kin Sum, 2018, Generative Model: Membership Attack, Generalization and Diversity. arXiv preprint arXiv:1805.09898 · arXiv
- Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl A Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv preprint arXiv:1802.04889 (2018). Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl A Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv preprint arXiv:1802.04889 (2018). · arXiv
- Oh Seong Joon, 2018, INternational Conference on Learning Representations.
- Ohrimenko Olga, 2016, USENIX Security Symposium.
- Shokri Reza, 2015, ACM conference on computer and communications security.
- Tramèr Florian, 2016, USENIX Security Symposium.
- Wang Binghui, 2018, Stealing Hyperparameters in Machine Learning. In IEEE Symposium on Security and Privacy.
Cited by
Sorted by citations
End-to-end privacy preserving deep learning on multi-institutional medical imaging
Kaissis, G., Ziller, A., Passerat-Palmbach, J., Ryffel, T., Usynin, D., Trask, A., Lima, I., Mancuso, J., Jungmann, F., Steinborn, M.-M., et al. (2021) · Nature Machine Intelligence · doi:10.1038/s42256-021-00337-8 · Cited by 513
“We note that while the data enjoys information-theoretic secrecy guarantees, the party requesting inference has access to the model’s predictions and can perform black-box membership inference 59 or model inversion attacks 60 .”
See through Gradients: Image Batch Recovery via GradInversion
Yin, H., Mallya, A., Vahdat, A., Álvarez, J. M., Kautz, J., & Molchanov, P. A. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.01607 · Cited by 519
Dreaming to Distill: Data-Free Knowledge Transfer via DeepInversion
Yin, H., Molchanov, P., Alvarez, J. M., Li, Z., Mallya, A., Hoiem, D., Jha, N. K., & Kautz, J. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00874 · Cited by 540
Vertical Federated Learning: Concepts, Advances, and Challenges
Liu, Y., Kang, Y., Zou, T., Pu, Y., He, Y., Ye, X., Ouyang, Y., Zhang, Y.-Q., & Yang, Q. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3352628 · Cited by 496
“He et al. [95] proposed a black-box MI attack to learn features x B of the passive party B under the splitNN setting by training a shadow model ˆ G B to mimic the local model G B using auxiliary data.”
BackgroundMethodInfluentialA Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning
Tian, Z., Cui, L., Liang, J., & Yu, S. (2022) · ACM Computing Surveys · doi:10.1145/3551636 · Cited by 293
“The privacy attack could be defined as malicious attempts revealing training data, such as membership inference [109, 114, 125] and model inversion [34, 45, 146, 154, 161].”
Background
Metadata
- Authors
- He, Z., Zhang, T., & Lee, R. B.
- Affiliations
- Princeton University (US)
- Nanyang Technological University (SG)
- Venue
- Proceedings of the 35th Annual Computer Security Applications Conference
- Publisher
- ACM
- Published
- 2019-12-09
- Pages
- 148-162
- ISSN
- 1063-9527 (ISSN-L)
- OpenAlex
- W2989885118
- Cited by
- 313
- References
- 48
- Citations by year
- 2026: 30 · 2025: 81 · 2024: 62 · 2023: 49 · 2022: 36 · 2021: 39 · 2020: 16
- FWCI
- 8.70
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Annual Computer Security Applications Conference (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- model inversion attacks, collaborative inference, inference privacy, privacy-preserving deep learning, data privacy, adversarial attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
