Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses
cs.CV
Submitted: 2024-02-06
Updated: 2026-09-18
Comments: Accepted by International Journal of Computer Vision (IJCV)
Code: https://github.com/ffhibnese/Model-Inversion-Attack-ToolBox
License: http://creativecommons.org/publicdomain/zero/1.0/
The gist: Deep Neural Networks (DNNs) have revolutionized various domains with their exceptional performance across numerous applications.
Terminology
Abstract
Deep Neural Networks (DNNs) have revolutionized various domains with their exceptional performance across numerous applications. However, Model Inversion (MI) attacks, which disclose private information about the training dataset by abusing access to the trained models, have emerged as a formidable privacy threat. Given a trained network, these attacks enable adversaries to reconstruct high-fidelity data that closely aligns with the private training samples, posing significant privacy concerns. Despite the rapid advances in the field, we lack a comprehensive and systematic overview of existing MI attacks and defenses. To fill this gap, this paper thoroughly investigates this realm and presents a holistic survey. Firstly, our work briefly reviews early MI studies on traditional machine learning scenarios. We then elaborately analyze and compare numerous recent attacks and defenses on Deep Neural Networks (DNNs) across multiple modalities and learning tasks. By meticulously analyzing their distinctive features, we summarize and classify these methods into different categories and provide a novel taxonomy. Finally, this paper discusses promising research directions and presents potential solutions to open issues. To facilitate further study on MI attacks and defenses, we have implemented an open-source model inversion toolbox on GitHub (https://github.com/ffhibnese/Model-Inversion-Attack-ToolBox).
Sources
- NIPS 2016 Tutorial: Generative Adversarial Networks
- Unstoppable Attack: Label-Only Model Inversion via Conditional Diffusion Model
- Language Models are Few-Shot Learners
- Scalable Extraction of Training Data from (Production) Language Models
- Defending Model Inversion and Membership Inference Attacks via Prediction Purification
- Prediction Exposes Your Face: Black-box Model Inversion via Prediction Alignment
- Extracting Training Data from Unconditional Diffusion Models
- Language Model Inversion
- Privacy Leakage in Text Classification: A Data Extraction Approach
- Are Large Pre-Trained Language Models Leaking Your Personal Information?
- Deconstructing Classifiers: Towards A Data Reconstruction Attack Against Text Classification Models
- Functional Mechanism: Regression Analysis under Differential Privacy
- Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps
- Classifier-Free Diffusion Guidance
- Variational Approaches for Auto-Encoding Generative Adversarial Networks
- On Memorization in Diffusion Models
- Extracting Prompts by Inverting LLM Outputs
- Bag of Tricks for Training Data Extraction from Language Models
- A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability
- Deep Reinforcement Learning: An Overview
Related papers
- Loss Knows Best: Detecting Annotation Errors in Videos via Loss Trajectories
- AnchorWeave: World-Consistent Video Generation with Retrieved Local Spatial Memories
- Benchmarking the Robustness of Foundation Models for Mammography under Domain Shift
- MambaX-Net: Dual-Input Mamba-Enhanced Cross-Attention Network for Longitudinal MRI Segmentation
- TeleOCR: Navigating Document Parsing Across Digital and Camera-Captured Documents
- A Survey on Efficient Vision-Language-Action Models